3 ms·

Isn't this good? I mean if you are a distribution you compile the software yourself so you can add the distribution keys (there are some that don't compile stuf

Isn't this good? I mean if you are a distribution you compile the software yourself so you can add the distribution keys (there are some that don't compile stuff ). Probably you are thinking there should be atext file in your home where you could add new signature to be sued, but that could be a security issue so probably needs to be something more safe,did any serious patch was sent to improve this and was it rejected or why we expect Canonical to prioritize this over other issues?

msla 6y ago
> Probably you are thinking there should be atext file in your home where you could add new signature to be sued, but that could be a security issue so probably needs to be something more safe,did any serious patch was sent to improve this and was it rejected or why we expect Canonical to prioritize this over other issues? If someone can replace that text file, they can replace the binary the key is compiled into.
- gjsman-1000 6y ago
  Yeah, but this isn't really any worse than APT or RPM at the moment. More like, if they can change the text file, you've got bigger problems.
- simion314 6y ago
  Apt has utilities for managing keys, You could keep it simple with plain text file that anyone can read and write but some dude can paste the wrong thing and corrupt the file, or you need to update the format and old scripts would corrupt the file etc. It can be done but as a developer I put in my code constant numbers and paths because there is not enough of a reason to justify the effort to save this values somewhere else. From the article it seems that there is not enough interest from distributions to have their own app store so there is no justifications to prioritize this feature over other ones.
Conan_Kudo 6y ago
No, this is incredibly bad. Think about the pain we're all going through to rotate UEFI certificates. There is almost no system where this is worth it.
solarkraft 6y ago
No matter who you are, having to maintain a patched version of Snap just to use your own software is absolutely ridiculous. I knew things were bad around Snap, but I didn't think they were attacking their feet with such fire power.
- simion314 6y ago
  You do not need that, you can just use a flag snap install --dangerous /path/to/snap
  - pantalaimon 6y ago
    But then you won’t get updates for that Snap
    - simion314 6y ago
      So you want something like a PPA? Is flatpack promoting each app will have it's own repo(Skype.Dropbox,Slack,Discord?) Seems to me that you want a way to have applications and updates installed by people and bypass the review process? If you are a distro maintainer you can change the hardcoded values before you build(distros always change this stuff) but if you are not a distro then you should either submit the app for review or do what other apps do and prompt a notification that a new update is available with a link to a download page.
      - vetinari 6y ago
        > Is flatpack promoting each app will have it's own repo(Skype.Dropbox,Slack,Discord?) Flatpak CAN support the scenario, where each app can have it's own repo. It's an option, not forced down your throat. Or you can self-host your private repo (e.g. applications used inside your network) IN ADDITION to public repos. > Seems to me that you want a way to have applications and updates installed by people and bypass the review process? Yes, I want to have Canonical out of the way. They can have their own repo if they really want; those who want curation by Canonical are free to use it. But I want to have options of different repos, with different curators. Canonical doesn't deserve to be the single gatekeeper between me and the apps. > If you are a distro maintainer you can change the hardcoded values before you build(distros always change this stuff) but if you are not a distro then you should either submit the app for review or do what other apps do and prompt a notification that a new update is available with a link to a download page. And this attitude is going to be a major reason why most distributions and users won't adopt snap. It will die the same way as other Canonical dead-ends did, while damaging the Linux ecosystems for a few years.

msla 6y ago

> Probably you are thinking there should be atext file in your home where you could add new signature to be sued, but that could be a security issue so probably needs to be something more safe,did any serious patch was sent to improve this and was it rejected or why we expect Canonical to prioritize this over other issues? If someone can replace that text file, they can replace the binary the key is compiled into.

gjsman-1000 6y ago
Yeah, but this isn't really any worse than APT or RPM at the moment. More like, if they can change the text file, you've got bigger problems.
simion314 6y ago
Apt has utilities for managing keys, You could keep it simple with plain text file that anyone can read and write but some dude can paste the wrong thing and corrupt the file, or you need to update the format and old scripts would corrupt the file etc. It can be done but as a developer I put in my code constant numbers and paths because there is not enough of a reason to justify the effort to save this values somewhere else. From the article it seems that there is not enough interest from distributions to have their own app store so there is no justifications to prioritize this feature over other ones.

Conan_Kudo 6y ago

No, this is incredibly bad. Think about the pain we're all going through to rotate UEFI certificates. There is almost no system where this is worth it.

solarkraft 6y ago

No matter who you are, having to maintain a patched version of Snap just to use your own software is absolutely ridiculous. I knew things were bad around Snap, but I didn't think they were attacking their feet with such fire power.

simion314 6y ago
You do not need that, you can just use a flag snap install --dangerous /path/to/snap
- pantalaimon 6y ago
  But then you won’t get updates for that Snap
  - simion314 6y ago
    So you want something like a PPA? Is flatpack promoting each app will have it's own repo(Skype.Dropbox,Slack,Discord?) Seems to me that you want a way to have applications and updates installed by people and bypass the review process? If you are a distro maintainer you can change the hardcoded values before you build(distros always change this stuff) but if you are not a distro then you should either submit the app for review or do what other apps do and prompt a notification that a new update is available with a link to a download page.
    - vetinari 6y ago
      > Is flatpack promoting each app will have it's own repo(Skype.Dropbox,Slack,Discord?) Flatpak CAN support the scenario, where each app can have it's own repo. It's an option, not forced down your throat. Or you can self-host your private repo (e.g. applications used inside your network) IN ADDITION to public repos. > Seems to me that you want a way to have applications and updates installed by people and bypass the review process? Yes, I want to have Canonical out of the way. They can have their own repo if they really want; those who want curation by Canonical are free to use it. But I want to have options of different repos, with different curators. Canonical doesn't deserve to be the single gatekeeper between me and the apps. > If you are a distro maintainer you can change the hardcoded values before you build(distros always change this stuff) but if you are not a distro then you should either submit the app for review or do what other apps do and prompt a notification that a new update is available with a link to a download page. And this attitude is going to be a major reason why most distributions and users won't adopt snap. It will die the same way as other Canonical dead-ends did, while damaging the Linux ecosystems for a few years.