5 ms·

Flatpak builds are not reproducible and why that's a practical problem (2022)

34 points by ementally 3y ago

Joel_Mckay 3y ago
On the one hand it has all the disadvantages of static linking, and on the other hand it has all the disadvantages of out-of-band package managers. They are unfortunately a necessary evil for keeping LTS OS running.
- deleted 3y ago
  [deleted]
ibotty 3y ago
(2022), and the article was not 100% correct even then.
- logro 3y ago
  What was and still is wrong with it?
  - pringk02 3y ago
    Builds are reproduceable
deleted 3y ago
[deleted]
ementally 3y ago
Guix seems the best when it comes to reproducibility https://guix.gnu.org/en/blog/2024/identifying-software/ https://guix.gnu.org/en/blog/2024/identifying-software/
ahmedfromtunis 3y ago
That's not what bothers me. My problem with Flatpak is how huge are the downloads, especially when on a metered connection. Last month I installed Kdenlive, and the size of the downloaded files was around 3 gb, to which the app itself contributed around 40 mb. (I use Ubuntu.) A week later, I wanted to install another app (I forgot which one), but again, it was 3 gb download for 30ish mb app. And then this week I ran `Flatpak update`, and it needed yet another 3 gb to download just because there was a new Kdenlive version (again, around 40 mb)! How on earth does it make sense to have to download 10 gb worth of data just for apps that only total 100 mb?
- Am4TIfIsER0ppos 3y ago
  The goal of these things is not to write software that works but to write software that works4me. Flatpack, snap, docker they all exist to ship your computer to someone else.
  - ahmedfromtunis 3y ago
    I use Snap frequently, and yes, apps that would only take 10 mb as a .deb can balloon to 200 mb. But I can live with that; it's a reasonable price to pay for separating apps update cycles from that of the OS. I also use Docker. But even then, my Django app — complete with pytorch, numpy and several other "heavy" deps on top of python itself — is a little more than 400 mb. Flatpak is on another level by itself!
- marcodiego 3y ago
  Interesting bottleneck. Considering that flatpaks are basically small filesystems themselves, there's probably some redundancy to remove. I wonder if a simple de-duplication strategy at file level may be enough to fix that.
  - ahmedfromtunis 3y ago
    I genuinely can't understand how a 40 mb app can turn into a 3 gb monstrosity. I won't be able to do so even if I wanted to!
    - yjftsjthsd-h 3y ago
      Easy: Like most other containers, it starts by bundling an entire general purpose distro. Though I grant it is surprising that the sizes are quite that bad; perhaps there were suboptimal choices made in an attempt to make the layers more reusable but it didn't work out?
  - brennoflavio 3y ago
    In Flatpak you define the dependencies as runtimes, and they are shared between apps. So for example when you install Kdenlive it will download the entire kde framework that is huge but when you install the next kde app it won't download it again
planede 3y ago
It feels like the update at the top entirely invalidates the article. At least I don't see why pinning dependency versions at the source level would be necessary for reproducible builds.
ementally 3y ago
Related: "Flathub is insecure for distributing cryptocurrency software". https://github.com/feather-wallet/feather/issues/47 https://github.com/feather-wallet/feather/issues/47

34 points by ementally 3y ago

On the one hand it has all the disadvantages of static linking, and on the other hand it has all the disadvantages of out-of-band package managers. They are unfortunately a necessary evil for keeping LTS OS running.

deleted 3y ago
[deleted]

ibotty 3y ago

(2022), and the article was not 100% correct even then.

logro 3y ago
What was and still is wrong with it?
- pringk02 3y ago
  Builds are reproduceable

deleted 3y ago

[deleted]

ementally 3y ago

Guix seems the best when it comes to reproducibility https://guix.gnu.org/en/blog/2024/identifying-software/ https://guix.gnu.org/en/blog/2024/identifying-software/

ahmedfromtunis 3y ago

That's not what bothers me. My problem with Flatpak is how huge are the downloads, especially when on a metered connection. Last month I installed Kdenlive, and the size of the downloaded files was around 3 gb, to which the app itself contributed around 40 mb. (I use Ubuntu.) A week later, I wanted to install another app (I forgot which one), but again, it was 3 gb download for 30ish mb app. And then this week I ran `Flatpak update`, and it needed yet another 3 gb to download just because there was a new Kdenlive version (again, around 40 mb)! How on earth does it make sense to have to download 10 gb worth of data just for apps that only total 100 mb?

Am4TIfIsER0ppos 3y ago
The goal of these things is not to write software that works but to write software that works4me. Flatpack, snap, docker they all exist to ship your computer to someone else.
- ahmedfromtunis 3y ago
  I use Snap frequently, and yes, apps that would only take 10 mb as a .deb can balloon to 200 mb. But I can live with that; it's a reasonable price to pay for separating apps update cycles from that of the OS. I also use Docker. But even then, my Django app — complete with pytorch, numpy and several other "heavy" deps on top of python itself — is a little more than 400 mb. Flatpak is on another level by itself!
marcodiego 3y ago
Interesting bottleneck. Considering that flatpaks are basically small filesystems themselves, there's probably some redundancy to remove. I wonder if a simple de-duplication strategy at file level may be enough to fix that.
- ahmedfromtunis 3y ago
  I genuinely can't understand how a 40 mb app can turn into a 3 gb monstrosity. I won't be able to do so even if I wanted to!
  - yjftsjthsd-h 3y ago
    Easy: Like most other containers, it starts by bundling an entire general purpose distro. Though I grant it is surprising that the sizes are quite that bad; perhaps there were suboptimal choices made in an attempt to make the layers more reusable but it didn't work out?
- brennoflavio 3y ago
  In Flatpak you define the dependencies as runtimes, and they are shared between apps. So for example when you install Kdenlive it will download the entire kde framework that is huge but when you install the next kde app it won't download it again

planede 3y ago

It feels like the update at the top entirely invalidates the article. At least I don't see why pinning dependency versions at the source level would be necessary for reproducible builds.

ementally 3y ago

Related: "Flathub is insecure for distributing cryptocurrency software". https://github.com/feather-wallet/feather/issues/47 https://github.com/feather-wallet/feather/issues/47