Best way to install/Update Flatpak packages?

User Support
1

As far as I can tell, there is no helper yet for Flatpak packages.

With that in mind, hows the best way to install/use them, and keep them up to date?

A) Make a separate template for Flatpaks. Make a separate VM for Flatpaks. Install in the template.
B) Use a standard template. Install the Flatpaks in their own VM.
C). Install Flatpaks in the VMs they are needed?

If I understand correclty, A) the Flatpaks will be updated? Right?
B

2

Have you seen this?

ā€¦but consider this:

https://flatkill.org/

Not sure what to think. Micah Lee is very knowledgeable but the criticisms of Flatpak also seem legit.

5 Likes
3

This looks like an interesting solution for less technical inclined users and those preferring the standard Fedora templates for various reasons. It does however come with the downsides you pointed to.

If one has the space and bandwidth (for the respective updates) I would recommend going with dedicated templates instead.

If one has some technical skill in installing Linux programs and resolving package dependencies of course as always: debian-minimal, apt-cacher-ng & one template per app/use case for reasons discussed many times in this forum.

1 Like
4

Yeah, I decided against using Flatpak. I arrived at my decision, ironically enough, because I donā€™t consider myself technical enough to know if itā€™s safe or not.

5

assigned to ā€˜User Supportā€™

6

To clarify: install a minimal template. Install flatpak in the an appVm of the template. Install the flatpaks in the appVm?

I imagine that the flatpaks wonā€™t update with the updater. And would need to be updated inside the appVm. And each appVm with the same flatpak would have to be updated separately?

(Turning on the network for the install, and installing the flatpaks direct in the template didnā€™t seem to work.)

1 Like
7

Sorry for being unclear: I meant NOT using flatpacks at all and instead doing a traditional install in the template.

1 Like
8

A few apps are Flatpak only. In this case I imagine the only solution is to install in an appVM and then update manually in the appVm?

9

I needed an up to date telegram app, allowed a debian clone internet installed the package then the app per the debian instructions, seems to be working, guess I could just use the clone template for the 1 app vm in which I run the telegram app,

Not sure if I looked at what version the Fedora template uses of telegram, nor if there was some kind of backport to get a newer telegram, which is an issue with debian sometimes, having older versions, did give me the idea to use disposable fedora firefoxā€™s now for a newer version ā€¦

Iā€™ve never used flatpaks before , did use backports or tried to before , maybe for youtube-dl, but tends to confuse meā€¦ or mess up my templates

10

Big thanks to Micah Lee for making such a useful app.

Qubes team, you might want to add that app to 4.1.2.

@Micahflee, msg me your XMR, ARRR address. Iā€™d like to send you some appreciation. Please continue to make such useful apps and guides.

11

So for now in 2024 year, is this criticism still legit? I am thinking about trying flatpaks too because of their advertised safety. But if itā€™s just a blown bubble, I think Iā€™ll hold off.

12

That website has a bit of bad faith. The sandboxing works fine, but some programs are not sandboxed or not tightly, this is listed in the program information on flathub.

Just make sure to avoid flatpak that are not from verified sources, this mean there are anonymous people behind it. That doesnā€™t mean the program packaging isnā€™t legit, but itā€™s not verified. For instance, Firefox flatpak on flathub is verified, this mean itā€™s made by the people making Firefox, so you should be able to trust them for not shipping malware :slight_smile:

Usually, flatpak ships vulnerability fixes pretty fast, and programs are automatically updated using compilation pipeline from sources code, itā€™s usually the first place to receive update for a new software version.

1 Like
13

Thanks. There are many different manuals for how to install and use flatpaks in Qubes. Many of them look pretty complicated. Iā€™m not sure which oneā€™s right for me. I just want to try sandboxed Telegram flatpak in some separated, dedicated for this purpose qube (most likely standalone). What method would you suggest for this purpose?

14

You could use an AppVM so itā€™s easier to maintain and add the --user flag to flatpak commands to install it under the user in /home/user/, this way it will be persistent even in the AppVM.

I wrote a detailed guide to use Flatpak for templates, but itā€™s more cumbersome for your use case that just need 1 program in 1 qube.

15

I wanted to use standalone because thought it will improve security (or privicy) while using such app as Telegram, because app qubes share the same template.

16

using a standalone may provide a bit less security than a template. In an AppVM, in the case a malware infects your computer in the template inherited files, they are just reset at every reboot, while a standalone isnā€™t partially reset.

In term of privacy, this would potentially allow an attacker to figure the programs installed in the template, nothing more.

You have all information to decide between a standalone or an AppVM now :+1:

In a standalone, just add flathub repository and install with the provided flatpak command line on flathub (just flatpak install something).

Even better, you could make a disposable from a standalone / AppVM and use telegram in it. This would work if telegram can resend you the history each time you connect.

1 Like
17

As I understand, when it comes about app qube and flatpak, you donā€™t need to install it in template. This all is performed only in app qube, right? So if I want to use only single, sandboxed flatpak app in app qube and using terminal for installation (in order not to bother with gnome) is ok for me then what manual would you suggest to follow?

18

Since Micahā€™s manual doesnā€™t work now I decided to try this one, but have few questions:

  1. In this part you say: " In order to add Flathub repository, you need to define the variable https_proxy so flatpak can figure how to reach the repository through the proxy". What proxy you mean? I use only sys-whonix as netvm. Should I specify tor proxy 127.0.0.1:9050 or it needs some special proxy? Maybe only this one that you wrote?
  2. Since I use only torified traffic, clearnet traffic is unacceptable for me. Does your method require / make any non-torified traffic? I mean some traffic that could bypass the Tor proxy without me knowing about it.
19

The ā€œproxyā€ here is the update proxy defined for the system, so if you configured sys-whonix as a proxy, it will be torrified.

20

I just re-read your manual more carefully and realized that I can avoid some hassle if I just do it all in standalone. Especially since I donā€™t want to install Telegram in template. So all I need is just to do:

  1. Add repository:
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
  1. Fix the bug:

In order to circumvent a GNOME Software bug, if you want to use it to install packages (Flatpak or not), you need to add the following line to /rw/config/rc.local:

ip route add default via 127.0.0.2

And it seems you miswrote 127.0.0.2 instead of 127.0.0.1. Yes? At least you wrote here 127.0.0.1.

  1. And reproduce the rest of paragraphs from your manual except adding update proxy (since standalone has networking enabled so it doesnā€™t need proxy).

Am I correct?