com.bitwarden.desktop VS snapd

> One thing I don't know about (which maybe somebody can inform me/us about): the wiki states that PRs are reviewed by Flathub reviewers, but I see no sign of human review on e.g. https://github.com/flathub/com.bitwarden.desktop/pull/167 (or others in that repo). What's the actual process?

In this case, I think the lack of human involvement is mostly a good thing. Flathub was criticised for having outdated packages[1]. Using automation to automatically update packages is mostly a good thing.

Obviously, we want to see thorough review of new packages, but that's a separate issue.

[1] I thought I read this in an LWN article, but I can't find it. But see e.g. https://github.com/flathub/org.qutebrowser.qutebrowser/issue...

for example, bitwarden's flatpak on github shows basically just repackages the official debian build into a flatpak build. in this case i think it's pretty safe (in fact i use the flatpak).

You might also be interested in learning a little about Flatpaks and downloading/installing programs from Flathub. I'll give you the basic background: It's an alternative (in some ways, honestly, modern) way of installing programs that can be sandboxed/permissioned. It's a way of releasing software that also helps ensure compatibility across a wide variety of systems. It's also a way of releasing software that can update independently from the base installation. You can think of it sort of like an app store on a phone where the programs are a bit self-contained and can update independently from the phone's operating system. https://flathub.org/apps/details/com.bitwarden.desktop

See https://github.com/flathub/com.bitwarden.desktop/issues/63

Example of an application but with Electron: https://github.com/flathub/com.bitwarden.desktop

Since we're on the subject, you can also host your own BitWarden if you wanted. Bitwarden also has a desktop client for Linux as well. Alternatively if enabled 3rd Party Repositories or just manually enabled Flathub, you can install the Bitwarden flatpak.

It's not really that much of a risk. If you look at the yaml file you can see exactly what permissions it requests and what happens when the package is built.

Luckily, Flathub is transparent in what manifests are used in the production of the Flatpaks they host. For example, this is the one for Bitwarden. You can take some time to learn how Flatpaks are built, but this one seems pretty straight forward. They are taking the .deb file from Bitwarden's github release page and extracting the executable from there. Then it adds a couple extra files, which are viewable within the manifest file, to make it into a Flatpak app.

Oh don't get me started on that. I use Firefox on a work machine and I spent a number of hours troubleshooting why it couldn't access the Internet when I was connected on VPN.

I suspected it had something to do with snapd, so I downloaded the .tar.gz release of Firefox and it worked. I kept investigating and figured it must have something to do with snap.firefox.firefox apparmor profile because the VPN client was symlinking the /etc/resolv.conf to /opt/.../resolv.conf

However, updating the apparmor profile didn't help so I ultimately realized that snap has a hardcoded list of mounts that it mounts into the app container [1] and there's no way to change this.

There are a number of reasons to hate on snapd, but this almost made me flip the table.

[1]: https://github.com/snapcore/snapd/blob/3a88dc38ca122eba97192...

https://github.com/snapcore/snapd - snapd itself

you know this is false right , snap is opensource https://github.com/snapcore/snapd

So there's a PR opened to fix this here: https://github.com/snapcore/snapd/pull/12845

Of course, nothing's stopping anyone from contributing more complete selinux support. Looks like they take external pull requests in a pretty straightforward manner.

the system is actually open https://github.com/snapcore/snapd, its just the url they use is their own

That's not true. The git is here.

thanks for that. Following your link I arrived at https://github.com/snapcore/snapd/pull/12495 which covers the code. 22 commits, 19 files touched, this was a big job which indicates a little bit of a design miss, it will be very good to have this. It's the last remaining piece of "firefox snap sucks" I think.