ostree VS pkg2appimage

Ansible makes mutable changes to the OS, task by task.

Nix is immutable. A new change is made entirely new, and only after the build is successful, all packages are "symlinked" to the current system.

Fedora Silverblue is based on ostree [1]. It works similarly like git, but on your root tree. But it requires you to reboot the whole system for the changes to take effect. Since Nix is just symlinked packages, you don't need to reboot the system.

More detailed explanation here [2].

[1]: https://github.com/ostreedev/ostree

[2]: https://dataswamp.org/~solene/2023-07-12-intro-to-immutable-...

This one is for the ostree bug currently ongoing: https://github.com/ostreedev/ostree/issues/2900

This sounds related to the ostree bug.

I definitely agree that immutability offers considerable value in regards to improving security. But arguably it's insufficient to pull the win over mutable Fedora due to the losses caused by the inability to install the kernel-hardened package and the lack of UKI (Unified Kernel Image) support.

Other hardening guides mention a Unified Kernel Image as another measure to further improve security. Unfortunately, once more, this is (currently) not supported on Fedora Silverblue. I haven't seen it being done on openSUSE Aeon either. Though, once again, I'd love to be corrected!

The fedora crew is working on it through ostree though, so both fedora Silverblue and flatpak will be getting it (as well as true immutability) in the future: https://github.com/ostreedev/ostree/issues/2867

Aside from what has already been mentioned, Unified Kernel Image isn't supported (yet).

The pkg2appimage script exists to do these conversions with many examples https://github.com/AppImageCommunity/pkg2appimage/tree/master/recipes

NOTE: I've built it using the recipe available at https://github.com/AppImageCommunity/pkg2appimage, added libunionpreload from https://github.com/project-portable/libunionpreload and some additional paths to LD_LIBRARy_PATH into the AppRun, just tested on Debian and Arch Linux... and works great!

Beyond all, my work is heavily focused on compiling AppImage from existing .deb packages through the use of pkg2appimage and appimagetool, as unofficial AppImage packages not present on AppImageHub are provided, but taken from fairly reliable sources ( Debian repositories, or in some cases a PPAs for Ubuntu). The sources are available via the -a or -w options of my scripts.

Does anyone actually do that? The official documentation says not to do that (see here). Also, the excludelist mentions a couple of problems that happen when certain libraries are bundled in an AppImage.

It sounds like there might also be at least some support for portable Linux formats on Mac: snap appears to allow installing on mac via brew, but it sounds like appimages and flatpaks cannot run on mac. that said, i haven't used snaps on mac nor have I ever heard of anyone who does so... so no clue if they work well there.

PS: yes, I know that better sources for this are already available, for example the Slackware repository and woolyss, but actually the more recent version, the 97, for old i386 machines is provided by Debian (ArchLinux32 has the v90, and other versions are quite buggy for this architecture, see this issue). Unluckily there is not a 32 bit version of pkg2appimage, if we had one or someone can fork better the main script, we can still have more appimages for old architectures, being many of my scripts for x86_64 wrote to support pkg2appimage (as you have already seen in my previous post).

If I have time enough, I wanna try to create a script that automatizes all the processes, also for you developers, but my knowledge is limited to the download of packages from Debian and derivatives or from Arch Linux to create these structures, I'm not much good in compiling these programs by myself into a chroot, I'm just an enthusiast.

Depends on who makes them, but generally everything besides this list

Brave doesn't officially provide any AppImages. There is a issue on GitHub tracking this, but it's definitely not their top priority right now. You can use pkg2appimage to produce an AppImage of Brave or use existing ones available on this GitHub repository. Keep in mind that these are unofficial sources that I don't recommend to use, but if you really want to, at your own risk.