Package installer

[pmzhou]

Thanks for this slick OS but i have a few rants. Flatpak does not seem to satisfy the need of many apps for now. I think apt or dpkg should have been left available as a second option in the OS.
I needed to install curl and looks like every step you try there’s something missing that you can’t satisfy.
You can’t install curl because you need a compiler, compiler won’t install because blah blah blah. A bit frustrating.

[egrath]

Even if it’s not a complete solution - once you get used to the way how flatpaks are built, it’s relativeley easy to build it by yourself (and then share with the world).

Let’s make it together for curl

Creating the Build Manifest

The first step is the Manifest, which is essentially a description on how to build the application, e.g.:

1. Where to get the sources and the dependencies
2. Which SDK to use
3. How to build the application

To figure out how to build it, i usually download the sources, extract them and then run the SDK manually via:

flatpak run --command=sh --filesystem=host org.freedesktop.Sdk//18.08

Then try to run the usual ./configure; make commands to see if everything compiles out of the box. In case of Curl, this was the case.

The next step is to acutally write the Manifest, which is a Json formatted file. For Curl it’s as simple as:

{
    "app-id": "com.github.curl",
    "runtime": "org.freedesktop.Platform",
    "runtime-version": "18.08",
    "sdk": "org.freedesktop.Sdk",
    "finish-args": [
        "--device=all",
        "--share=ipc",
	"--share=network",
	"--filesystem=host"
    ],
    "command": "curl",
    "cleanup": [
        "/include",
        "/lib/pkgconfig",
        "/share/aclocal",
        "/share/man",
        "*.la", "*.a"
    ],
    "modules": [
        {
            "name": "curl",
            "buildsystem": "autotools",
            "sources": [
                {
                    "type": "archive",
                    "url": "https://github.com/curl/curl/releases/download/curl-7_64_1/curl-7.64.1.tar.gz",
		    "sha256": "432d3f466644b9416bc5b649d344116a753aeaa520c8beaf024a90cba9d3d35d"
                }
            ]
        }
    ]
}

The Details of the various key/values pairs and their meaning can be examined in depth in the manual (https://manpages.debian.org/testing/flatpak-builder/flatpak-manifest.5.en.html and http://docs.flatpak.org/en/latest/building.html)

Call this file “com.github.curl.json”

Building it

Now we can let flatpak-builder do its work and build us an flatpak from this manifest. Invoke the builder with:

flatpak-builder --force-clean --install-deps-from=flathub build com.github.curl.json

Make a test run

It’s time to test our build. First of all, spawn a shell in the build-sandbox:

flatpak-builder --run build com.github.curl.json sh

and then simply run curl with your desired parameters

Deploy it to a repository and install it

To make it available to the flatpak enviroment, you need to first deploy it to a repository:

flatpak-builder --repo=repo --force-clean build com.github.curl.json

… and then add this repository to your local list of repositories:

flatpak remote-add --no-gpg-verify --user curl-repository repo

… and now it’s time for installation:

flatpak update
flatpak install --user curl-repository com.github.curl

Make it more comfortable

Now we could run flatpak run com.github.curl, but thats unintuitive. Add the following line to your ~/.bashrc to make it an alias:

alias curl="flatpak run com.github.curl"

Endnotes

You may ask, what are the advantages of having such a complex way of getting and building applications? Security and comfort is the answer.

In a more or less ideal world, application developers have to supply you with exactly one build of their application and it runs on any PC. Windows has this since DOS days, download a ZIP file which contains everything to run the application, extract it and simply run it. Linux traditionally has a completely different approach, which works well for power users and system administrators but not for people who simply want to get their stuff done. For that (and the other, following) reason, flatpaks and snaps¹ were invented. Build it once, deploy it everywhere (everywhere means any Linux Distribution supporting flatpaks)

The other reason is security. In a flatpak, everything runs in a constrained sandbox with well defined interfaces to the rest of the system. So, normally a malicious application can not do to much harm to the rest of the system - if you do not allow or override it manually with flatpak override.

¹: Snap is the Ubuntu alternative to Flatpak and suffers from NIH-Syndrome.