I am attempting to update my Flatpaks but some are failing. They download their payload but spit out an error during the install process:
$ flatpak update
Looking for updates…
ID Branch Op Remote Download
1. [✗] us.zoom.Zoom stable u flathub 295.5 MB / 302.3 MB
2. [✗] com.slack.Slack stable u flathub 138.0 MB / 143.5 MB
3. [✗] com.google.Chrome stable u flathub 129.8 MB / 139.4 MB
4. [✗] com.visualstudio.code stable u flathub 232.4 MB / 240.5 MB
Error: Error deploying: While trying to apply extra data: apply_extra script failed, exit status 256
Error: Error deploying: While trying to apply extra data: apply_extra script failed, exit status 256
Error: Error deploying: While trying to apply extra data: apply_extra script failed, exit status 256
Error: Error deploying: While trying to apply extra data: apply_extra script failed, exit status 256
Updates complete.
error: There were one or more errors
I tried uninstalling one and installing it fresh, but it fails with the same error. Fortunately I chose one that I don’t need in the short term.
I found this issue, but it doesn’t sound right to me. All these Flatpaks were updating just fine until recently, possibly right up until I upgraded to Fedora 44. As part of the upgrade process I had to unlayer RPM-fusion and then add it back in after:
I wasn’t sure if this straggling data might at least be the reason I can’t simply reinstall these applications, so I tried renaming the ~/.var/app/com.usebruno.Bruno and installing, but the same thing happened:
$ flatpak install com.usebruno.Bruno
Looking for matches…
com.usebruno.Bruno permissions:
ipc network fallback-x11 wayland x11 dri file access [1]
[1] home
ID Branch Op Remote Download
1. [✗] com.usebruno.Bruno stable i flathub 167.1 MB / 167.6 MB
error: Failed to install com.usebruno.Bruno: Error deploying: While trying to apply extra data: apply_extra script failed, exit status 256
Thanks @bryanmoore! Your suggestion revealed the problem:
sudo flatpak update --verbose com.slack.Slack 2>&1
[sudo] password for me:
F: Opening system flatpak installation at path /var/lib/flatpak
F: Opening user flatpak installation at path /root/.local/share/flatpak
Looking for updates…
F: Fetching summary index file for remote ‘flathub’
F: Loading https://dl.flathub.org/repo/summary.idx using curl
F: Received 10001 bytes
F: Loading https://dl.flathub.org/repo/summaries/eef41061405c2d6dc106993b0bce86702024138876571b54e541a3b11f86ab69.idx.sig using curl
F: Received 592 bytes
F: Fetching indexed summary file ee676c963a96f4df16ce662fcb9aace1bfd90eba441c9f820a00cd9ff66e2690.gz for remote ‘flathub’
F: Loading https://dl.flathub.org/repo/summaries/ee676c963a96f4df16ce662fcb9aace1bfd90eba441c9f820a00cd9ff66e2690.gz using curl
F: Received 1609739 bytes
F: Transaction: update flathub:app/com.slack.Slack/x86_64/stable[*]
F: Looking for remote metadata updates for flathub
F: marking op update:app/com.slack.Slack/x86_64/stable resolved to 990a977b4e227e658ef33bff9ce4d0b6bc1be38d4ed6755fc6b380d02c1a883f
F: Updating dependency org.freedesktop.Platform/x86_64/25.08 of com.slack.Slack/x86_64/stable
F: Transaction: update flathub:runtime/org.freedesktop.Platform/x86_64/25.08[$old]
F: marking op update:runtime/org.freedesktop.Platform/x86_64/25.08 resolved to a0b687431459280667d830df5c9d0f25e47b9b7d78f212a858eefac086ed2909
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.GL.default/x86_64/25.08[*]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.GL.default/x86_64/25.08-extra[*]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.Locale/x86_64/25.08[/en]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.codecs-extra/x86_64/25.08-extra[*]
F: marking op install/update:runtime/org.freedesktop.Platform.codecs-extra/x86_64/25.08-extra resolved to 7116be6864f5bfe54ccf6311a20d43616f910a3fb05c2f578a1b3dc4dc09dc0f
F: marking op install/update:runtime/org.freedesktop.Platform.Locale/x86_64/25.08 resolved to 40d64910991e3e290580e161c3719128cfe8227fbcd8a260e540c5239517c942
F: marking op install/update:runtime/org.freedesktop.Platform.GL.default/x86_64/25.08-extra resolved to c3bb4d072d8f2a5b6cee1566fd3becf5b817e6358cefda5aabbfc86d7608ff32
F: marking op install/update:runtime/org.freedesktop.Platform.GL.default/x86_64/25.08 resolved to 68b343b37bb6ddfa82518be6c32e28428f36179f1c8536d33d6fff6bc5fc79f1
F: Checking installation ‘system’ for EOL unused refs and autoprunes
F: Checking installation ‘system’ by checking for dependent refs in ‘user’
F: Checking installation ‘system’ for EOL unused refs and autoprunes
F: Checking installation ‘system’ by checking for dependent refs in ‘user’
1. com.slack.Slack stable u flathub < 143.5 MB
Proceed with these changes to the system installation? [Y/n]:
Updating…
F: flatpak_dir_pull: Using commit 990a977b4e227e658ef33bff9ce4d0b6bc1be38d4ed6755fc6b380d02c1a883f for pull of ref app/com.slack.Slack/x86_64/stable from remote flathub
Updating… 0% 0 bytes/s
Updating… █ 5%
F: Loading https://api.snapcraft.io/api/v1/snaps/download/JUJH91Ved74jd4ZgJCpzMBtYbPOzTlsD_244.snap using curl
Updating… █▌ 8% 3.9 kB/s 00:46
Updating… █▌ 8% 110.8 kB/s 00:57
Updating… ██ 10% 688.0 kB/s 00:54
Updating… ███▍ 17% 2.1 MB/s 00:34
Updating… ████▍ 22% 2.7 MB/s 00:28
Updating… █████▏ 26% 3.1 MB/s 00:25
Updating… ██████ 30% 3.1 MB/s 00:25
Updating… ███████▏ 36% 3.6 MB/s 00:21
Updating… ████████ 40% 3.8 MB/s 00:19
Updating… █████████ 45% 4.0 MB/s 00:17
Updating… █████████▊ 49% 4.2 MB/s 00:15
Updating… ██████████▊ 54% 4.3 MB/s 00:13
Updating… ███████████▏ 56% 4.3 MB/s 00:13
Updating… ████████████▏ 61% 4.4 MB/s 00:11
Updating… █████████████ 65% 4.5 MB/s 00:10
Updating… ██████████████ 70% 4.7 MB/s 00:08
Updating… ██████████████▊ 74% 4.8 MB/s 00:07
Updating… ███████████████▊ 79% 4.8 MB/s 00:05
Updating… ████████████████▌ 83% 4.9 MB/s 00:04
Updating… █████████████████▍ 87% 5.0 MB/s 00:03
Updating… ██████████████████▍ 92% 5.1 MB/s 00:02
Updating… ███████████████████▏ 96% 5.1 MB/s 00:01
Updating… ███████████████████▊ 99% 5.1 MB/s 00:00
Updating… ████████████████████ 100% 5.1 MB/s 00:00
F: Received 138014720 bytes
F: Looking for checksum 990a977b4e227e658ef33bff9ce4d0b6bc1be38d4ed6755fc6b380d02c1a883f in local repo
F: extracting extra data to /var/lib/flatpak/app/com.slack.Slack/x86_64/stable/.990a977b4e227e658ef33bff9ce4d0b6bc1be38d4ed6755fc6b380d02c1a883f-F4AOeP/files/extra
F: Opening system flatpak installation at path /var/lib/flatpak
F: /lib32 does not exist in runtime
F: Disallowing ipc access
F: Disallowing network access
F: Running /app/bin/apply_extra
bwrap: Can't find source path /etc/hosts: Permission denied
Error: While trying to apply extra data: apply_extra script failed, exit status 256
Updates complete.
error: There were one or more errors
It seems that /etc/hosts being a symlink is triggering this bubblewrap code to complain. My understanding is that it might because it’s linking to a file that is effectively outside its sandbox (in my user’s home directory).
The timing of this now makes sense because I recently symlinked my hosts file so I can maintain it via my dotfiles, since I need customizations related to toolbox access.
I tried removing the symlink and making it a plain old file and then the same update command worked! So the “Permission denied” output was very helpful in pointing to the problematic file, though a little misleading in that it’s more about not being able to follow the symlink.
I have successfully updated all Flatpaks as I was typing the above. This leaves me with one burning question, which is how to maintain my hosts file. Maybe I’ll alter my bootstrap scripts to copy it across rather than symlinking. It’s not as ideal but seems like it might be the best option.
Any thoughts are welcome, and thank you again for helping me troubleshoot this!
As I understand it, bubblewrap tries to bind-mount /etc/hosts into the sandbox and it can’t follow a symlink that resolves outside the normal filesystem hierarchy.
I think you have four options regarding “copy vs symlink:”
Copy with a bootstrap script (your current plan): This works fine, but you’ll need to remember to re-run it whenever the hosts file changes. You could automate that with a simple watch script or systemd path unit if that gets annoying.
A deploy script that copies on change: You could use something like a Makefile or shell script in your dotfiles that copies rather than links, so make deploy would keep things in sync without manual effort.
systemd-tmpfiles: You could define a rule that copies the file from your dotfiles location on boot, which would be more robust than a symlink and would likely play nice with immutability.
Just manage /etc/hosts directly via a dotfiles tool: If you’re using something like chezmoi, it can be used for files that need to be copied rather than symlinked, specifically for cases like this.
