Proposal: Enable Flathub by Default

[catanzaro (Michael Catanzaro)]

@chapien

Suppose the default behavior is changed to be a filtered Flathub list. Would there still be a setup option that would enable the full Flathub library? ie Default is Flathub “open source”, with an option for third party/full Flathub. Second, would enabling the full repository later require going to Flathub’s website and following their steps for enabling their repo, as I believe it does now?

I would not offer any option to enable the full Flathub library. What I would do is change the existing “enable third-party repositories” setting to an “enable searching for proprietary software” setting; that would allow searching for the proprietary subset of Flathub. Open source software that is not built from source should be just entirely unavailable, unless you go to Flathub’s website and follow the command-line instructions to build it.

Flathub doesn’t currently have a subset for “open source but not built from source,” so this would require changes on Flathub’s end to implement. (I don’t think we want to use fedora-flathub-filter for this.)

@misc

There is still the question of patents and liabilities that arise from them. IIRC, that was the main reason for not enabling Flathub by default, and I have no knowledge of a recent substantial legislative change that would have changed the status quo.

Fortunately, I can confirm that Fedora Legal is fine with us enabling all of Flathub. We have no legal restrictions here whatsoever.

@tqcharm

I wonder if such apps were still considered open source. Because if they would be marked as proprietary by Flathub, then this should be no issue, since the user is provided with the information that no source code is available. Those could even be filtered out by default, and given an opt-in option.

These apps’ appstream metadata indicates that they are considered open source. And that’s not entirely unreasonable, because they are open source. We just have to hope that whoever built it is not malicious, and that their computers are not compromised.

@siosm

Citation needed. This is a commonly repeated argument without actual proofs or statistics. if there are so many, it should be easy to make a list of those.

Reference

I only have this list of a few examples, not statistics. We need to be confident that we know of ALL such examples.

Note that I’m not worried about stuff like Firefox that has its own trustworthy build infrastructure separate from Flathub. (I’m not sure about OBS Studio; we’d need to evaluate that one carefully.)