Flathub Finally Adds Much Needed Flatpak Feature

Key Takeaways

back when flat pack and flat hub first hit the scene most of the flat packs available were packaged by a third party and this is a fairly common practice on Linux most developers out there don't package the application for every single system maybe they'll have a Debian or a Ubuntu package maybe they'll have a fedora package maybe one or two other things but you'd be really lucky to see much else but as flat pack has been growing while you still primarily see third-party packaging a lot more developers are becoming interested in maintaining their own flat pack this ensures that users out of the box get the experience intended by the developers assuming nothing else goes wrong in flat pack which for one of these um certainly has happened OBS Studio but other official apps are things like proton tricks or Firefox but without going and doing research there is no way you can tell at a glance if this is by a third-party developer or the official developers of the project there is some information on here about the developer and publisher but sometimes there's information missing sometimes it directs you to another site it's not entirely clear and this is where beta.flat hub.org comes in we've talked about this site plenty of times in the past this is basically a testing ground for the main flat Hub website it allows you to try out new features and new additions that may not be in the best of States and get feedback from the users in a public forum without breaking your main site with features that haven't properly been tested and as such anything that happens here is completely subject to change and as of a few days ago they added in a really big change a section for verified applications so here are some of the same applications from earlier here is OBS here is proton tricks and here is Firefox and as you can see they all have a marker here indicating they are verified and why reinvent the wheel just copy what Twitter does and the key night among you may have noticed why I picked these three applications they all have a slightly different kind of verification let's start with OBS this is a website verification it says the name of the website obs project.com and if you hover over the verification symbol the ownership of the com.obs.project application ID has been verified using obsproject.com the second kind of verification is a repo verification it says the name of the developer and the platform they're using in this case GitHub the ownership of the com.github.madoking.protontricks application ID has been verified by at matterking on GitHub and the Third Kind of verification just says verified the ownership of the org.mozilla.firefoxapplicationid has been manually verified by flat Hub staff now while it's obvious the Third Kind of verification is manual with the first two it's mostly automatic for the flat Hub staff so when you first upload a flat pack on the flat Hub there is some information you're required to give things like the name of the project the project website the license where the Manifest for the flat pack can actually be found and a bunch of other things you can optionally add you can choose to add extra things like contribute translations and Reporting issues and things like that but the main two important things are the project website and if the project is open source the repo for the project not the repo for the flat pack the repo for the project itself now the easiest is probably repo verification like matter King is done on fight her beta you can have an account this account is set up by linking various accounts GitHub gitlab good gnome get lab and I can imagine other things being added into the future and if the project you have in this case being proton tricks is on your connected account then that project can be verified whereas website verification involves a little bit more work obviously there's no like sign in with the web site to verify you own the website that just doesn't make any sense so the way that this is done is you're given a little marker a little token to include on that website and if that token is on the website then the project can be verified and having both of these options is great because while a lot of massive projects like OBS are going to have their own project website a lot of other stuff the project website is also the repo like with proton tricks even though this is a fairly popular application it doesn't have its own dedicated website giving both those options gives a lot of freedom for how you want this to be done and gives you the same result in the end and also they're both kind of as abusable as each other both of these also make it fairly easy for a project outside of the developers of the main project to be recognized as the official developers of the flat pack for example with OBS this started as a whole separate project by a bunch of developers that weren't connected with OBS eventually OBS recognized them as you know a good idea and brought them into the project and made it official but if it was still a separate repo because they are doing website verification it can still say this is the official flat pack while all of this stuff is great and it's great to recognize Developers for the work they're doing verification isn't without its drawbacks so you can have an application that is malicious that is also verified because the developer of the malicious program is the one that put it onto flat Hub now you can't just go and randomly uplift things to Flat Hub it's not like the Aur if something is going to be uploaded it is going to be screened and generally that is gonna get rid of the malware but every repo out there has had at least one or two cases of something slipping through I don't think flat Hub has just yet but it may happen in the future so don't just go and blindly install things just because they're verified know what you're actually installing but even if it's not malicious there are still some cases where an application shouldn't be verified in that case a flat Hub staff member can veto block or manually verify any applications they want to as we saw they did manually verify Firefox however there has already been one weird Edge case where something did need to lose its verification there is a project on flat Hub called WhatsApp for Linux Now WhatsApp is not officially on Linux and as you can tell by the developer name here this is not the official developer of WhatsApp but initially this was verified and not because of a bug but because they are the devil developer of WhatsApp for Linux an unofficial WhatsApp desktop application for Linux so should this person be verified or shouldn't they be now for most applications I would argue yes they should the issue is WhatsApp is a brand name that people are aware of if you see WhatsApp for Linux you probably assume that's being developed by the WhatsApp developers and not some random person on GitHub but this is exactly the reason why we have flat Hub beta to answer questions like this and work out how verification should really be handled the way that I think it should be done is if this application was like a third-party Discord client and called it something like I don't know um friend chat or better Discord or something that makes it very clear that it's related to the project possibly but still not officially that thing in that case verification makes sense but for this I think they made the right call you could make the argument that because it says in the description unofficial WhatsApp desktop application maybe that's fine and maybe that's enough to distinguish it from WhatsApp but I don't think most people read past the title to make sure it's what they want to install my honest suggestion to the dev is just change the Project's name not just because a flat Hub changed the name because at some point in the future if the WhatsApp legal team finds out your project exists you are going to get a very angry email they own the name WhatsApp and they're going to be in the right one that happens and I don't want to see a project like this just disappear off the internet but with that out of the way I think think generally if the flat Hub staff are paying attention to what is being verified this is just a good thing it's going to make it a lot clearer uses what is being developed by the official developers and a lot of other marketplaces online use a fairly similar system while I said earlier they were copying Twitter in some ways it might be more accurate to say they're just copying Visual Studio Marketplace it pretty much uses the exact same text GitHub has a verified ownership for the domain github.com if we go to OBS Studio the ownership of the project application ID has been verified using obsproject.com it's pretty much the same thing and there's nothing wrong with that it's a system that works hopefully before this hits the main site if it ever does as I said subject to change they do have very clear guidelines of what can be and what can't be verified most cases are going to be fairly simple you develop proton tricks proton tricks is just proton tricks it gets verified you own the website for OBS Studio OBS Studio gets verified but the edge cases are where you really need guidelines for because if they don't have guidelines verification will disappear from a random project leading to a giant drama on Reddit and no one likes drama on Reddit unless you're not the one being targeted but let me know your thoughts in the comment section down below do you care about verification are you a flat pack developer and are going to make use of this are you a third-party flat pack developer and maybe trying to make your project officially part of the main project I would love to know and if you like this video remember to go and like the video and if you really like the video and you want to become one of these amazing people over here go check out my patreon Scrabble link down below that's gonna be it for me and I'm out [Music]