consider building a flatpak for linux

[ibotty]

It would be great to have pwsafe as a flatpak. That way, installation would be easy for many distributions.

[ykne]

It is really more then trivial to compile native pwsafe package on all Linuxes, thus a need for flatpak is questionable.

[igor2x]

Flatpack has many benefits:
1 .It runs successfully on many Linux distributions (no need to manually create package).
2. I has ability to auto-update. Just execute: flatpak -y update and all flatpak applications are updated.
3. It has some isolation (sandboxing) implemented, so if some safety problem appears it may be ""stopped", because of sandbox.
4. It reduces testing on multiple Linux distributions. Test on one and it will work on all supported flatpak systems.
5. It reduces impact of a program on system stability. If program updates some library it is updated inside the sandbox and does not influences on system stability.
6. It is usually simpler to install and update to new version of program and usually with far few problems.
7. And... it works. Like in my case #940 in Ubuntu 22.10, it doesn't. This is kind of important, that application works... :-)

[igor2x]

I have created flatpak of Password Safe program. If somebody is interested, please test and report back if it is working for you.

CAUTION

Before using PasswordSafe package as flatpak I strongly suggest to make a copy of Password Safe password database file *.psafe3. I have performed some tests and haven't found any issue, but just in case if something goes wrong, you are using flatpak application at your own risk and you should have a backup.

PREREQUISITES

Make sure Flatpak is installed. On some Linux distributions Flatpak is installed by default. For example: Fedora, Linux Mint, OpenSuse, etc. But on some of Linux distributions e.g. Ubuntu, it must be installed manually. See setup instructions: https://www.flatpak.org/setup/ There are just few simple commands to execute.

BUILD, INSTALL AND USE PASSWORD SAFE FLATPAK

I created bash script to massively simplify download source code, build, install and run a Password Safe flatpak.

1. In directory you have read and write access create new directory e.g. build.
2. Make sure there are no other files in this new directory. Directory should be empty. If not, build process may fail.
3. Download make.zip file and extract it to "build" directory.
4. Assign file permissions: chmod 700 make.sh
5. Execute the script: ./make.sh

That is all. Now just wait e.g. 15 min that flatpak gets build and installed. After flatpak package is build and installed, first time it is also automatically started. If everything goes well, after few minutes you should see Password Safe GUI program. Next time you would like to start flatpak, you can do it from terminal "flatpak run com.github.pwsafe.pwsafe" or pressing Super key (also known as "Windows key") and type in: PasswordSafe and press Enter.

FLATPAK BENEFITS

1. There are 36 main distributions are supported. Each distribution has multiple spins/flawors (Gnome, KDE, XFCE, Cinnamon, i3, LXQT, LXDE, Soas, Sway, Bungie, MATE, Unity,...) lets say at least 5 of them per main distribution. Then there are multiple versions through time lets say at least 5 e.g. on Ubuntu: 16.04, 18.04, 20.04, 22.04, 22.10 and 23.04, but there are also unsupported verions as well, plenty of them. So: 38 * 5 * 5 = 950 different version-spin-distributions. This is huge and may even be underestimated. Way higher number then existing few Linux distributions that are currently supported using RPM and DEB packages.
2. There are at least 8 popular distributions that have flatpak installed as default: Fedora, elementary OS, CentOS, Endles OS, Fedora Silverblue (immutable), Linux Mint, PureOS, Zorin OS. There are more of them.
3. Flatpaks main support is on immutable operating system like Fedora Sliverblue, OpenSuse MicroOS, and many more. On immutable systems applications are not installed as RPM/DEB packages, because they can not be installed into read-only operating system's file system. There main support are flatpaks.
4. Red Hat has decided that it will not package LibreOffice in Red Hat and Fedora as RPM anymore, but instead they will support LibreOffice instead. Flatpak is moving into mainstream.
5. Flatpak applications run in sandbox. Application can not access any data outside of sandbox without explicit permissions and other flatpaks app can't access Password Safe data without explicit permissions.
6. Using portals. Flatpak runs inside sandbox. To access host files like Password Safe accesses password database file it accesses the file using portals. From end user this is just a Open dialog and selecting the file (actually process is exactly the same as in deb/rpm installed application). The only difference is, Password Safe program can only access the file, user has manually selected using Open dialog. This is for safety reasons.
7. When new version is released it, it is recognized by update system and installed e.g. through Software Center using Update button.
8. Flatpak application runs independently of operating system libraries. Everything flatpak installs is sandboxed and operating system does not get affected by flatpak libraries. And vise versa. Any update on host system and flatpaks are not affected.
9. Immutable Linux distributions (like Fedora Silverblue) operating system is installed as images. Rpm/deb package can't be installed inside that read only operating system file system. Also someone can rebase operating system image from Gnome to KDE, reboot and everything works fine if flatpaks are used, because they are installed in separate layer. Immutable distributions (to my humble opinion future of Linux distributions) have several layers: system layer as image for operating system (not package based), flatpak layer for applications, podman/docker layer for services or applications that are not installed as flatpaks (but Linux images are stipped down, so a lot of investigation is needed to install appropriate basic software) and rpm-ostree layer that for any application separately installed on top of operating system layer. This is possible, but not recommended, because if something goes wrong, then top layers must be manually removed - so they are depended on operating system layer comparing to flatpaks that are complete independent.
10. There is exactly one flatpak for any Linux distribution. Test on one distribution and it should work the same way on all others. This is massive save of time and massive stability and improvement. You would like to add new library, just add it. You don't need to investigate how will this affect all kind of different Linux distributions and versions of the same distribution. Flatpaks are running in sandbox, independently of operating system libraries etd.
11. Flatpacks were developed to give power to developers. They can package application what ever they think is the most appropriate for particular application. Middle man, package maintainer, is cut off, because there is no need to investigate and develop special solutions for each of Linux distribution and version, that maintainer has more knowleadge then developer.

FLATPAK COMMUNITY HELP

I have created Password Safe flatpak package in few days, despite starting from my zero knowleadge how flatpaks internals works. Community is very helpful, so progress is made very quickly. If you are interested the help I have got from Flathub community and the steps I took to get to the working flatpak. https://discourse.flathub.org/t/how-to-include-libraries-into-my-first-ever-flatpak/4950

LIMITATIONS

1. Flatpak should be tested in deep. I only tested the features I use, that is not whole application. No issues appeared so far.
2. I don't have YubbiKey. Some owner should test this. If there are some problems, they are probably related to permissions. Please install Flatseal flatpak and add permissions using GUI application.
3. I have set Password Safe permissions to only access $HOME/Documents folder. If you need to open/safe Password Safe password database file from some other location, you can use Flatseal flatpak to assign permissions.

QUESTION TO PASSWORD SAFE DEVELOPERS

It would be awesome, if developers are interested on maintaining future flatpak releases. It shouldn't be too much additional work. Structure of manifest file should not get changed much. If I did it with zero application development expience, then anyone can. My question to developer is, are you willing to take where I finished, and do only few steps (after do some testing), to publish package on Flathub. Process should not be too complicated. Just follow Submission chapter https://docs.flathub.org/docs/for-app-authors/submission and then all the rest Flathub project people will tell you if something additional should be made. Maybe also take a lot at the Requirements site https://docs.flathub.org/docs/for-app-authors/requirements

[ronys]

Thanks @igor2x !
I'm looking into this, starting with your manifest.

[igor2x]

I have now simplified manifest file. This should be much easier to manually update manifest file when new Password Safe version is released in future.

Updated make.zip to generate manifest file.

---

When new version of Password Safe is released do the following to build new manifest file:

1. Open manifest file com.github.pwsafe.pwsafe.yml and search for "modules" section.
2. Copy url address from manifest file and paste into web browser.
   
3. Click on "tags".
   
4. Make sure tag do not hold any "beta", "release candidate" or similar, to skip non-stable tags. Copy last tag and right click and copy link to commit.
   
5. Paste tag and commit from previous step into manifest file.
   

Now move down in manifest file and search for "-name" for new library and do all of above steps. Repeat the process for all libraries and main Password Safe program.

[igor2x]

I have updated make.zip file. New version of Freedesktop SDK was released and I changed required flatpak's SDK version from 22.08 to 23.08. Freedesktop SDK is released once per year and is maintained for 2 years, this new version up to 2025/09.

I have successfully build PasswordSafe v1.17 with this new version of Freedesktop, did some test and everything is working fine.

In my humble opinion, when proceeding on releasing flatpak on Flathub, we should start with new Freedesktop, so we can use this runtime for two years without additional testing required.

[igor2x]

@ronys I have gone through the list of Requirements and I have created all of the files required by Flathub: flathub.zip

Please do the following:

1. Unzip zip files.
2. Open com.github.pwsafe.pwsafe.xml file and fill in your contact information.

<?xml version="1.0" encoding="UTF-8"?>
<!-- Copyright 2023 Your_first_name Your_surname <your_mail@mail.com> -->
<!--
EmailAddress: your_mail@mail.com>
SentUpstream: 2023-09-09
-->

in above file change:

• Your_first_name
• Your_surname
• your_mail@mail.com
• EmailAddress: your_mail@mail.com

to your contact information.

3. Now it should be simple. Just follow Submission.
   Note: All of the files from my zip file should be in root directory of new git branch (there should be no directory).

I am willing to help if submission personal requires something additionally.

Please update this thread, if/when you create pull request on Github for Flathub.

[igor2x]

Updated make.zip file for PasswordSafe v1.18.

@ronys, I haven't got your response for over a month. Are you interested distributing PasswordSafe as flatpak? It should be pretty easy now, following my previous post.

[ronys]

Thanks for the update!
Sorry, been a bit busy. Hope to get to this over the next few days.

[ronys]

Hi,
Sorry for the delay, but I finally made the pull request to flathub: flathub/flathub#4890

[igor2x]

@ronys, no worries... I am glad you have found some time to submit it to Flathub.
I have written my suggestions in submitted Flathub pull request (link in your last post above).

From mergers comments and current Flathub documentation, it looks like Flathub submission has changed. I have collected required info like four months ago. Flathub is getting better and better, so changes are expected.

[igor2x]

@ronys, congratulations Password Safe is finally published on Flathub.org.

Password Safe can be installed as flatpak to visit https://flathub.org/apps/org.pwsafe.pwsafe

Password Safe can be installed from Gnome's Software (if flatpak is installed).

@ronys, you can close down this issue. Thanks for cooperation to make excellent tool Password Safe available as flatpak.