How is it possible, that Signal still only provides a .deb package and no .rpm, or even better AppImage or Flatpak? There is an unofficial Flatpak but is it secure?
I just read through the unofficial Flathub Flatpak for Signal and it is very simple. It fetches the .deb from Signal’s website, installs it in the sandbox, and uses a launcher script to tell the OS some basic toggles like should it start minimized or should it display a tray icon. In the script it makes use of zypak, which to my understanding is to tell electron (chromium) to allow sandboxing to be handled by Flatpak. Here is the repo and the build instructions is the .yaml file.
Some projects of Signal-compatible clients and forks received a message from a Signal representrive requesting they stop distributing unofficial clients that connect to their servers.
That probably has on shilling effect on Linux distribution that may be considering building and distributing Signal in their repository.
They can’t possibly provide a package for every distro.
Signal’s model, ie keep tight control over development and distribution of the client, and the absence of federation, it well suited for Apple/Google’s stores, but not at all for open-source and Linux’ ecosystem.
AppImages run on nearly every distro. Why arw they not providing that instead of a .deb?
You are right. They can’t for every distro.
But fedora/rhel, Ubuntu/debian, and arch-based distros are the most commonly used. So they can provide official packages for those, and/or as the OP said, provide an official flatpak.
And to be fair, it’s a nice-to-have to have a better sense of trust, but given the unofficial ones are open source, it’s quite likely any maliciousness would be rooted out very quickly.
been using the flatpack for months and had no issues so far
You could try running the .deb through alien(1p), although it can be hit-and-miss if the package has a lot of scripts or dependencies.
It’s an old program that converts between .deb (Debian), .rpm (RedHat), .tgz (Slackware), .slp (Stampede), .pkg (Solaris), and LSB packages.
I don’t use it much, but it can be handy in a pinch for installing software that isn’t packaged for your distribution. Just don’t use it for anything low-level or that’s already packaged natively, or you’ll break stuff.
I have the official Signal Desktop flatpak installed through Discover. It exists.
Yeah, I think it’s that one. Does Discover pull it’s content from flathub.org?
It says “by Signal Foundation” on it and 900,000 people have installed it so it seems good enough to me.
