Free desktop application distribution and installation

[Matthias Klumpp]

Hi there!

2014-12-09 0:02 GMT+01:00 Thomas Kluyver <thomas at kluyver.me.uk>:
> This may be a pipe dream, but XDG is the best place I know to propose
> something like this:
>
> We need a new mechanism for distributing end-user applications on free
> desktop platforms.
> [...]

There are already some solutions for this - most notably 0install and
some application-specific installers, but also some new approaches
like the one of the systemd crew and Limba, my own approach to this
problem.

> So, I would like a mechanism whereby:
>
> 1. Developers can publish applications without going through distro
> maintainers. This could either be self-hosted installer files, or a
> centralised location where you're free to claim a name (like PyPI, CPAN,
> etc.)

This is supported by 0installer and in progress for Limba. I am pretty
sure the systemd solution will have something like that as well.

> 2. When the user installs an application, it can set up command line tools
> on $PATH and .desktop files to launch the application from the GUI.

Meh, manual interventions are bad, fiddling with $PATH especially.
Most solutions implement some logic for software integration.

> 3. Applications can be installed into ~/.local without giving them root
> privileges

This actually has some security implications, e.g. a malicious
software can taint the other applications and use them to hide itself.
It also leads to some kind of annarchy on one system, where different
users are running different software versions (and combinations of
them).

> 3.a For bonus points: capabilities based security, because root is not the
> only thing we care about: http://xkcd.com/1200/

There is a really great sandboxing solution under construction - once
kdbus is merged into the kernel (and large chunks of data can be
transmitted via it), we get something which is able to perform these
tasks.

> 4. The installer should be able to specify dependencies on system packages
> for any relevant packaging systems, because the developer shouldn't be
> forced to bundle dependencies any more than they should be forced to
> unbundle them.

Heh ;-) Originally, I believed in something like this, today I am
thinking that this might not be the best idea. I did another 3rd-party
app installer based on that concept, called Listaller, and the
complexity of this approach was enormous. Also, the slight differences
between different distribution packages will create a huge test matrix
and additional error sources, which application developers will
receive bug reports for.

> 5. A user with an application installed should be notified of updates,
> without every application having to implement its own update checker and
> downloader.

Agreed. In progress for Limba, realized in 0install and Listaller. I
haven't heard plans about this from the systemd solution.

> 6. Ideally, all of this should be an addition to a tarball, so sites can
> offer a single .app.tar.gz file, and users without the installer mechanism
> can extract the files and launch the application manually.

Why should they want to do that? This would not only have all problems
described in 3., but also have other technical difficulties. E.g. you
have version 1.0 of application X which creates some configuration in
your home directory. Then you decide to "test" version 2.0 that way,
which migrates your configuration to a higher version. Then you decide
to switch back to 1.0, or simply launch 1.0 because you forgot about
the local copy. Version 1.0 can't read 2.0 configuration or in the
worst case might even corrupt it, and then you have new trouble.

> 7. This should, of course, be distro and desktop independent. We definitely
> can't afford to fragment it by GNOME vs. KDE, or Debian vs. Red Hat.
> Applications should have *one* button to download for Linux.

Yeah, would be nice - future will tell ;-)

> I am working on an end-user application, and I will try to build something
> like this and test it by distributing that (glossing over 3a and probably
> skipping 5 for the first iteration). Feedback, offers of help, and telling
> me about similar things that already exist are all welcome.

I would recommend you to try my Limba project (obviously!) - it is
still in a very early phase of development, and you need a Linux
kernel with OverlayFS support (ideally Linux 3.18) to run it, but you
should definitively give it a try.
0install is also a good solution, which is already mature.

Here are some pointers on that matter, if you are interested in diving into it:

The systemd crew approach:
Lennarts analysis of software distribution:
http://0pointer.net/blog/revisiting-how-we-put-together-linux-systems.html

Limba:
Announcement: http://blog.tenstral.net/2014/11/introducing-limba-a-software-installer-experiment.html
Package build instructions:
http://blog.tenstral.net/2014/12/how-to-build-a-cross-distro-package-with-limba.html

0install:
http://0install.net/
Note: 0install has a much larger scope, as it aims to be a
cross-platform installer, which not only works on Linux.

Misc stuff:
The Glick2 design document: https://people.gnome.org/~alexl/glick2/
Listaller: http://listaller.tenstral.net/

There are also other approaches helping software distribution on
Linux, e.g. GNOME SDK and the KDE Frameworks effort.
That field became pretty busy in the past months.

If you have any questions, please ask! Of course, help is also wanted
(pick the project you like most).
Cheers,
    Matthias Klumpp

-- 
Debian Developer | Freedesktop-Developer
I welcome VSRE emails. See http://vsre.info/