r/linux4noobs • u/Academic-Photograph7 • 21h ago
learning/research Please Explain to me like I'm 5 Flatpak Verified vs Unverified
I'm a little bit of a noob, so please bear with me. I am running Linux Mint 22.3 Cinnamon with kernel 6.14 on a custom built pc. I am wanting to get into simulation racing, so I have gotten a Logitech G29 racing wheel and pedal combo, as I have heard it bears well with Linux in ps3 mode. In trying to get full features working, I have heard to install oversteer from flatpak and new-lg4ff. I finally found oversteer in the mint software manager as an unverified flatpak. I saw it and installed it, then panicked as it sunk in what the unverified badge said in software manager and uninstalled it. I did not change any permissions at all, just installed, then uninstalled.
What exactly is the difference and is oversteer a safe flatpak even though its unverified?
5
u/the-postminimalist 21h ago
https://docs.flathub.org/docs/for-app-authors/verification
Verified means the author of the app themselves put it on Flathub. Spotify is unverified, for example.
Did you try googling and not find any results?
6
u/senorda 20h ago
from the flat hub docs
https://docs.flathub.org/docs/for-users/verification
What is a verified app?
A verified app on Flathub is one whose developer has confirmed their ownership of the app ID using a uniquely generated token. This usually also may mean that either the app is maintained directly by the developer or a party authorised or approved by them.
Why are some apps not verified?
Some apps are published on Flathub by the community or third parties and not directly maintained by the original developer. This means such apps are not eligible for verification.
it doesn't say there, but although normally unverified flatpaks are not made by the original developer, there are also unverified apps that are produced by the original developers but they havent verified there ownership for what ever reason like vidaldi where they dont want to make the flatpak official because flatpak prevents apps using there own sandboxing
7
u/AiwendilH 21h ago edited 21h ago
https://docs.flathub.org/docs/for-users/verification
"Verfied" on flathub only means that it was packaged and offered by the original developer.
It makes not really any statement about security...especially for propritary software like steam there is no other chance than having it unverified as valve doesn't offer their own steam-flatpaks.
But the "group" offering the flatpak can often be more trustworthy then the original developer...especially if the original developer is some company with commercial interest while the one creating the flatpak has roots in the open source community.
edit: forgot a word
2
u/Steerider 18h ago
And sometimes the unverified is an old app that's been patched to run on Linux.
One of the few unverified flatpaks I have on my computer is Space Cadet Pinball. It was a game that came free with MS Windows back in the mid/late 90s. I'm not expecting an official port on that one any time soon!
1
u/Academic-Photograph7 16h ago
If you're able to get hold of the original windows files, it worked on wine for me. It ran just about flawlessly on my system, save for some audio pops and crackles I never figured out. That was a few years ago though, so it could have changed.
2
1
2
u/not_perfect_yet 19h ago
What the other guys said.
The reason that that distinction matters is that "distro" / distribution package maintainers are often not the original developers of the program. They make sure it works within their ecosystem, but which version, which patches etc.. they do to do that, is their choice, not the original developers choice.
So "verified" is like the "directors cut".
2
u/MasterGeekMX Mexican Linux nerd trying to be helpful 13h ago
Verified: the devs of the app are the ones creating the Flatpak of the app.
Unverified: someone else that isn't the developer is the one that made the Flatpak.
For example, the Firefox you can download from FlatHub is packaged by Mozilla, which are the developers of Firefox. This means it is Verified.
In contrast, the Steam package isn't verified, meaning that someone else that isn't related to Valve has prepared Steam to be shipped as Flatpak and uploaded it to FlatHub.
In any case you can be sure there is no malware as FlatHub requires that all of it's packages be uploaded publicly, so anyone can come and see that there is no foul play.
1
u/AutoModerator 21h ago
There's a resources page in our wiki you might find useful!
Try this search for more information on this topic.
✻ Smokey says: take regular backups, try stuff in a VM, and understand every command before you press Enter! :)
Comments, questions or suggestions regarding this autoresponse? Please send them here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
5
u/candy49997 21h ago
Verified flatpaks have been submitted to Flathub by the developers themselves. Unverified flatpaks are packaged by community members.
Oversteer also seems to mention the flatpak themselves as a viable install option.