Skip to content

Commit

Permalink
chore: sorry codeql
Browse files Browse the repository at this point in the history
  • Loading branch information
Jabster28 committed Sep 16, 2024
1 parent fa319ac commit 884a0eb
Show file tree
Hide file tree
Showing 2 changed files with 30 additions and 11 deletions.
9 changes: 4 additions & 5 deletions desktop/package/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,3 @@

# Building installers

Follow these instructions to create installers for the Haveno Java desktop application on each platform.

> **Note**
Expand All @@ -15,7 +12,8 @@ From x86_64 machine:
3. Confirm prompts.
4. Path to installer is printed at the end. Execute to install: `sudo dpkg -i <path>.deb` or open `<path>.deb` with Software Install.

Note: Please see [flatpak.md](../../docs/flatpak.md) for information on distributing Haveno via Flatpak.
Note: Please see [flatpak.md](../../docs/flatpak.md) for information on
distributing Haveno via Flatpak.

Haveno data folder on Linux: `/home/<username>/.local/share/Haveno/`

Expand Down Expand Up @@ -102,7 +100,8 @@ sudo apt install flatpak flatpak-builder

### Building for macOS

Svg was converted into a 1024x1024 pixel PNG using <https://webkul.github.io/myscale/>, then converted to icns for macosx
Svg was converted into a 1024x1024 pixel PNG using
<https://webkul.github.io/myscale/>, then converted to icns for macosx
here <https://cloudconvert.com/png-to-icns>

#### Known Issues
Expand Down
32 changes: 26 additions & 6 deletions docs/flatpak.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,33 @@
# Flatpak distribution

The `.flatpak` binary files (known as "bundles") that `./gradlew packageInstallers` creates can be used to download and install Haveno, but there are several security issues that arise in Flatpak when only using the bundle files:
The `.flatpak` binary files (known as "bundles") that
`./gradlew packageInstallers` creates can be used to download and install
Haveno, but there are several security issues that arise in Flatpak when only
using the bundle files:

- There is no [digital signature](https://en.wikipedia.org/wiki/Digital_signature), if a bad actor were to upload a malicious `.flatpak` the users would have no way to tell when upgrading.
- Upgrading isn't as easy, your users need to find the new Flatpak bundle file, and you cannot update multiple apps easily.
- There is no
[digital signature](https://en.wikipedia.org/wiki/Digital_signature),
if a bad actor were to upload a malicious `.flatpak` the users would have no
way to tell when upgrading.
- Upgrading isn't as easy, your users need to find the new Flatpak bundle file,
and you cannot update multiple apps easily.
- This also makes an accidental downgrade much more likely.

Flatpak has a solution for these issues, a [Flatpak repository](https://docs.flatpak.org/en/latest/repositories.html). Flatpak repos store the data of their apps within an OSTree (almost like git) repository, and the commits can be signed with a GPG key. The nature of OSTree also allows for easy updates, as the Flatpak client can download deltas of the changes instead of the entire file.
Flatpak has a solution for these issues, a
[Flatpak repository](https://docs.flatpak.org/en/latest/repositories.html).
Flatpak repos store the data of their apps within an OSTree (almost like git)
repository, and the commits can be signed with a GPG key. The nature of OSTree
also allows for easy updates, as the Flatpak client can download deltas of the
changes instead of the entire file.

If you plan on distributing Haveno as a Flatpak, it's recommended to create a Flatpak repository as well. This guide will show you how to create a Flatpak repository for Haveno. The official documentation states that [it's possible to use GitHub/Lab Pages](https://docs.flatpak.org/en/latest/hosting-a-repository.html#hosting-a-repository-on-gitlab-github-pages) to host the repository, but this hasn't been tested. The more common way is to use a web server, or something like [flat-manager](https://github.com/flatpak/flat-manager).
If you plan on distributing Haveno as a Flatpak, it's recommended to create a
Flatpak repository as well. This guide will show you how to create a Flatpak
repository for Haveno. The official documentation states that [it's possible to
use GitHub/Lab Pages](https://docs.flatpak.org/en/latest/hosting-a-repository.html#hosting-a-repository-on-gitlab-github-pages)
to host the repository, but this hasn't been tested. The more common way is to
use a web server, or something like
[flat-manager](https://github.com/flatpak/flat-manager).

An example Haveno flat-manager solution using `docker-compose` has been created and documented at <https://gitlab.com/Jabster28/flatman-haveno-test.git> if you want a quick way to get started. Note that this does require an always-on server.
An example Haveno flat-manager solution using `docker-compose` has been created
and documented at <https://gitlab.com/Jabster28/flatman-haveno-test.git> if you
want a quick way to get started. Note that this does require an always-on server.

0 comments on commit 884a0eb

Please sign in to comment.