Linux Flatpak / AppImage releases

[AllienWorks]

First of all, based on the site, Sparrow looks really cool! Can't wait to test it out.

However, not all Linux distros support DEB/RPM packages – do you have any plans to releasing also via Flatpak or AppImage (which are both quite universal Linux packages)?

[craigraw]

Would like to, if only to have a single Linux release type, but the Java's packaging tool jpackage only supports .deb and .rpm at this time. That said I don't think it would be too hard to get the application image into AppImage format.

Will look into this in a future release.

[monperrus]

Yes, I also need to run sparrow on a machine on which I'm not root.

A standalone build of sparrow for Linux would be awesome.

[craigraw]

Sparrow v0.9.8 has been released with a Linux standalone build. It's not a Flatpak or AppImage, but just a tar.gz of the binary and associated libraries.

Does this work?

[monperrus]

Yes, it works, thanks a lot. Had to chmod 755 bin/Sparrow first.

[AllienWorks]

Yep, I can confirm. After chmodding the binary, it runs fine. Thanks much @craigraw!

[craigraw]

Thanks for the feedback! I'll still look into an AppImage in future.

[6102bitcoin]

Outstanding Action: Add AppImage release Proposed Priority: Low

[mariaa144]

Sparrow v0.9.8 has been released with a Linux standalone build. It's not a Flatpak or AppImage, but just a tar.gz of the binary and associated libraries.

Does this work?

The binary doesn't work for NixOS users. NixOS does have a package for Sparrow but it sometimes has broken features such as the border wallet not working currently. An Appimage or Flatpak would be a nice addition.

[ademar111190]

There is an official SDK Extension for OpenJDK 20 on flathub repo; I believe that can help a flatpak support effort.

[craigraw]

Thanks - Sparrow already uses jlink to package a minimized JRE, so this shouldn't be necessary. It's effectively a binary application.

[storopoli]

Is this legit? It has the verified icon in Flathub: https://flathub.org/apps/io.github.Strozer2002.sparrow

[RequestPrivacy]

Is this legit?

I don't think so, the question is can something be done against this?

[monperrus]

a compromised version through a package manager? (remember the Ledger attack on the Microsoft store https://www.hackread.com/fake-ledger-app-microsoft-app-store-crypto-funds/)

[craigraw]

Definitely not legit, and probably malware.

The download size, version number and app architecture (appears to be a flutter app) are all dramatically different.

I have reported to flathub@lists.freedesktop.org. I would appreciate any help in getting this removed.

[craigraw]

Have also reported the actual application at https://github.com/Strozer2002/sparrow-linux/ to Github.

[xmready]

@craigraw I would seriously recommend having a verified flatpak version on flathub. There are multiple pros for this:

1. Reduces attack vector of non-official flatpaks
2. Flatpaks can update automatically removing the need to manually update Sparrow
3. Flatpaks work across all popular Linux distros
4. Flatpaks have become extremely popular
5. It's less complicated than changing permissions on a standalone binary for noobs

[craigraw]

@xmready The problem with supporting flathub (or another app store like snap store, winget or the mac app store) is that it broadens the distribution attack vector. Right now, the only source for Sparrow binaries is Github. These binaries are independently watched by https://binarywatch.org. The security model for app stores is generally more complicated, and they don't usually have robust independent monitoring of binaries afaik.

[xmready]

@xmready The problem with supporting flathub (or another app store like snap store, winget or the mac app store) is that it broadens the distribution attack vector. Right now, the only source for Sparrow binaries is Github. These binaries are independently watched by https://binarywatch.org. The security model for app stores is generally more complicated, and they don't usually have robust independent monitoring of binaries afaik.

My understanding is that a verified Flatpak submission on Flathub comes from a GitHub PR made by the original developer, aka you. The Flatpak is built using your project's repo. Are you saying that the resulting build can't be verified?

[ziqiq]

I created a Flatpak manifest file and installed it on Fedora 40/GNOME/X11

How to reproduce:

1. Install build dependency flatpak-builder

   dnf install flatpak-builder

2. Build (and install) the app

   flatpak-builder --force-clean --user --install-deps-from=flathub --repo=repo --install builddir com.sparrowwallet.Sparrow.yml

   This will create two directories:

   • builddir, the actual files built for the Flatpak app
   • repo, a local Flatpak repo where the app published to
3. If a bundle file is needed for distribution

   flatpak build-bundle repo sparrow-1.9.1-x86_64.flatpak com.sparrowwallet.Sparrow 1.9.1 --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo

   This will create a single-file Flatpak bundle sparrow-1.9.1-x86_64.flatpak

See the Flatpak build guide for detail.

Note:

• The Sparrow home directory is ~/.var/app/com.sparrowwallet.Sparrow/.sparrow. You might want to copy the existing data file from ~/.sparrow into it (or create a symbolic link).
• As I added a desktop file, there will be an Sparrow entry in the launcher:)

[ziqiq]

Some other FYIs:

1. I just realized the flatpak-builder itself is also available on Flathub as a Flatpak app, so if you are not comfortable with installing additional rpm/deb package to build the manifest, or don't have root permission, you could:

flatpak install --user org.flatpak.Builder
alias flatpak-builder='flatpak run org.flatpak.Builder'

2. If you don't need the bundle file, you could omit --repo=repo. Also, usually most environment should have the base Freedesktop runtime, so I think most end user might just run this to install Sparrow as Flatpak:

flatpak-builder --user --install builddir com.sparrowwallet.Sparrow.yml

[craigraw]

Are you saying that the resulting build can't be verified?

@xmready No, please read my reply again.