Hacker News Reader

Comment by jahewson | Hacker News Reader

I disagree with this post. I wouldn’t be surprised if the author of the help article was under the impression that the package was Microsoft’s. Just look at the metadata, which is used in the UI:

<id>com.microsoft.Edge</id>

<name>Microsoft Edge</name>

<developer_name>Microsoft Corporation</developer_name>

You can’t go round claiming to be Microsoft and then add a disclaimer in the notes field that you’re not actually Microsoft, which they do, after four paragraphs of other text:

> NOTE: This wrapper is not verified by, affiliated with, or supported by Microsoft.

I don’t think this is an adequate way to surface such an important piece of information, one which arguably contradicts the package metadata. Flathub needs to figure this out.

View on HN

>You can’t go round claiming to be Microsoft and then add a disclaimer in the notes field that you’re not actually Microsoft

The developer_name element is for the developer of the application that is being packaged. It is not the name of the maintainer of the flatpak.

>The <developer_name/> tag is designed to represent the developers or project responsible for development of the project described in the metadata.

https://www.freedesktop.org/software/appstream/docs/chap-Met...

It may be designed that way but in practice it’s misleading, especially the way it appears in the UI. It looks like a designation of origin of the package. These are trademarks and can’t just be thrown around casually.

Why is there not at least a packager or maintainer field?

>Why is there not at least a packager or maintainer field?

On flathub the developer is the developer of the software being published and the publisher is the people who packaged it.

Interesting. Where can I find the publisher field?

Click on an application on https://flathub.org/home and ctrl + f

This does not help much without doing further digging. I checked the "Steam" package and for me in Flathub I see a link to "See Details" for the publisher. Clicking on that takes me to the contributors page of their Flathub GitHub repo. Am I supposed to know if these are employees of the company or not?

I am on mobile, so maybe there's more info on desktop? I see nothing indicating if this is official or not, other than a note at the bottom of the flathub description telling me it is not official, which seems strange for that to be the only place indicating that.

From TFA:

> Needless to say, this most likely an oversight so I have not concluded that this was intentional, yet

I don't see a point of disagreement. Developer != flatpak maintainer. Putting themselves there would rightly have them called out for misappropriation.

Indeed. I think this reveals a deeper problem with flatpack packaging conventions. The package maintainer is a vital piece of missing metadata.

This is one of my bigger issues with Flathub that still keeps me uncomfortable.

I've been adopting flatpaks a fair bit lately but something doesn't sit right that there's not an obvious way (At least in most front ends) to know:

1) Who the packager is.

2) Is the flatpak officially sanctioned by the developer of the software?

2.5) If not, how do I know that it was packaged correctly? Was the build from a clean source?

3) Is it really the latest version? (or is the potential non-official packager perhaps lagging behind the official release)

Perhaps you can dig further into GitHub and get the information, but it's not blatantly obvious at a glance.

Reply on news.ycombinator.com