Matthias Klumpp

While founding the Tanglu Debian derivative, I did set up infrastructure to create and maintain a Debian archive (which includes Britney, Ben, Dak and friends) and maintain it for the derivative, which resulted in some custom code being written for Tanglu. Doing this turned out to be quite a big task for a small derivative which requires a lot of continuous human work. After I started working on PureOS for Purism[1], I had the pleasure of doing the same thing again. Having learned the lesson in Tanglu, I developed a framework for setting up and maintaining infrastructure for a Debian derivative, called Laniakea. Laniakea uses tools already present and in use at Debian itself, but allows to centrally manage them and aggregate their information in one database. This allows to automate a lot more archive actions, saving human manpower, as well as showing new developers a nice coherent web interface for their packaging. This talk will be about what Laniakea wants to be and what it can already do today for your derivative, and how it differs from other solutions like Fedmsg. I will also likely contain useful information in what (not) to do in case you are brave enough to attempt to set up your very own infrastructure based on the tools we use to build Debian. [1]: https://puri.sm/

I will talk about software bundling solutions, mainly Flatpak (XdgApp) and Limba, which problems they actually solve and why solving these issues is important for the Linux ecosystem as a whole. I will explain how bundling is implemented in the shiny new solutions available on Linux, and what we as distributor could do to make software bundles suck less and keep the distribution relevant. Additionally, I'll explain which roles sandboxing (Flatpak, Bubblewrap) plays in the big picture.

Since last year, Debian supports the AppStream specification for providing machine readable metadata for any software component available in the Linux distribution. At time, the data is primarily used by GNOME Software and KDE Discover to display an user-friendly catalogue of installable applications. But this is not all we can do with the new metadata: It can be used to automatically detect and install missing firmware and drivers, match applications between distributions and allow upstream projects to track them across different distribution releases and other interesting tasks like automatically checking installed applications for vulnerabilities or installing missing libraries and Python modules automatically in a distro-agnostic way. The talk will explain what AppStream is today and how it is implemented in Debian, as well as giving some statistics on the availability and evolution of metadata. It will also go into detail on usecases for the metadata, challenges in writing it and future plans, like support for fonts and more automatization in data generation.

AppStream provides a solution for application-centric software management using existing package managers, while Listaller extends the package manager with the ability to install 3rd-party applications in a secure way, without introducing additional UI. This talk explains the basic concepts of both projects and the motivation behind them, as well as the obstacles in cross-distro collaboration which we hit while developing these tools.

Software management on Linux is traditionally done using packages, although desktop users are more interested in applications instead and do not care much about how something is packaged. Also, users often want to install software which is not available in the repositories (e.g. unpackaged stuff, as well as new versions of applications), without having to upgrade the whole distribution. AppStream provides a solution for application-centric software management using the existing package-managers, by providing extra metadata for packages. This allows developers to create cross-distro application-centers, like GNOME-Software or Apper. Listaller extends the package manager with the ability to install 3rd-party applications, which are not (yet) in the distribution's repositories. It builds on top of the AppStream specs and focuses on integration, so the installation process is completely transparent for users, and Listaller-installed applications can be managed with existing software-management tools. Because software from 3rd-party sources is a potential security risk, Listaller also tries to give users a hint if they can trust a certain application, and includes sandboxing for these applications. Both projects rely heavily on metadata provided by upstream projects and distributions. This talk will explain the concepts of AppStream and Listaller, which new metadata needs to be added and why as well as how distributions can make a software-center available for their users. If the time allows it, the talk will also highlight the problems we had with the AppStream project in the first place and how we could improve cross-distribution collaboration in general.

Listaller is a new approach for making 3rd-party software installations on Linux possible, without interfering with the native package manager. Listaller's primary focus is system-integration, so users will not notice that they are using the tool, as it integrates with existing PackageKit-based software management frontends. The installer also contains a new approach to dependency-handling, and makes use of existing specifications, such as AppStream.

Software management on Linux is traditionally done using packages, although Linux desktop users are more interested in applications instead and do not care much about how something is packaged. Also, users often want to install software which is not available in the repositories (e.g. new applications or new versions of them), without having to upgrade the whole distribution. Listaller extends the package manager with the ability to install 3rd-party applications. It is built on top of the AppStream specs and PackageKit and focuses on system-integration. This means no additional UI must be added in order to install applications packages using Listaller. Listaller apps can be managed using existing tools like GNOME-Software or Apper. Because software from 3rd-party sources is a potential security risk, Listaller also tries to give users a hint if they can trust a certain application, and makes it possible to run these applications in a sandbox automatically. For developers, it contains some helper tools to make applications work on multiple distributions.