electrum on flathub?

[figliar0]

There is electrum on flathub:
https://flathub.org/apps/details/org.electrum.electrum
but flatpak package is not mentioned on electrum official site. Who builds package on flathub?

[jackg]

Is flathub not compatible with github directly, the links on that flathub site seem to suggest it is.

I can get this link from clicking on the publisher https://github.com/flathub/org.electrum.electrum/community - you can use that to see who's added commits to it.

That is NOT electrum's official github though. Electrum's official github is: https://github.com/spesmilo/electrum

There is a chance, unless Thomas V's signature verifies, the other version is a scam.

[dkbit98]

but flatpak package is not mentioned on electrum official site. Who builds package on flathub?

It could be community made, so it's not official package from Electrum, but you can contact Electrum website support directly for confirmation.
I clicked on See details under Publisher section in Additional information and I got the same github link as posted above.

[nc50lc]

The source of the binary is at least from electrum's official website and the hash matches from the source.
Lines 74-78: https://github.com/flathub/org.electrum.electrum/blob/master/org.electrum.electrum.json#L74-L78
However, there are lot of other requirements from "python3-requirements-binaries.json", "python3-requirements.json", "python3-requirements-hw.json" alongside the installation which you can check if something shouldn't be there (most checks out BTW).

But please don't take this as a vouch

[figliar0]

Since the repository is owned by Flatpak itself, there's small credibility of this Electrum package. But please use AppImage instead if you're looking for one-click solution.

Yes, but I am using Linux Mint, which has very nice flatpak integration (very nice means for lazy people as I am).

[figliar0]

...but you can contact Electrum website support directly for confirmation. I clicked on See details under Publisher section in Additional information and I got the same github link as posted above.

Well, Electrum website said that questions can be asked on this forum, so I hope that someone watch it from time to time... I do not think that Publisher section on Flathub is relevant - if it is some fake/malware/whatever package, it is easy to put real developer info to it, isn't it?

[BitMaxz]

Well, Electrum website said that questions can be asked on this forum, so I hope that someone watch it from time to time... I do not think that Publisher section on Flathub is relevant - if it is some fake/malware/whatever package, it is easy to put real developer info to it, isn't it?

They already talk about this from here https://github.com/spesmilo/electrum/issues/5017
And it's not developed by Electrum devs so it is not safe to use and it's an unofficial package owned by A6GibKm of GitHub. If you have some issue with this package then it's better to talk about this on their own GitHub page here https://github.com/flathub/org.electrum.electrum or on their Flathub page.

[DireWolfM14]

The source of the binary is at least from electrum's official website and the hash matches from the source.
Lines 74-78: https://github.com/flathub/org.electrum.electrum/blob/master/org.electrum.electrum.json#L74-L78
However, there are lot of other requirements from "python3-requirements-binaries.json", "python3-requirements.json", "python3-requirements-hw.json" alongside the installation which you can check if something shouldn't be there (most checks out BTW).

But please don't take this as a vouch

That's a bit of a relief, but it's still troubling.  Something like this could be an attempt to get people comfortable downloading Electrum source from an alternative site, and turn into a trojan horse in the future.  I personally would recommend that people only use the official Electrum site or the GitHub repository, which is managed by the same crew.  

[figliar0]

They already talk about this from here https://github.com/spesmilo/electrum/issues/5017
And it's not developed by Electrum devs so it is not safe to use and it's an unofficial package owned by A6GibKm of GitHub. If you have some issue with this package then it's better to talk about this on their own GitHub page here https://github.com/flathub/org.electrum.electrum or on their Flathub page.

Thank you very much. It seems that electrum devs do not use/like flatpak and don't care about the package at all. One should be really careful, when using these these kind of flathub packages. But I think, that electrum devs should be even more careful about this matter. Cryptocurrency wallets are special case of software - there are really strong motivation for blackhats (and electrum is quite a popular).

[figliar0]

I know Flatpak (along with Snap and App Center) is great for lazy people, but AppImage is still very easy to use. On most cases, you just need to make sure you can execute it (by open properties of the AppImage file), then double-click.

I don't know appimage, but according to what i read, you have to manually download new package on every new release. That's not very lazy-friendly. Linux Mint has flatpak updates integrated in its system update manager, so flatpaks updates automatically together with regular packages.

[figliar0]

True, AppImage basically just format of portable application. But you could update it on each major update. I only update my Electrum occasionally (when there's new interesting feature or fix serious security vulnerability).

I understand, but considering this process for boring and archaic (from certain point of view). Central software management (maintaining software up to date) is one of the reasons I am using Linux for about ten years. I don't want to know about security problems - I want downstream to do the job and supply updates to users in confortable manner. It has some problems on non-rolling distros (I was using archlinux for long period), but Linux Mint show us, it is possible to integrate Flatpak to system in very comfortable manner and thats what I really like.

But no offense - every technology finds its users and I hope you enjoy using appimage.