Development

Extending GNOME Software

At GUADEC 2016 in Karlsruhe, Germany, Kalev Lember spoke about the recent changes in GNOME's application-installation tool GNOME Software. The program does more than simply install packages; it provides user-visible metadata, ratings, screenshots, and other information. As new application-packaging formats like Flatpak have gained popularity, GNOME Software has adapted to work with them as well.

Lember began with a short summary of GNOME Software's history. The genesis of the project came several years ago, when Richard Hughes started developing PackageKit, which is a component that supports package installation but provides no real user interface. Hughes learned that the lack of a user-level installation tool was effectively keeping his wife from running GNOME, so he set out to build a solution.

Initially, the GNOME front end for PackageKit ("GNOME PackageKit") merely exposed the internal structures and APIs of PackageKit, which was not user-friendly. The error messages from PackageKit, for example, tended to be obtuse, reporting low-level problems like two packages that attempt to provide the same file. In 2012, though, the application was redesigned from the ground up by Jakub Steiner, Jon McCann, and Allan Day, resulting in GNOME Software. The architecture, Lember said, is not nearly as clean as GNOME PackageKit's, but it provides the interface that users need. Maintenance is harder, he said, "but it's a small price to pay if we can have happy users."

There are tradeoffs made in the new design. First, GNOME Software does not attempt to provide access to every package on the system, focusing instead only on "applications" (loosely defined as interactive user programs, almost all of the GUI variety). Second, because applications are "first-class citizens," a useful, human-readable description and a screenshot are required for every application.

Both of those metadata items are provided by AppData files. Initially, AppData was not used much, Lember said, but after it was released in Fedora, there was a huge uptick in application projects that provide AppData files. The specification has also subsequently been adopted by other projects, including Ubuntu's snap package format and KDE's Muon package manager.

Rate this

Recently, Ubuntu decided to start using GNOME Software as its application installer, replacing the previous Ubuntu Software Center. But Ubuntu wanted to add support for a user reviews and a ratings system, features long provided in Ubuntu Software Center but that had not been implemented in GNOME Software. Ubuntu developers added front-end code for ratings and reviews, and Hughes wrote back-end support, starting with a generic rating-and-review server called the Open Desktop Ratings Service (ODRS).

The rating-and-review system supports a configurable server source so that individual distributions (or, perhaps, enterprise deployments) can link GNOME Software to their own ODRS system. Ubuntu, for example, links the application to its pre-existing rating-and-review database. Lember said that ODRS is rather open: anyone can post a review if they know the proper API calls, with no need to create an account. "I, too, was very skeptical about this," Lember said, when Hughes explained that design to him. "But he is stubborn, in a good way, and he went ahead," he added.

Despite the fact that authenticated user accounts are not required to post reviews, there are some administrative controls. Information about each user's machine is hashed on the server to act as an internal ID, and the ODRS administrators can ban reviewers if necessary. In the GNOME Software interface, users see an "is this review useful?" question on reviews; if too many users flag a particular review as problematic, the expectation is that administrators will take action. So far, he said, the system has worked remarkably well: there have been only a few badly behaved users, and all were caught within a matter of hours.

In response to an audience question, Lember added that it is technically possible for programs other than GNOME Software to fetch review information directly from an ODRS server, although that is not the intent. The server provides a JSON API, so client code will have to deal with that output format and, at present, there is no "bulk download" facility.

APIs, upgrades, and future work

In the current development cycle, GNOME Software has added a public plugin API. The architecture was already plugin-based internally, Lember said, to support backends for different package engines (namely RPMs and Debian packages). Although GNOME Software was largely a Fedora effort at first, it now gets contributions from Ubuntu, Debian, SUSE, and Red Hat Enterprise Linux, which Lember noted was a "great example of cross-distribution cooperation."

The API has allowed developers to add support for Ubuntu's repositories, Flatpak, OSTree, and Limba, and making it public will enable developers to write out-of-tree plugins. That could be useful for enterprises, which can enable support for their own private systems without the burden of maintaining a fork of GNOME Software.

Another important new feature is the ability for GNOME Software to handle distribution release upgrades. Fedora supports this upgrade method as of the Fedora 24 release.

Looking to the future, Lember noted that some work will be necessary to support the OSTree model, in which the base system is provided as an immutable OS image and individual applications are packaged in self-contained bundles (such as Flatpaks). GNOME Software's view of the system becomes challenging in this type of environment, particularly how to present state to the user when a package is both part of the immutable OSTree image and is available as a Flatpak bundle. The team is already looking at how to distinguish between Flatpak-like bundles and standard distribution packages (such as displaying a "shield" icon on the bundle to indicate that it is sandboxed and, thus, should be safer).

Other challenges moving forward include the possibility of automatically building sandboxed bundles directly from distribution packages (something that the Flatpak project has already been working on). There may also be a need to distinguish somehow between free-software applications and proprietary applications; since sandboxed bundles like Flatpaks can be delivered by third-parties, it will be important to provide users with licensing information if at all possible.

In the question-and-answer period at the end of the session, Lember said that there are currently no plans to add back-end support for language-specific software repositories like the Python Package Index, since there are few graphical applications distributed through such systems. But there is nothing to prevent their inclusion in some later GNOME Software release.

An audience member also asked whether GNOME Software could be used to help strengthen the direct relationship between project developers and end users, which is a topic GNOME has grappled with in recent years. If GNOME Software can link users to the upstream developer, rather than to the distribution's package repository, then feedback, bug reports, and even payments could be simpler. Lember replied that GNOME Software can easily add links to project homepages and so on, but that such information should be made part of the AppData specification. He also noted that improving connections between developers and end users is already a goal of the application-sandboxing projects.

[The author would like to thank the GNOME Foundation for travel assistance to attend GUADEC 2016.]

Comments (2 posted)

Quote of the week

— Boudewijn Rempt reaches his breaking point with changes in Qt.

Comments (6 posted)

OpenSSL 1.1.0 released

Version 1.1.0 of the OpenSSL TLS library is available. A list of changes can be found on this page; they include a new threading API, a number of new algorithms and the removal of a number of older ones, pipelining (parallel processing) support, extended master secret support, and more.

Full Story (comments: 5)

Twisted 16.4.0 released

Version 16.4 of the Twisted framework for Python is now available. Highlights include a new command-line tool, twist, for running Twisted plugins, a new interface for Protocols that provides TLS handshake information, and better Windows support. In addition, more than 35 modules have been ported to Python 3 since the previous release.

Full Story (comments: none)

Nextcloud 10 released

Nextcloud 10 has been released with new features for system administrators to control and direct the flow of data between users on a Nextcloud server. "Rule based file tagging and responding to these tags as well as other triggers like physical location, user group, file properties and request type enables administrators to specifically deny access to, convert, delete or retain data following business or legal requirements. Monitoring, security, performance and usability improvements complement this release, enabling larger and more efficient Nextcloud installations."

Comments (8 posted)

Rhythmbox 3.4 is available

Version 3.4 of the Rhythmbox music player has been released. Changes include a web-based player interface, improved keyboard control, updated Universal Plug and Play (UPnP) support, improvements to the SoundCloud plugin, and removal of the WebKit dependency. The WebKit change may affect third-party plugins; developers are encouraged to take a close look at their plugin code.

Comments (none posted)

Pump.io 1.0 released

Version 1.0.0 of the federated microblogging platform pump.io has been released. According to the release notes, important features include NodeJS 4.x support, LibreJS support, and a wide range of security fixes that guard against cross-site scripting and other attack scenarios. Finally, the team notes that "since we're now past 0.x.x releases, we're now officially making a commitment to the community to make only API-compatible changes going forward (or at least, until 2.0.0!)."

Comments (none posted)

Remembering Vernon Adams

Open-source font developer Vernon Adams has passed away in California at the age of 49. In 2014, Adams was injured in an automobile collision, sustaining serious trauma from which he never fully recovered. Perhaps best known within the Linux community as the creator of KDE's user-interface font Oxygen, Adams created a total of 51 font families published through Google Fonts, all under open licenses. He was also active in a number of related free-software projects, including FontForge, Metapolator, and the Open Font Library. In 2012, he co-authored the user's guide for FontForge as part of Google's Summer of Code Documentation Camp, which we reported on at that time.

Speaking personally, Vernon was always quick to offer encouragement and assistance to newcomers—regardless of their experience with type design, FontForge, or free software in general. There were also few people who put as much energy into improving the usability of free-software design tools as he did. In addition, he was a constant advocate for free-software principles in the world of fonts—not just on development lists and at libre graphics conferences, but on type forums as well, where "open source" did not automatically garner a warm reception. The tagline on his web site was "fonts for everyone", and he meant it. He'll be missed.

Comments (2 posted)

Development newsletters from the past week

• What's cooking in git.git (August 24)
• This Week in GTK+ (August 29)
• OCaml Weekly News (August 30)
• Perl Weekly (August 29)
• PostgreSQL Weekly News (August 28)
• Python Weekly (August 25)
• Ruby Weekly (August 25)
• This Week in Rust (August 30)
• Wikimedia Tech News (August 29)

Comments (none posted)

Rintel: NetworkManager 1.4: with better privacy and easier to use

Lubomir Rintel takes a look at new features in NetworkManager 1.4. "It is now possible to randomize the MAC address of Ethernet devices to mitigate possibility of tracking. The users can choose between different policies; use a completely random address, or just use different addresses in different networks. For Wi-Fi devices, the same randomization modes are now supported and does no longer require support from wpa-supplicant." Also a newly added API for using configuration snapshots that automatically roll back after a timeout, IPv6 tokenized interface identifiers can be configured, new features in nmcli, and more are covered. (Thanks to Paul Wise)

Comments (36 posted)

Haller: MAC Address Spoofing in NetworkManager 1.4.0

We recently pointed to Lubomir Rintel's coverage of NetworkManager 1.4. Thomas Haller follows up with a more detailed look at the MAC spoofing capabilities of NetworkManager. "1.2.0 relies on support from wpa_supplicant to configure a random MAC address. The problem is that it requires API which will only be part of the next major release 2.6 of the supplicant. Such a release does not yet exist to this date and thus virtually nobody is using this feature. With NetworkManager 1.4.0, changing of the MAC address is done by NetworkManager itself, requiring no support from the supplicant. This allows also for more flexibility to generate “stable” addresses and the “generate-mac-address-mask”. Also, the same options are now available not only for Wi-Fi, but also Ethernet devices."

Comments (4 posted)