How to install Signal on Secureblue?

[glass stirrup]

Hey,
I know Signal Desktop isn't secure, but unfortunately I can't do without the desktop version.
I tried installing Signal as a Flatpack. When I open Signal, I get a warning about missing encryption. When I accept it, nothing else happens.

Secondly, I tried to install Signal via an Ubuntu distro box following the instructions at https://signal.org/de/download/.

When I open the distro box Signal version, nothing happens...

What else can I do?
Thanks!

[woven canopy]

Did you run the flatpak permissions lockdown?

that error indicates signal is missing permissions

[glass stirrup]

what is this?

[woven canopy]

ujust flatpak-permissions-lockdown

this^

[glass stirrup]

i will try

[woven canopy]

no

im asking if you did it already

nein

[glass stirrup]

no i didnt

[woven canopy]

@mossy bloom @wintry python hilf mir 😄

ich spreche kein Deutsch

[woven canopy]

okay cool

[wintry python]

[glass stirrup]

but now i have

[woven canopy]

in that case I would probably recommend using the experimental encrypted backend

[woven canopy]

noooo 😭

why

that will make it harder to debug

[woven canopy]

need help with language barrier

[wintry python]

With what specifically?

[glass stirrup]

Sorry, I misunderstood that.

[woven canopy]

no problem

[woven canopy]

just some things are being misinterpreted

[glass stirrup]

Hey,
I know Signal Desktop isn't secure, but unfortunately I can't do without the desktop version.
I tried installing Signal as a Flatpack. When I open Signal, I get a warning about missing encryption. When I accept it, nothing else happens.

Secondly, I tried to install Signal via an Ubuntu distro box following the instructions at https://signal.org/de/download/.

When I open the distro box Signal version, nothing happens...

What else can I do?
Thanks!

[woven canopy]

@glass stirrup this should be the solution

[glass stirrup]

Oh, I completely forgot to translate the message.

[woven canopy]

all good i translated it

but @glass stirrup i think you just need to follow the message in the error

and then the flatpak will work

[wintry python]

Is it expected that the Flatpak doesn't work with the unencrypted default backend?

[glass stirrup]

i tried it. but it doesnt work

[woven canopy]

i think the issue is that using an unencrypted backend is a bad idea

[woven canopy]

what image are you using

[wintry python]

Well their issue is that Signal just doesn't launch, not that they have an issue with the unencrypted backend.

Surely its bad

[woven canopy]

I tried installing Signal as a Flatpack. When I then open Signal, I get a warning about the lack of encryption. If I accept it, nothing else happens.

oh i see

oh

i think it's because it's electron

[glass stirrup]

is this correct?

[woven canopy]

and it's probably defaulting to wayland

[woven canopy]

what image are you on

[wintry python]

Oh yeah. Maybe XWayland maybe even unconfined userns required.

[woven canopy]

[woven canopy]

now try flatpak run org.signal.Signal --ozone-platform=wayland

[wintry python]

As you don't care about the backend being unencrypted, I would recommend to remove that ENV var again for stabilities sake (should be able to do so graphically in flatseal)

[glass stirrup]

gnome

[woven canopy]

oh man

i can't imagine using signal with an unencrypted backend 😬

[glass stirrup]

and than click "no" or "yes"?

[woven canopy]

it's still complaining about the backend?

well. click yes to see if it opens

Ja

[wintry python]

I can't either, but does the encrypted backend work well enough to actually use it? The warning popup makes it not seem like this is the case and it also was my understanding that Signal Desktop doesn't support encrypted storage yet.

[woven canopy]

yeah i want to leave that up to @glass stirrup

stability or security

apparently, you can only use one

another reason not to use signal desktop i guess

[glass stirrup]

oh yes it opens. But then there is another error

[wintry python]

Network error

It seems

Connection with Signal servers failed

[glass stirrup]

yes. But i have internet

[wintry python]

Maybe because of the flatpak permission lockdown?

[glass stirrup]

oh no

Can I undo this?

[open harbor]

Do ujust flatpak-reset-global-overrides and ujust harden-flatpak, that should get it to the default state

[glass stirrup]

Oh yes, it seems to be working! Thank you very much!

[woven canopy]

gern geschehen

🙂

[glass stirrup]

I have the same problem with "Joplin", that it dont open. Is there a general way to handle this?

or is Joblin also not recomended?

[woven canopy]

doesn't open with what error

it's probably also electron

you either need to pass --ozone-platform=wayland to each of them

[glass stirrup]

no error

[woven canopy]

from the terminal

there will be an error

[glass stirrup]

ohm. how do i know whats the correct name of the application?

[woven canopy]

flatpak list | grep joplin

[woven canopy]

🤨

what does it say without --ozone-platform=wayland

[woven canopy]

okya so

maybe it just doesn't work with wayland

ujust toggle-xwayland and reboot

[glass stirrup]

I can also try to find another option for Markdown notes that can be synchronized with my smartphone if it's too difficult...

[glass stirrup]

Is this a security issue?

[woven canopy]

it reduces security, yes

[woven canopy]

it's not about difficulty it's about avoiding electron and xwayland

[glass stirrup]

were can i see if an app uses electron?

[woven canopy]

open the repo and search for "electron"

for example

https://github.com/search?q=repo%3Alaurent22%2Fjoplin electron&type=code

[glass stirrup]

That works. Then I'll think about whether to look for an alternative or use xwayland...

[woven canopy]

the main drawback of xwayland is that all apps running in the xwayland session can spy on each other 🙃

e.g. read keystroke logs intended for other apps

etc

[glass stirrup]

Oh, okay. Thanks for explaining.

[fickle cosmos]

I've been using it with gnome-libsecret just fine. the warning does make it sound like it won't work at all but I tried it because there is no way I would use it unencrypted

[woven cairn]

There's also the unofficial Flare client, it doesn't use electron but it's still experimental with warnings and everything and has less features unfortunately, for that I haven't tried it but I'm keeping an eye on its progress. Either way I would recommend using the official mobile app and only the official desktop electron one if you must.

[ivory moss]

I wish there was a list of fixes per app. It seems like the majority of Flatpaks don't work and each one needs a slightly different fix if you don't use xwayland.

[woven cairn]

Flathub https://flathub.org/en & the https://secureblue.dev/faq shows a number of permissions necessary for each flatpak to work, for example on Flathub the X11/XWayland dependency is listed as "uses a legacy windowing system". Toggling permissions via Flatseal/Flatpak KCM permissions management/terminal(with commands seen on the terminal's welcome message & the FAQ) is the best option at the moment. There are developers that are working on having their Flatpaks require less/different permissions as we speak, and of course if it's too much for you you can consider using other distros (or operating systems), though they won't be as secure(linux distros). Also, Verified Flatpaks ensure that the Flatpak comes straight from the developer(s) so unverified ones are disabled by default here (but you can re-enable them, at the cost of security degradation)

[hasty umbra]

The fact that you were pinging those two but not me hurts deeply

[hasty umbra]

You can also check the yaml files on each apps flathub repository. They are also shown to you in terminal right after installation. Not all of these permissions may be necessary though.

[woven canopy]

oops my bad 😄

[hasty umbra]

Signal and FreeTube work just fine for me under Wayland. They may require additional parameters like --enable-features=WaylandWindowDecorations, --ozone-platform-hint=auto or --gpu-context=wayland though.

[mint mauve]

How do i add these in flatseal?

For global also.

[hasty umbra]

I believe you need to edit the .desktop file for the respective flatpaks instead.

[mint mauve]

Do you have a similar fixes for OnlyOffice?

They deadass don't care about Flatpak and won't fix the fake wayland support while still giving it access to wayland by default.

[hasty umbra]

I don't use that. What's the issue? Check the terminal output when running flatpak run ....

[mint mauve]

It just no matter what i do it just saying it need X channel.

[mint mauve]

Wait where is this again?

[mint mauve]

I have no idea wheres the correct location of the .desktop file on secureblue.

[woven canopy]

for what app

[mint mauve]

Flatpak in general.

I forgot to add it.

[bronze meteor]

~/.local/share/applications

[mint mauve]

I mean for Flatpak.

[bronze meteor]

then ~/.local/share/flatpak/exports/share/applications, but i would copy the file to ~/.local/share/applications first, then modify it there