Linux

Great article, BTW

I disagree, the headline is clickbaity and implies that there is some ongoing conflict. The fact that the Fedora flatpak package maintainer pushed an update marking it EOL, with "The Fedora Flatpak build of obs-studio may have limited functionality compared to other sources. Please do not report bugs to the OBS Studio project about this build." in the end-of-life metadata field the day before this article was written is not mentioned until the second-to-last sentence of it. (And the OBS maintainer has since said "For the moment, the EOL notice is sufficient enough to distance ourselves from the package that a full rebrand is not necessary at this time, as we would rather you focus efforts on the long-term goal and understand what that is.")

The article also doesn't answer lots of questions such as:

• Why is the official OBS flatpak using an EOL'd runtime?
• Why did Fedora bother to maintain both their own flatpak and an RPM package of OBS?
• What (and why) are the problems (or missing functionality) in the Fedora Flatpak, anyway? (there is some discussion of that here... but it's still not clear to me)
• What is the expected user experience going to be for users who have the Fedora flatpak installed, now that it is marked EOL? Will it be obvious to them that they can/should use the flathub version, or will the EOL'd package in the Fedora flatpak repo continue to "outweigh" it?

Note again that OBS's official flathub flatpak is also marked EOL currently, due to depending on an EOL runtime. Also, from the discussion here it is clear that simply removing the package (as the OBS dev actually requested) instead of marking it EOL (as they did) would leave current users continuing to use it and unwittingly missing all future updates. (I think that may also be the outcome of marking it EOL too? it seems like flatpak maybe needs to get some way to signal to users that they should uninstall an EOL package at update time, and/or inform them of a different package which replaces one they have installed.)

TLDR: this is all a mess, but, contrary to what the article might lead people to believe, the OBS devs and Fedora devs appear to be working together in good faith to do the best thing for their users. The legal threat (which was just in an issue comment, not sent formally by lawyers) was only made because Fedora was initially non-responsive, but they became responsive prior to this article being written.

I can confirm, I really missed the opportunity

That wouldn’t work. Flathub and Fedora Flatpaks have different goals.

Fedora Flatpaks must meet legal requirement set by Fedora, so no proprietary or patented software.

Flathub also encourages upstream to maintain their packages. But upstream may not meet the security requirements set by Fedora. Fedora has much stricter packaging guidelines which don’t permit vendored dependencies.

The lesson is that Fedora Flatpak Repo needs to fuck off. It's an anti-pattern to have an obscure flatpak repo with software that is packaged differently from everything else.

The entire point of flatpaks was to have a universal packaging format that upstream devs could make themselves, and Fedora is completely undermining it.

It's not that hard to actually follow XDG specifications instead of hardcoding paths.

Which flatpak itself doesn't, btw. $HOME/.var for flatpaks is hardcoded, no answer in the issue tracker so far, to the proposal of using the usual flatpak_xyz_dir variable to change the path.

I think you might find this comment by one of the OBS upstream devs interesting:

https://pagure.io/fedora-workstation/issue/463#comment-955899

OBS continued using the EOL runtime because of Qt regressions introduced in the updated KDE runtime. The OBS team decided the security risk of sticking to the EOL runtime was small, so they didn't update.

But that still does mean that users were no longer receiving security updates. Ideally, OBS should have moved to the standard Freedesktop runtime and vendored in the older Qt dependency. That way, the they would still be receiving security updates for everything in the Freedesktop runtime. Then once the regressions were fixed, they could move to the updated KDE runtime and remove the vendored Qt dependency.

Overall, the risk OBS had was small. But it demonstrates a larger issue with Flathub, which is that they don't take security as seriously as Fedora. There are hundreds of flatpaks in Flathub that haven't been updated in years, using EOL runtimes and vendored dependencies that get no updates.