Oh, snap! Do containerized Mozilla apps violate the licenses?

[Stevo]

Containerized=snap, flatpaks, and appimages

According to the Pale Moon developer, they do: https://forum.palemoon.org/viewtopic.php?f=37&t=21246
and is why you don't see PM in a container format. I wonder what Ubuntu would say about their Firefox snap package?

[manyroads]

I'd guess the Palemoon guy is clueless.... https://wiki.mozilla.org/Nightly

Mozilla provides access to FF flatpak/snaps.

[Eggnog]

Well, there you have it.

[Stevo]

Well, maybe. But this wouldn't be the first time that the right hand doesn't know what the left hand is doing, either. It will be interesting to see Moonchild's take on this fact, though.

We have plans to provide Snap binaries of Firefox and once this is ready, we will probably propose also them for Nightly. The tracking bug is Automate generation of Firefox snap packages.

We don't have plans for FlatPack yet but there is a bug open: Use Flatpak framework to distribute Firefox for Linux users

There is an unofficial Firefox Flatpak repository created by the Fedora/RedHat maintainers for testing purposes: https://firefox-flatpak.mojefedora.cz/ With this FlatPak repository, your profile is stored in $HOME/.var/app/org.mozilla.FirefoxNightlyWayland/.mozilla

If you are on Ubuntu, here is a detailed article on how to install it here: How to Install Firefox Nightly as a Flatpak App on Ubuntu

[skidoo]

stevo, I tried to engage you in a conversation about this (not EXACTLY this) when I learned that you were wrapping had, for a given package, wrapped binaries built by {some 3rd party, not MX} into a package being redistributed via MX repos. Unfortunately, that conversation soured.

You do not have possession of the source code, thereby impinge users' right to obtain and inspect it.
You have only a representation, offered by some 3rd party who is outside my chain-of-trust, that
"this here source code, I promise THIS is the exact sourcecode used to compile the binary you (the packager) obtained".
-=-
IIRC, your point of view was, essentially: "well it _IS_ exactly the same executable an end-user would/could obtain if they (instead of me, the packager) chose to do so, from the same upstream vendor I've obtained it from."

I'll try again, with all the politeness I can muster: "Sir, that is a red herring"

This packaging scenario represents a failure both in terms of preserving the chain of trust and in terms of licensing.
Not necessarily specific to AppImage format, this non-legalese guidance presented within the AppImageKit wiki will hopefully clarify my position:

Regardless what further interpretation Moonchild brings (specific to MPL vs GPL), such repackaging//bundling//wrapping and redistribution of binary-executables (blobs) represents a violation of the license borne by the packaged "reputedly opensource" application.

https://github.com/AppImage/AppImageKit ... -appimages

Even under open source licenses, distributing and/or using code in source or binary form may create certain legal obligations, such as the distribution of the corresponding source code and build instructions for GPL licensed binaries, and displaying copyright statements and disclaimers. As the author of an application which you are distributing as an AppImage, you are responsible to obey all licenses for any third-party dependencies that you include in your AppImage, and ensure that their licenses and source code are made available, where required, together with the release binaries. AppImageKit itself is released under the permissive MIT license.

"But the end-user can verify the hashsum of the packaged binary"

"Verify by using which tool, Sir?"

It is impractical for an end-user to extract the blob from the package and inspect it, prior to installation. Prior to first-run, what verificaton other than a weak md5sum check can the end-user apply? Does the upstream publisher even provide a checksum to compare against?

For the sake of convenience, and as a matter of practicality, we can (we do) consign ourselves to trusting that the person performing the repackaging has applied checksum verification and, feeling warm-and-fuzzy, we happily accept the "cryptographically signed, and muh keyring" wrapper which contains that repackaged blob.

The licensing/legality issue stands separate, and the position expressed by Moonchild cannot be easily dismissed.

[dreamer]

From a GPL perspective is there a difference between the ISO format and the AppImage, Flatpak and Snap format?

I'm just guessing, but I don't think there is. The Linux world has always been a legal grey area and I think Free Software Foundation accepts it. Maybe Moonchild doesn't "understand" that breaking the rules is common practice?