Git-Mirrors/haveno
1
0
Fork 0
mirror of https://github.com/haveno-dex/haveno.git synced 2025-07-04 03:26:43 -04:00
Code Issues Projects Releases Packages Wiki Activity

chore: sorry codeql

Browse source
This commit is contained in:
justynboyer@gmail.com 2024-09-16 17:16:26 +01:00
parent fa319ac080
commit 884a0ebea7
2 changed files with 30 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

9
desktop/package/README.md
View file

@ -1,6 +1,3 @@
# Building installers
Follow these instructions to create installers for the Haveno Java desktop application on each platform.
> **Note**
@ -15,7 +12,8 @@ From x86_64 machine:
3. Confirm prompts.
4. Path to installer is printed at the end. Execute to install: `sudo dpkg -i <path>.deb` or open `<path>.deb` with Software Install.
Note: Please see [flatpak.md](../../docs/flatpak.md) for information on distributing Haveno via Flatpak.
Note: Please see [flatpak.md](../../docs/flatpak.md) for information on
distributing Haveno via Flatpak.
Haveno data folder on Linux: `/home/<username>/.local/share/Haveno/`
@ -102,7 +100,8 @@ sudo apt install flatpak flatpak-builder
### Building for macOS
Svg was converted into a 1024x1024 pixel PNG using <https://webkul.github.io/myscale/>, then converted to icns for macosx
Svg was converted into a 1024x1024 pixel PNG using
<https://webkul.github.io/myscale/>, then converted to icns for macosx
here <https://cloudconvert.com/png-to-icns>
#### Known Issues

32
docs/flatpak.md
View file

@ -1,13 +1,33 @@
# Flatpak distribution
The `.flatpak` binary files (known as "bundles") that `./gradlew packageInstallers` creates can be used to download and install Haveno, but there are several security issues that arise in Flatpak when only using the bundle files:
The `.flatpak` binary files (known as "bundles") that
`./gradlew packageInstallers` creates can be used to download and install
Haveno, but there are several security issues that arise in Flatpak when only
using the bundle files:
- There is no [digital signature](https://en.wikipedia.org/wiki/Digital_signature), if a bad actor were to upload a malicious `.flatpak` the users would have no way to tell when upgrading.
- Upgrading isn't as easy, your users need to find the new Flatpak bundle file, and you cannot update multiple apps easily.
- There is no
[digital signature](https://en.wikipedia.org/wiki/Digital_signature),
if a bad actor were to upload a malicious `.flatpak` the users would have no
way to tell when upgrading.
- Upgrading isn't as easy, your users need to find the new Flatpak bundle file,
and you cannot update multiple apps easily.
- This also makes an accidental downgrade much more likely.
Flatpak has a solution for these issues, a [Flatpak repository](https://docs.flatpak.org/en/latest/repositories.html). Flatpak repos store the data of their apps within an OSTree (almost like git) repository, and the commits can be signed with a GPG key. The nature of OSTree also allows for easy updates, as the Flatpak client can download deltas of the changes instead of the entire file.
Flatpak has a solution for these issues, a
[Flatpak repository](https://docs.flatpak.org/en/latest/repositories.html).
Flatpak repos store the data of their apps within an OSTree (almost like git)
repository, and the commits can be signed with a GPG key. The nature of OSTree
also allows for easy updates, as the Flatpak client can download deltas of the
changes instead of the entire file.
If you plan on distributing Haveno as a Flatpak, it's recommended to create a Flatpak repository as well. This guide will show you how to create a Flatpak repository for Haveno. The official documentation states that [it's possible to use GitHub/Lab Pages](https://docs.flatpak.org/en/latest/hosting-a-repository.html#hosting-a-repository-on-gitlab-github-pages) to host the repository, but this hasn't been tested. The more common way is to use a web server, or something like [flat-manager](https://github.com/flatpak/flat-manager).
If you plan on distributing Haveno as a Flatpak, it's recommended to create a
Flatpak repository as well. This guide will show you how to create a Flatpak
repository for Haveno. The official documentation states that [it's possible to
use GitHub/Lab Pages](https://docs.flatpak.org/en/latest/hosting-a-repository.html#hosting-a-repository-on-gitlab-github-pages)
to host the repository, but this hasn't been tested. The more common way is to
use a web server, or something like
[flat-manager](https://github.com/flatpak/flat-manager).
An example Haveno flat-manager solution using `docker-compose` has been created and documented at <https://gitlab.com/Jabster28/flatman-haveno-test.git> if you want a quick way to get started. Note that this does require an always-on server.
An example Haveno flat-manager solution using `docker-compose` has been created
and documented at <https://gitlab.com/Jabster28/flatman-haveno-test.git> if you
want a quick way to get started. Note that this does require an always-on server.