On a multi-user system, Discover makes it hard for users to install applications without stumbling upon system repositories. This takes time to explain to each user that they can install everything on Discover as long as they double and triple check if they are using a system repo. This is too cumbersome. On OpenSUSE I had to remove PackageKit integration because I do not want other users having to deal with system packages while using Discover. This accomplishes what I want in a roundabout way. What I can't do is remove Flatpaks System Repos from User Repos. See, on a multi-user system it makes absolute sense for each user to have their own flahub --user repo, this alongside removing PackageKit means that any user can simply open Discover and install whatever they want, without EVER being asked for root. However, you need to remove the system repo for this to work this seamlessly. The issue with that, is that there are quite a number of flatpak apps that everyone on a system will use, it makes sense to install, for instance, VLC as a system flatpak. However, adding back the system repo through the terminal will also add it to every user Discover, and that isn't what I wish would happen. tl;dr: Wish there was a way to remove system flathub repo from discover without removing system flathub repo from the system.
Discover can be configured to prefer certain Flatpak repos over others, so for exaple you can configure it to prefer the user repo over the system repo. Is there a reason why this doesn't work?
1) it isn't currently reliable. Changing the ordering appears to do the same as flipping a coin. 2) Even if it was reliable, it is still limiting what can be done. Again, with the example of native packages it will inevitably result in packages being shown that can't be installed without root. The entire reason why I'm asking for this feature is so that "average users" in a multi-user PC can utilize Discover 100% of time without having any chance for confusion over whether they can install things over discover
Dear Bug Submitter, This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging If you have already provided the requested information, please mark the bug as REPORTED so that the KDE team knows that the bug is ready to be confirmed. Thank you for helping us make KDE software even better for everyone!
1 is a bug that should be fixed regardless. Can you open a new bug report about that? But yeah, for a multi-user environment I think it makes sense.
> tl;dr: Wish there was a way to remove system flathub repo from discover > without removing system flathub repo from the system. Hi, I'm afraid you're asking for the impossible here. The idea of a 'system' repository is that it applies system-wide, to all users. If you remove it from the system it will remove it from Discover, for all users on the PC. Now unless I'm mistaken, there's actually no need for a system repo at all. When you first add Flathub to your PC, it adds a 'system' repository by default. You can remove it manually and add a 'user' repository manually for each user. Every account can have its own 'user' repository, including the administrator. Adding user repositories currently can only be done via the command line. There is a wishlist request open for adding this functionality to Discovers GUI, see: https://bugs.kde.org/show_bug.cgi?id=481183 In comment #1, Nate suggested prioritising user repos over system repos. I have a bug open for this currently. See here: https://bugs.kde.org/show_bug.cgi?id=510138 In comment #2 you wrote; >2) Even if it was reliable, it is still limiting what can be done. Again, with the example of native packages it will inevitably result in packages >being shown that can't be installed without root. The entire reason why I'm asking for this feature is so that "average users" in a multi-user >PC can utilize Discover 100% of time without having any chance for confusion over whether they can install things over discover There is fundamentally nothing wrong with removing the system repo entirely and having a single user repo configured for each user on the PC, including the administrator. What you're describing here is a parental controls issue. Non-administrator users will still require the administrator (root) password to install certain software in Discover, regardless of whether or not they are trying to install software from a user repository or a system repository. Please track the two separate issues I've mentioned in the two URL's I've shared above. Thanks.
I don't believe you understand what was being discussed in here. I will, write again here, in hopes of clarifying it: The idea is to "mask" repos for DISCOVER, not Flatpak itself, meaning that they are only removed from Discover itself, not the system. For instance: I'd like the ability to remove "system flatpak" from the Discover of User#2, that doesn't mean I want to remove the system repo from the entire system, I'd just like to prevent the user from interacting with it inside Discover. The same is said for packagekit. In a multi-user environment, usually one user is self-assigned the admin of the system, where the rest are simple users. The idea behind this proposal is for those users to have no visible access to "system" stuff inside Discover, while keeping it to the "Admin" As I mentioned in my initial comment, there are some flatpaks which benefit all users, VLC, LibreOffice, Firefox (I will not elaborate why you'd be using Flatpak for those), those flatpaks make sense to be under the System Repo, as a way to cut down on storage and improve security somewhat by knowing all users are using the latest update. The issue is that once you enable the system repo, Discover will also have it enabled on all users, with no option to mask/remove from discover itself. This means that every user will see Discover trying to update it, and receiving a root prompt, even worse: While enabling it, users may find themselves trying to install via the system repo in discover. There is no logical reason why you can't have Discover ignore certain repos, including packagekit. This makes multi-user enviroments a pain to deal with, with the only real solution removing system flatpak and packagekit as well Again, I believe this issue was misunderstood and closed too prematurely. This isn't a request to change flatpak behavior, but about adding a DISCOVER-LEVEL option to hide or remove it from Discover for certain users.
(In reply to WS from comment #6) > I don't believe you understand what was being discussed in here. I will, > write again here, in hopes of clarifying it: > > The idea is to "mask" repos for DISCOVER, not Flatpak itself, meaning that > they are only removed from Discover itself, not the system. > > For instance: I'd like the ability to remove "system flatpak" from the > Discover of User#2, that doesn't mean I want to remove the system repo from > the entire system, I'd just like to prevent the user from interacting with > it inside Discover. The same is said for packagekit. You cannot do this, I'm afraid. It sounds like you're trying to bend and twist the intended use of a system repo into a user repo. Both types of flatpak repo exist for different purposes. Discover is nothing more than a GUI for flatpak, hiding it for flatpak hides it for Discover. > In a multi-user environment, usually one user is self-assigned the admin of > the system, where the rest are simple users. The idea behind this proposal > is for those users to have no visible access to "system" stuff inside > Discover, while keeping it to the "Admin" > > As I mentioned in my initial comment, there are some flatpaks which benefit > all users, VLC, LibreOffice, Firefox (I will not elaborate why you'd be > using Flatpak for those), those flatpaks make sense to be under the System > Repo, as a way to cut down on storage and improve security somewhat by > knowing all users are using the latest update. > > The issue is that once you enable the system repo, Discover will also have > it enabled on all users, with no option to mask/remove from discover itself. > This means that every user will see Discover trying to update it, and > receiving a root prompt, even worse: While enabling it, users may find > themselves trying to install via the system repo in discover. None of this is anything to do with Discover. As I mentioned in my previous comment, this is a parental controls issue. You need to modify the user permissions for the standard user accounts on your PC to stop them installing software from the system repository. See: https://discussion.fedoraproject.org/t/flatpak-non-sudo-install-still-installing-as-system/137019/3 > There is no logical reason why you can't have Discover ignore certain repos, > including packagekit. This makes multi-user enviroments a pain to deal with, > with the only real solution removing system flatpak and packagekit as well > > Again, I believe this issue was misunderstood and closed too prematurely. > This isn't a request to change flatpak behavior, but about adding a > DISCOVER-LEVEL option to hide or remove it from Discover for certain users.
I think there’s still a misunderstanding about what I’m describing, so let me clarify again: I’m not using Fedora nor a Distro that adds users to the wheel group or anything of the sort, and I’m not asking for any change to Flatpak, PackageKit, or system-level permissions. On my distro, users cannot install or update anything that requires root, they will always get a sudo prompt. That works as expected, even I get a sudo prompt, which in my eyes is ideal. What I’m requesting is just a Discover feature: The ability to hide or mask certain repo from the Discover UI on a per-user basis, without removing them from the system. I'm not even asking for a tool to automatically do it for every user. I'm still thinking I'd have to open Discover’s settings page on each user and simply mask “System Flatpak" or “PackageKit” so that their Discover only shows software from the user’s own Flatpak repo. What I want is to: 1. Prevent other users in a multi-user system from seeing or interacting with root-level packages in Discover 2. Drastically reduce the amound of root prompt those users will be able to see. 3. Leave the actual packageKit and system-flatpak repo untouched I managed to basically get the same results by removing packageKit and system-flatpak repo, which is a convoluted solution for multi-user systems
(In reply to WS from comment #8) > I think there’s still a misunderstanding about what I’m describing, so let > me clarify again: > > I’m not using Fedora nor a Distro that adds users to the wheel group or > anything of the sort, and I’m not asking for any change to Flatpak, > PackageKit, or system-level permissions. Yes you are. https://en.opensuse.org/SDB:Administer_with_sudo#Setting_group_access > On my distro, users cannot install or update anything that requires root, > they will always get a sudo prompt. That works as expected, even I get a > sudo prompt, which in my eyes is ideal. Correct. Intentional behaviour. > What I’m requesting is just a Discover feature: > The ability to hide or mask certain repo from the Discover UI on a per-user > basis, without removing them from the system. No. System repos apply to the system, they apply to ALL users by design. User repos apply only to the user that configured it. Therefore, user repos don't need to be masked. > I'm not even asking for a tool to automatically do it for every user. I'm > still thinking I'd have to open Discover’s settings page on each user and > simply mask “System Flatpak" or “PackageKit” so that their Discover only > shows software from the user’s own Flatpak repo. There is no need to mask them. You just need to stop users installing software from system repos. Read this and change user permissions accordingly. https://discussion.fedoraproject.org/t/flatpak-non-sudo-install-still-installing-as-system/137019/3 > What I want is to: > > 1. Prevent other users in a multi-user system from seeing or interacting > with root-level packages in Discover See link above to Fedora discussion page. > 2. Drastically reduce the amound of root prompt those users will be able to > see. Users may still see password prompts if they install, For example, 18+ rated games, even from user repositores. > 3. Leave the actual packageKit and system-flatpak repo untouched No problem. Revoke user permissions as per the Fedora discussion link. > I managed to basically get the same results by removing packageKit and > system-flatpak repo, which is a convoluted solution for multi-user systems Unecessary. Please understand I will not be replying again. It is your job as the administrator to choose who can Install what software.
John, he's asking for the ability to restrict what repos that are already present are shown in Discover, *irrespective of how Flatpak itself is configured on the system*. IMO it's a reasonable request, especially if we envision Discover using used in organizations in the future; re-opening. Also, please be aware that you're representing KDE when you communicate with people in bug reports. Let's try to be empathetic to people's needs and use cases. Thanks!