There is no denying that the German government is a bad actor, persecuting conservative political parties opposing their mass immigration policies… And they keep donating large sums to opensource projects. They could just be protecting the software stack they use, but the OCGFC are always working different angles, so what concessions go along with that money? And Flatpak is the IBM/Red Hat app container system they’ve been promoting with an app store, and something I’ll never use along with Ubuntu’s Snap Package system. The opensource alternative if you need it is AppImage. Native apps for your distribution is always the preferred way to go.
https://linuxiac.com/flatpak-secures-e508k-to-bring-stronger-sandboxing-to-linux-apps/
Germany’s Sovereign Tech Agency is investing €508,640 in Flatpak development, targeting stronger sandboxing, new portals, and infrastructure improvements.
By Bobby Borisov
Flatpak, a distribution-independent application packaging and delivery system for Linux, is receiving a substantial financial boost to improve application sandboxing. Germany’s Sovereign Tech Agency, through its Sovereign Tech Fund, is investing €508,640 in a two-year initiative to develop and steward Flatpak over the long term.
The project is co-organized by Modal Collective, with Para-Real Ltd. as the supporting organization. Work will ramp up in the coming months and continue through the end of 2027.
Despite its maturity, Flatpak’s security model still has some gaps compared with platforms like Android and iOS. According to Modal, development in some areas has slowed recently because the work requires specialized knowledge and Flatpak’s maintainers have limited capacity. The newly funded work is intended to address several of those limitations.
One notable improvement concerns audio permissions. Currently, granting an application access to the audio system makes it hard to distinguish between playback access and input devices like microphones.
The project plans to introduce a new static PipeWire socket permission, WirePlumber policy controls, and a portal for managing audio permissions. This should allow an application to use your speakers without automatically gaining microphone access.
Networking is another major area receiving attention. Flatpak is expected to gain more granular network isolation, with permissions distinguishing between access to the host, the local network, and the Internet, as well as individual ports.
A dedicated VPN portal is also planned. Inspired by APIs available on Android and iOS, it would allow third-party VPN applications running inside a Flatpak sandbox to create and manage system-level VPN connections in a controlled way.
Password management is also on the roadmap, though this work is currently exploratory. Developers plan to design a secure password autofill portal that could replace browser Native Messaging, which Modal calls unsuitable for sandboxing.
Interestingly, the investment goes beyond adding individual portals. Flatpak developers also plan a new entitlements system to declare static permissions for specific portals. This should help application store reviewers identify required capabilities and could support more advanced features, including third-party accessibility tools.
Another planned feature, called intents, would let applications advertise the services they provide. XDG Desktop Portal itself will receive maintenance work, including a move toward libdex, additional integration testing, and improvements to system permission dialogs.
The people involved are not starting from scratch. Several members of the team previously worked on the 2023–2024 Sovereign Tech Fund initiative around GNOME. The new Flatpak project includes Philip Withnall, Julian Sparber, Dhanuka Warusadura, Zelda Ahmed, Ignacy Kuchciński, Hari Rana, Eva from the Bazaar project, and longtime GNOME designer Sam Hewitt.
The €508,640 comes from the Sovereign Tech Fund, the main investment program of Germany’s Sovereign Tech Agency. The agency supports foundational open-source technologies seen as important digital infrastructure, emphasizing their security, resilience, and long-term sustainability.