Use the system Bitwarden CLI package

[yochananmarqos]

Please don't ship a precompiled Bitwarden CLI binary in the repo. Use the upstream version by checking for /usr/bin/bw, /usr/local/bin/bw or ~/bin/bw, etc.

[mxmvncnt]

The end goal is to include it in the Flatpak dependencies, not sure if that would work, the reason it is in the main repository was for easier testing and cloning. This is a way to avoid different installations that were not found etc. Like I said I want to change this as the time goes because requiring people to install a tool first is not very straightforward in my opinion.

[dusansimic]

The end goal is to include it in the Flatpak dependencies

That would be imho the best solution.

Like I said I want to change this as the time goes because requiring people to install a tool first is not very straightforward in my opinion.

If this app depends on bw cli, then for the app to exist in any repo there needs to be access to bw cli via that repo or it should be bundled with the app. It should not be the apps responsibility to check for new versions and download them, that's the responsibility of package maintainers.

[yochananmarqos]

There are several distros that package bitwarden-cli.

An unknown, custom bw binary should NOT be bundled with this. I refuse to use it and symlink the bitwarden-cli Arch package bw binary to the Bitsteward directory instead. However, it no longer is working since you changed something. I can open a new issue if you wish.

You already say this program is insecure with a disclaimer which is fine for now in early development.

[mxmvncnt]

There are several distros that package bitwarden-cli.

An unknown, custom bw binary should NOT be bundled with this. I refuse to use it and symlink the bitwarden-cli Arch package bw binary to the Bitsteward directory instead.

I understand your concern, if there is a way to bundle an outside binary in a Flatpak, I would love to know, but for now, the best I could do is to both ship it and have people check the signature and compare it with the original signature (its not custom), and have a way to detect if the bw package is already installed on the system and use that instead.

I am not familiar with flatpak packaging, so help/guidance would be appreciated for this. I know that for an eventual AUR package, I can simply install the bw package directly as a dependency, and that would eliminate your concern.

However, it no longer is working since you changed something. I can open a new issue if you wish.

Yes, I did some changes to the way the app interacts with BW, and I updated the readme with new instructions. The new way is more secure as it prevents other apps and devices on the network from getting the entire vault's content

[yochananmarqos]

I am not familiar with flatpak packaging

Neither am I, so I can't help there. However, I think there may be a way to pull it in via git and build it when packaging.

I know that for an eventual AUR package, I can simply install the bw package directly as a dependency, and that would eliminate your concern.

I'm already doing that with my preliminary package I'm using locally.

I did some changes to the way the app interacts with BW

...and it broke. See #16. Sorry, the Issue title could be better.

[dusansimic]

I am not familiar with flatpak packaging, so help/guidance would be appreciated for this.

I maintain a few flatpak packages on flathub so I could help out. You essentially could just put an url as a source for a binary which would pull in bw cli directly from the GitHub release page for example. You could also use flatpak-external-data-checker to automate checking for updates. I've implemented it on one of packages I maintain so I could help out with that. I think it would be ideal to track this in another issue.

and have a way to detect if the bw package is already installed on the system and use that instead.

I still feel like this should be avoided. It could cause potential security issues if the installation process of bw-cli is not handled on package install. Relying on users to download bw-cli themselves and update it is a bad idea imho.

[mxmvncnt]

You essentially could just put an url as a source for a binary which would pull in bw cli directly from the GitHub release page for example. You could also use flatpak-external-data-checker to automate checking for updates.

Cool to know that exists, I think that would be ideal, as it removes binary files from the git repo, and makes sure that no one tampered with the BW binary. Ill definitely look into using the flatpak external data checker and Flatpak packaging, but for now, I think there is more important stuff I need to focus on the app, especially a login page. When that is done, i think an alpha flatpak release could make sense

I still feel like this should be avoided. It could cause potential security issues if the installation process of bw-cli is not handled on package install. Relying on users to download bw-cli themselves and update it is a bad idea imho.

I also feel similar, this would go against the purpose of Flatpak, it would not be an AIO 1-click install anymore, plus some distros package really old versions that could have security holes/broken features.