Bitwarden should manage its Flathub application

I reluctantly went with the Snap on OpenSUSE Tumbleweed because I like to get auto-updates. I’d rather be using Flatpak (not keen on Canonical) but I can’t trust something as important as password management to a package maintained by a third party.

The Flatpak comes up in Discover as by “8bit Solutions LLC”, but at the bottom of the description is a note saying “This wrapper is not verified by, affiliated with, or supported by 8bit Solutions LLC.” To clear up confusion, Bitwarden should publish its own official Flatpak.

3 Likes

Voted this up, and agreed with the comments, this should be managed by Bitwarden. I’m also a premium customer and use Bitwarden because of it’s strong Linux and cross-platform integration.

5 Likes

Welcome to the community @9heavens - we appreciate your feedback!

1 Like

Like a few others, I created an account to vote on this. Actually, I watched a youtube video which mentioned a social media post suggesting people come here and vote on this, squinted at (I’m legally blind) half the link that was visible, came to the site, found this by searching for it, then created an account to vote on this.

I did this because I used to be a Debian developer, and still am a Debian user. Bitwarden creates deb packages, but there’s two good reasons why that’s not good enough. The first is that a Bitwarden deb installed without a Debian repository shows up in the package manager as obsolete/local. The package manager is subtly suggesting this package doesn’t belong installed (anymore) and maybe you want to remove it. But even if it were in a repo (and it’s not hard to set that up BTW), you’re still giving someone other than Debian’s package developers root access to your machine. Yes really, that’s what it means to install a 3rd party package. So think about that before you do it, folks!

But beyond that, Flatpak is the only intended way to install Bitwarden on to some systems like the Steamdeck. I don’t use one (mobile gaming is not for me), but I know people who do and I think it’s important that they know they can trust the BW flatpak hasn’t been tampered with.

As for what I want to see with the BW flatpak … I’d like the CLI tool to be in the bundle. Yeah I know, flatpaks are for GUI applications. You can run CLI commands in them, though, and you can set up thin wrappers to do so via a command name that goes into your path and just does what you want. I’d like that to be an easy thing.

6 Likes

As a developer on openSUSE Aeon and Kalpa, which are leveraging flatpak for the vast majority of our desktop applications, and have a “flatpak first” policy, this is certainly one that we would like to see as an “official” flatpak maintained by upstream.

On a personal level, I’m a paid Bitwarden customer, and I’d like to see it just for my own personal use. As it is, I don’t have the unofficial flatpak installed, due to some instability I’ve found. I just leverage the browser extensions, which is less than ideal.

6 Likes

Come on Bitwarden, help @cassidyjames out already :slight_smile: Let’s move this forward!

1 Like

From Github, Bitwarden has this issue “tracked internally.”

3 Likes

Long time KeepassXC user here. I am starting to integrate Bitwarden into my workflow since i have 3 Android devices and am going to be using heavily for the foreseeable future. The native Android app is a plus over KeepassXC. While my main machine is a Fedora Only box and all applications are OCI/Podman/Docker containers or Flatpaks. A future steam machine will also be flatpaks. KeepassXC has a native solution there.

what are the sticking points to not support the project on Flathub?

2 Likes

There is now a verified flatpak app for Goldwarden, an unofficial third-party Bitwarden client.

However, if you use Goldwarden, you still have to trust the developer of Goldwarden since it’s a third-party app.

Developer of the client here, Goldwarden itself and the Flatpak are open source, and built on GitHub/FlatHubs infrastructure. If you are a technical user, you can read the source code to verify, and verify that the binaries are built from those sources.

If you don’t have the means to or the time to, sure it’s based on trust, though I do have rather close ties to the community and to Bitwarden itself by making various code contributions to and security research for the official clients, so I wouldn’t want to waste that reputation :wink:

Do note the feature-set is somewhat orthogonal to the desktop app, since it’s less about managing your vault, but more about providing (linux)-desktop integration (auto-type, ssh keys, biometrics and so on).

Though, on that note, I do feel it’s an issue that FlatHub displays my unofficial client as “verified” (to my domain, as a developer) where the official client which is also built from source on FlatHubs infrastructure is not (because it’s not managed by Bitwarden).

Though, this should be fixed once Bitwarden takes over management of the FlatHub client (hopefully soon) :slight_smile:

3 Likes

+1 for this. AppImage format seems to be a pain to integrate into the desktop environment. I currently have a process for manually creating the .desktop file for Bitwarden because it’s the only AppImage that I use, and I don’t want to install some external tool just for managing a single AppImage (see Running AppImages — AppImage documentation). But it would be much more convenient to install via Flatpak.

Not to mention that AppImage uses a deprecated fuse2 and cannot upgrade to fuse3.

2 Likes

+1 for Bitwarden Asahi Linux usage.

It would be more convenient to utilize an external tool like AppImage Pool | Flathub.

@bw-admin Any updates regarding this request?

2 Likes

It is a little ridiculous that something like this would take so long for Bitwarden to take charge of and maintain.

But, there are other request that have been made over the years that seem to never get any traction with the Bitwarden team. I’m thinking this will continue to be one of them.

1 Like

I found out lot of information helpful. Thanks for sharing this thread.

1 Like

It’s been six years since this thread started. I’m still holding out hope we’ll get a verified flatpak some day.

I’m also interested in part due to the possibility of ARM64 support. The appimage is only available for x86, whereas the unofficial flatpak has builds for both x86 and ARM.

1 Like

Are you sure about this? Build from source & enable aarch64 build by proletarius101 · Pull Request #55 · flathub/com.bitwarden.desktop · GitHub is still open.

2 Likes

Huh. The manifest itself also says

        only-arches:
          - x86_64

But the Flathub page says

Available Architectures
aarch64, x86_64
1 Like