Are apps on Flathub legitimate and safe?
@l3l_aze answer is complete from my point of view and should be the accepted answer, but let's look at a few examples.
The Discord example
I'm trying to explain how this works to myself here, so let's see what we have.
What is a wrapper (function)?
Wrapper functions can be used to adapt an existing class or object to have a different interface. This is especially useful when using existing library code.
That looks like a precise and short explanation to me. What does that mean in practice for Flathub and the Flatpak packaging format in this case? Someone from the community took existing software and wrapped it in Flatpak bubblewrap padding. Sounds funny, but it is true. I could talk in more overused terms about sandboxing and containers, but let's keep it brief.
So Flatpak should wrap an object for us in bubblewrap, so we can carry it around safely. Where does the object come from? You can read the source: com.discordapp.Discord.json#L114 An automated build process fetches the software source code or binary objects directly from the manufacturer website and adds required dependencies, just like you would do. The other parts should only be metadata and helper functions.
An abandoned app example
Here is an anecdotal example about how Flathub---the crowd sourced community that Discover Software Center builds up on---publishing and packing works in practice, and with how much the team that runs Flathub burdens themselves: https://github.com/puddletag/puddletag/issues/735
In this case we have an app (a music tag editor) which has been abandoned by its original author. After some time a few members of the community stepped up to port it to a newer platform (Python 3 and newer Qt). Packaging it for Flathub and publishing it there would make it easier for a lot of users from my point of view, but the current project leads don't feel comfortable and don't have it on their roadmap yet. Another user stepped up to do most of the work, but Flathub refused to publish the app this way. Sounds a bit ambiguous at first when compared to the discord example. But not everyone can spin their own copy of a popular app and publish it on Flathub. This it as much as we have right now.
Software supply chain security, where is the industry now?
Well you started to ask the right questions, but you need to see where we are at this point with the software engineering industry. Free software and free software components have taken over but many people still don't understand what that means and what the risks are. Consumers will probably never understand, and people who learned doing it the wrong way to get things done will only unlearn over a long time. That is the baggage we are still carrying around from days when only very few people were software engineers and nobody really cared about security because most systems were not connected and thus less useful and less risky.
Requirements for a software bill of materials could improve the situation, but it will be a long road ahead.
From another point of view we need to also consider software preservation, which is where I see Steam and Wine/Proton playing a big part. The Discover Software Center as a whole, and how it is integrated at the moment looks like an afterthought. They knew they had to offer a way for traditional desktop experience and a way to get popular apps without reinventing the wheel like Apple and Google are doing and at which Canonical (Ubuntu) failed with their phone undertaking, so they choose Flathub, a good choice for people who know their way around things (it serves the community well) and how to read code, but out matched by the big competitors.
My opinions and observations:
- I don't like walled gardens.
- I don't like antivirus software packages.
- Free software packaging which Linux distributions like Debian started in the 1990ies, and which JFrog, Sonatype and other competitors took to the next level makes a lot of sense from the professional point of view.
- Implementing secure systems is very difficult, many developers are under constant pressure to deliver new features built up on code they thought they understood until it broke.