most music available on spotify is on youtube, but im old school and like to purchase albums and hard copies where i can if i really like the music. youtube-dl and keep your music on a portable local drive

Same here.

I dont see the point in spotify

Me too.

https://nuclear.js.org/
https://freetubeapp.io/

I still wonder what the differences were.  But, I don't use Spotify.

The only way to install such software with any degree of safety is to create a chroot and install it there - but it's still not to be considered trustworthy.  As I understand it, it's a binary distribution, so you're somewhat hamstrung, but without resorting to a chroot, you could also unpack the deb and manually install the components under /usr/local , create symbolic links, etc...

debootstrap + schroot + firejail =  relatively secure way for third party repos.

1. Create separated root filesystem with debootstrap

2. Install packages into chroot environment

3. Run program via firejail and schroot

ToxicExMachina wrote:

in system totally controlled by microsoft-friendly company (RedHat and Canonical are friends of microsoft) is not a good idea

Using Spotify is not a good idea but that's what the OP wants and IMO a sandboxed chroot is a better option than handing control of APT to the Spotify developers.

Yes. And he don't need another third party wannabe-"secure" package manager for that.

The subject is not kernel.

man firejail

Maybe someone made a package. I don't know. However, there is no official flatpak package.

I don't think about that - user should decide the grade of acceptance.

Flatpak is systemd way. It's also extremely insecure thing with fake sandboxing: https://flatkill.org/

in system totally controlled by microsoft-friendly company (RedHat and Canonical are friends of microsoft) is not a good idea

Using Spotify is not a good idea but that's what the OP wants and IMO a sandboxed chroot is a better option than handing control of APT to the Spotify developers.

Oh, and RedHat, Cannonical and Microsoft are all contributors to the Linux kernel itself.

All programs have firejail "support", that's not an intrinsic feature of AppImages.

I didn't claim otherwise, my question was are there any Spotify AppImages available at all?

Why do you think it is acceptable to hand the APT keys over to a proprietary company?

As I mentioned earlier, flatpak can be run without root permissions, which seems significantly safer to me.

ToxicExMachina wrote:

Both flatpak and snap are EEE projects

And what has that to do with anything?

Additional package manager in system totally controlled by microsoft-friendly company (RedHat and Canonical are friends of microsoft) is not a good idea.

AppImage has FireJail sandbox support. So it's definitely much and much more than nothing.

According to official website Spotify doesn't provide official flatpak builds. Moreover: there is official deb repository.

Besides, flatpak and/or snap instead of AppImage is a trait of incompetent upstream maintainer.

I may also suggest a totally open source alternative to Spotify: https://github.com/nukeop/nuclear
It has AppImage builds

Both flatpak and snap are EEE projects

And what has that to do with anything?

Well if that was the case then your previous statement would be false because the alternatives would lack the middle E...

In the case of flatpak the advantage is the sandbox provided by bubblewrap, it's not great security but it's better than nothing (which is what AppImages provide).

Also, do Spotify even provide an AppImage?

^ Well I couldn't find a snapd package in the Devuan repositories

But seriously, I don't think giving the Spotify developers the opportunity to mess up the dependency chain is a good idea.

flatpak may be a bloated pile of crap but at least it can be run without root privileges (with the --user flag) and it doesn't interfere with the package manager.

Both flatpak and snap are EEE projects. AppImage is better because it's tarball evolution.