I am well aware that this issue has been known for a long time. However, is such an action okay? Is it enough to remove the user from the wheel group?
What are you doing in discover that should require a password?
You should never use discover for package management on an Arch-based distro and installing flatpaks and plasma widgets doesn’t require a password.
5 Likes
I simply mean the fact of such packagekit behavior. The user does not know that the applications are installed in another space and thus it is not safe. This surprises me, because discover is an integral part of plasma and packagekit is its dependency.
You should never, ever use packagekit on an Arch-based distro to install or update packages. Packagekit by design doesn’t allow any user intervention and Arch requires user intervention in many cases. If you even try to use discover with packagekit you will get this nasty message:
This is not some empty warning. It can break your system. Make it unbootable.
If you don’t mind if your system breaks and for some reason need to use Discover instead of any of the more appropriate tools and you want to make it so installing software requires escalated privileges, you can alter the polkit rules to enforce that.
Removing your user from the wheel group will make it so that user can’t do any privilege escalation at all. That probably isn’t what you want.
4 Likes
@matadrox This may be true, in general. But as far as any Arch based distro goes, Discover is not NOT integral in any way. Nor should it be. As @dalto said… “You should never, ever use packagekit on an Arch-based distro to install or update packages… This is not some empty warning. It can break your system. Make it unbootable.”
That’s not to say that Discover can’t be of use on an Arch based system if used properly. I use it for Flatpaks. ALL sources except Flathub have been removed in Discover’s settings and Flathub marked a ‘Default Source’. Discover then turns into a solid Flatpak front end.
1 Like
I understand all this. just wanted to point it out, because in general less informed users are very keen to use Discover even to perform a system update. Thank you gentlemen for all the information.
Even you installed Discover which we don’t include in the default install, you would have to know to manually install packagekit-qt6 or you won’t see any repo packages in Discover.
1 Like
To be honest, I haven’t checked if EOS offers Discover because I don’t use it. It’s good to hear that it doesn’t.
1 Like
I have a question: are there any good GUI software installers that can be used on Arch/EndeavourOS?
I use Discover to manage Flatpaks and Plasma add-ons. I use EndeavourOS’ terminal tools (yay) to install updates to system packages and non-Flatpak applications. However, yay is not a good tool for finding, installing, and removing non-Flatpak applications because you have to know the actual Arch name of the package that needs to be installed/removed. This requires a hit or miss search on ArchLinux.org or Google. Also, sometimes when it’s time to remove non-Flatpak applications you need to know the name of the dependencies that were installed because they sometimes don’t get automatically marked for removal. If not, you need to go through the orphan removal process…
Here’s some discussion considering this. Just ignore the part where it gets really odd. 
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.