Flatpak: Cannot install things from system-level gpg-unsecured repos

[sgnn7]

$ flatpak version
Flatpak 0.9.12

$ flatpak remote-add --no-gpg-verify test_staging https://foo/bar

$ flatpak install test_staging com.foo.apps.Platform/x86_64/1
Installing: com.foo.apps.Platform/x86_64/1 from test_staging
error: Can't pull from untrusted non-gpg verified remote

[alexlarsson]

You can, but only with sudo.

[alexlarsson]

i.e. sudo flatpak install test_staging com.foo.apps.Platform/x86_64/1 should work.

[sgnn7]

@alexlarsson Hmm.. fair enough but why does adding a remote pops up the sudo dialog box but this doesn't then? At the very least (imo) the error is misleading.

[alexlarsson]

We use policy-kit to allow the sysadmin the possibility to install from a pre-defined remote while authenticating as the user, not root. However, we really can only do this safely if there is some way to guarantee that the data the user feeds to the system is actually from said remore. If there is no gpg signatures then the user could download whatever he wants and claim they were from that remote.

When you sudo though, the actual download happens as root, and we're to some degree certain that things are from that remote.

[Alexander-Wilms]

Could the error message be changed to give a hint that one needs to run the command as root?