Skip to content

Improve software-installation section under FAQ #291

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Meijuta wants to merge 5 commits into
base: live
Choose a base branch
from
Draft

Improve software-installation section under FAQ #291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e76d859
Improve software-installation section under FAQ
Meijuta Feb 8, 2026
8b2184e
Merge branch 'live' into patch-1
Meijuta Feb 14, 2026
b57e344
Addressed most issues commented on in the FAQ
Meijuta Feb 14, 2026
6bcc0bc
minor changes to the flatpak article
Meijuta Feb 14, 2026
47284a6
Cut a bit from flatpak section of FAQ to move to the flatpak article
Meijuta Feb 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 20 additions & 7 deletions content/FAQ.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,13 +203,24 @@ secureblue prevents [numerous modules](https://github.com/secureblue/secureblue/

### [How do I install software?](#software)
{: #software}

1. Check if it's already installed using `rpm -qa | grep x`
2. For GUI packages, you can install the Flatpak if available using the Software store or using `flatpak install`. You can browse this [catalogue of Flatpaks](https://flathub.org) to discover the available packages.
3. For CLI packages, you can install from brew if available using `brew install`. You can browse this [catalogue of Homebrew Formulae](https://formulae.brew.sh) to discover the available formulae.
4. If a package isn't available via the other two options, or if a package requires greater system integration, `rpm-ostree install` can be used to layer rpms directly into your subsequent deployments.

You can add the unfiltered Flathub repo with `ujust enable-flathub-unfiltered`.
#### Check if software is already installed
> `rpm -qa | grep x`

#### Flatpak
[Flatpaks](https://flatpak.org/) are the recommended way to install GUI software in secureblue, with the exception of [browsers](https://github.com/RKNF404/chromium-hardening-guide/blob/main/pages/BROWSER_SELECTION.md#flatpak-linux). An article on why we recommend flatpaks, as well as some recommended configuration, is available [here](https://secureblue.dev/articles/flatpak).
##### Installing Flatpaks
###### Bazaar
[Bazaar](https://github.com/kolunmi/bazaar) is the app store that comes preinstalled with secureblue. It is forked for secureblue so we can make a few of our own changes and audit updates for security. It by default filters EoL apps and certain apps with known security issues. Do note that the scope of this filter is limited and an app being unfiltered does not mean it is secure. Bazaar has a curated tab for software that compliments secureblue.
###### CLI
Flatpaks can by installed using the flatpak CLI tool, which is preinstalled with secureblue. Run `flatpak --help` for a list of commands and their usage. You can browse this [catalogue of Flatpaks](https://flathub.org) to discover the available packages.
#### Homebrew
For CLI packages, you can install with [Homebrew](https://docs.brew.sh/Manpage) using `brew install <package>`. You can browse this [catalogue of Homebrew Formulae](https://formulae.brew.sh) to discover the available formulae.
#### RPM
If a package isn't available via Flatpak or Homebrew, or if a package requires greater system integration, `rpm-ostree install <package>` can be used to layer rpms directly into your subsequent deployments. Sometimes an additional repository needs to be added to install software.

Note that by adding a third party repo, you are trusting the owner of that repo. **You should avoid adding third party repos**. But, if you must use a third party repo, run:
`curl -O --output-dir /etc/yum.repos.d/ <repository-URL>`
`rpm-ostree install <packagename>`

### [How do I install my VPN?](#vpn)
{: #vpn}
Expand Down Expand Up @@ -488,6 +499,8 @@ For example:
rpm-ostree install funionfs
```

Note: Sometimes AppImages can work if you extract them with `/path/to/your/appimage --appimage-extract`, then enter the `squashfs-root` directory created and run whatever binary is in there.
Copy link

@thegreatGreenstar thegreatGreenstar Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Note: Sometimes AppImages can work if you extract them with `/path/to/your/appimage --appimage-extract`, then enter the `squashfs-root` directory created and run whatever binary is in there.
Note: [Type 2](https://github.com/AppImage/AppImageSpec/blob/master/draft.md#type-2-image-format) AppImages can work if you extract them with `/path/to/your/appimage --appimage-extract`, then enter the `squashfs-root` directory created and run whatever binary is in there.

Copy link

@thegreatGreenstar thegreatGreenstar Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The slowdown in doing so should be mentioned. Because a link or source of some kind would be useful to verify such a statement I shall not suggest such as I currently lack such a source with proper formality.


### [Why won't Trivalent start when Bubblejailed?](#trivalent-bubblejail)
{: #trivalent-bubblejail}

Expand Down
2 changes: 1 addition & 1 deletion content/articles/FLATPAK.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ You can revert this change by running:
ujust flatpak-reset-global-overrides
```

Note that this will not only undo the the `ujust flatpak-permissions-lockdown` command but also any other global overrides (individual app overrides will not be affected). This also affects flatpak's hardened_malloc integration (which is set by default), so you should run this afterwards:
Note that this will not only undo the the `ujust flatpak-permissions-lockdown` command but also any other global overrides (individual app overrides will not be affected). This also affects flatpak's [Hardened_Malloc](https://github.com/GrapheneOS/hardened_malloc) integration (which is set by default), so you should run this afterwards:

```
ujust harden-flatpak
Expand Down