Installing eduVPN via Flatpak or Appimage #660

thms-k commented 2025年09月30日 13:57:01 +02:00

Hi,
since I'm on an atomic distro (Bluefin), I'd love to see a Flatpak or AppImage version of eduVPN. This would avoid the hassle with layering apps to the system.

Thanks!

Hi, since I'm on an atomic distro (Bluefin), I'd love to see a Flatpak or AppImage version of eduVPN. This would avoid the hassle with layering apps to the system. Thanks!

jwijenbergh commented 2025年10月01日 11:40:25 +02:00

Would you like to submit packages for this? #537

Supporting this is not trivial due to the flatpak sandbox. Personally I am not interested in an AppImage, but PRs welcome :)

Would you like to submit packages for this? https://codeberg.org/eduVPN/linux-app/issues/537 Supporting this is not trivial due to the flatpak sandbox. Personally I am not interested in an AppImage, but PRs welcome :)

thms-k commented 2025年10月01日 12:36:37 +02:00

Sorry, I can't code. I'm just a user who thought a Flatpak version would be a good idea ;b I can test things though.

Sorry, I can't code. I'm just a user who thought a Flatpak version would be a good idea ;b I can test things though.

jwijenbergh commented 2025年10月01日 12:44:03 +02:00

I personally don't have the time to support this

I personally don't have the time to support this

jwijenbergh commented 2025年10月01日 12:44:26 +02:00

please someone comment if you want to pick this up

please someone comment if you want to pick this up

WebSpider commented 2026年03月11日 11:00:16 +01:00

@jwijenbergh I am moving my daily driver from ubuntu to Bluefin, which is mainly flatpak based. I'd like to give it a go.

@jwijenbergh I am moving my daily driver from ubuntu to Bluefin, which is mainly flatpak based. I'd like to give it a go.

jwijenbergh commented 2026年03月11日 11:04:39 +01:00

Thanks! Let me know if you have any questions or an update regarding this

Thanks! Let me know if you have any questions or an update regarding this

WebSpider commented 2026年03月11日 13:23:36 +01:00

After a bit of fiddling, eduVPN 4.6.0 runs as a flatpak, thanks to the extensive notes in #537

Wireguard just works out of the box, but when trying/connecting to an openvpn profile, there is an error on the console, resulting in a state machine messup:

time=2026年03月11日T13:18:32.927+01:00 level=DEBUG msg="FSM transition" old=GotConfig new=Connecting
2026年03月11日 13:18:32,929 - MainThread - ERROR - /app/lib/python3.13/site-packages/eduvpn/utils.py - utils.py:28 - Unhandled exception
Traceback (most recent call last):
 File "/app/lib/python3.13/site-packages/eduvpn/app.py", line 425, in connect
 connection.connect(
 ~~~~~~~~~~~~~~~~~~^
 self.nm_manager,
 ^^^^^^^^^^^^^^^^
 ...<4 lines>...
 on_connect,
 ^^^^^^^^^^^
 )
 ^
 File "/app/lib/python3.13/site-packages/eduvpn/connection.py", line 166, in connect
 manager.start_openvpn_connection(
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
 self.config_str,
 ^^^^^^^^^^^^^^^^
 ...<2 lines>...
 callback=callback,
 ^^^^^^^^^^^^^^^^^^
 )
 ^
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 412, in start_openvpn_connection
 new_con = self.import_ovpn(ovpn)
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 366, in import_ovpn
 connection = self.ovpn_import(target)
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 351, in ovpn_import
 raise Exception(f"Expected one openvpn VPN plugins, got: {len(vpn_infos)}")
Exception: Expected one openvpn VPN plugins, got: 0

After a bit of fiddling, eduVPN 4.6.0 runs as a flatpak, thanks to the extensive notes in #537 Wireguard just works out of the box, but when trying/connecting to an openvpn profile, there is an error on the console, resulting in a state machine messup: ``` time=2026年03月11日T13:18:32.927+01:00 level=DEBUG msg="FSM transition" old=GotConfig new=Connecting 2026年03月11日 13:18:32,929 - MainThread - ERROR - /app/lib/python3.13/site-packages/eduvpn/utils.py - utils.py:28 - Unhandled exception Traceback (most recent call last): File "/app/lib/python3.13/site-packages/eduvpn/app.py", line 425, in connect connection.connect( ~~~~~~~~~~~~~~~~~~^ self.nm_manager, ^^^^^^^^^^^^^^^^ ...<4 lines>... on_connect, ^^^^^^^^^^^ ) ^ File "/app/lib/python3.13/site-packages/eduvpn/connection.py", line 166, in connect manager.start_openvpn_connection( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ self.config_str, ^^^^^^^^^^^^^^^^ ...<2 lines>... callback=callback, ^^^^^^^^^^^^^^^^^^ ) ^ File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 412, in start_openvpn_connection new_con = self.import_ovpn(ovpn) File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 366, in import_ovpn connection = self.ovpn_import(target) File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 351, in ovpn_import raise Exception(f"Expected one openvpn VPN plugins, got: {len(vpn_infos)}") Exception: Expected one openvpn VPN plugins, got: 0 ```

jwijenbergh commented 2026年03月11日 13:33:54 +01:00

@WebSpider wrote in #660 (comment):

After a bit of fiddling, eduVPN 4.6.0 runs as a flatpak, thanks to the extensive notes in #537

Wireguard just works out of the box, but when trying/connecting to an openvpn profile, there is an error on the console, resulting in a state machine messup:

time=2026年03月11日T13:18:32.927+01:00 level=DEBUG msg="FSM transition" old=GotConfig new=Connecting
2026年03月11日 13:18:32,929 - MainThread - ERROR - /app/lib/python3.13/site-packages/eduvpn/utils.py - utils.py:28 - Unhandled exception
Traceback (most recent call last):
 File "/app/lib/python3.13/site-packages/eduvpn/app.py", line 425, in connect
 connection.connect(
 ~~~~~~~~~~~~~~~~~~^
 self.nm_manager,
 ^^^^^^^^^^^^^^^^
 ...<4 lines>...
 on_connect,
 ^^^^^^^^^^^
 )
 ^
 File "/app/lib/python3.13/site-packages/eduvpn/connection.py", line 166, in connect
 manager.start_openvpn_connection(
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
 self.config_str,
 ^^^^^^^^^^^^^^^^
 ...<2 lines>...
 callback=callback,
 ^^^^^^^^^^^^^^^^^^
 )
 ^
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 412, in start_openvpn_connection
 new_con = self.import_ovpn(ovpn)
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 366, in import_ovpn
 connection = self.ovpn_import(target)
 File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 351, in ovpn_import
 raise Exception(f"Expected one openvpn VPN plugins, got: {len(vpn_infos)}")
Exception: Expected one openvpn VPN plugins, got: 0

This seems like it cannot find the NetworkManager-openvpn plugin. Maybe the flatpak needs that as a dependency?

@WebSpider wrote in https://codeberg.org/eduVPN/linux-app/issues/660#issuecomment-11514250: > After a bit of fiddling, eduVPN 4.6.0 runs as a flatpak, thanks to the extensive notes in #537 > > Wireguard just works out of the box, but when trying/connecting to an openvpn profile, there is an error on the console, resulting in a state machine messup: > > ```text > time=2026年03月11日T13:18:32.927+01:00 level=DEBUG msg="FSM transition" old=GotConfig new=Connecting > 2026年03月11日 13:18:32,929 - MainThread - ERROR - /app/lib/python3.13/site-packages/eduvpn/utils.py - utils.py:28 - Unhandled exception > Traceback (most recent call last): > File "/app/lib/python3.13/site-packages/eduvpn/app.py", line 425, in connect > connection.connect( > ~~~~~~~~~~~~~~~~~~^ > self.nm_manager, > ^^^^^^^^^^^^^^^^ > ...<4 lines>... > on_connect, > ^^^^^^^^^^^ > ) > ^ > File "/app/lib/python3.13/site-packages/eduvpn/connection.py", line 166, in connect > manager.start_openvpn_connection( > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ > self.config_str, > ^^^^^^^^^^^^^^^^ > ...<2 lines>... > callback=callback, > ^^^^^^^^^^^^^^^^^^ > ) > ^ > File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 412, in start_openvpn_connection > new_con = self.import_ovpn(ovpn) > File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 366, in import_ovpn > connection = self.ovpn_import(target) > File "/app/lib/python3.13/site-packages/eduvpn/nm.py", line 351, in ovpn_import > raise Exception(f"Expected one openvpn VPN plugins, got: {len(vpn_infos)}") > Exception: Expected one openvpn VPN plugins, got: 0 > ``` This seems like it cannot find the NetworkManager-openvpn plugin. Maybe the flatpak needs that as a dependency?

WebSpider commented 2026年03月11日 14:20:44 +01:00

Yeah, I added that, but maybe the paths are wrong. Thanks for the suggestion, i'll keep you posted.

Yeah, I added that, but maybe the paths are wrong. Thanks for the suggestion, i'll keep you posted.

WebSpider commented 2026年03月12日 09:29:40 +01:00

OK, I think I found the problem.

While calling NM.VpnPluginInfo.list_load() in nm.py from the sandbox, the polkit rules that allow elevation of privileges do not seem to apply. The call results in a permission denied. A simulation from within the sandbox:

[📦 org.eduvpn.www ~]$ gdbus call \
 --system \
 --dest org.freedesktop.NetworkManager \
 --object-path /org/freedesktop/NetworkManager/VpnManager \
 --method org.freedesktop.NetworkManager.VpnManager.GetVpnPlugins
Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Sender is not authorized to send message

There seem to be two ways to correct this:

1. Let flatpak break out of the sandbox specifying a command to run using flatpak-spawn
2. Let the flatpak drop user-scoped polkit config files to allow the sandbox to run the command

but actually I am hoping for a third option, that allows the flatpak to specify it should be exempted under existing polkit rules.

Or maybe as a 4th option patch the client to just assume the plugin is present or in general behave more like eovpn does in https://github.com/jkotra/eOVPN/blob/master/eovpn/connection_manager.py

OK, I think I found the problem. While calling `NM.VpnPluginInfo.list_load()` in `nm.py` from the sandbox, the polkit rules that allow elevation of privileges do not seem to apply. The call results in a permission denied. A simulation from within the sandbox: ``` [📦 org.eduvpn.www ~]$ gdbus call \ --system \ --dest org.freedesktop.NetworkManager \ --object-path /org/freedesktop/NetworkManager/VpnManager \ --method org.freedesktop.NetworkManager.VpnManager.GetVpnPlugins Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Sender is not authorized to send message ``` There seem to be two ways to correct this: 1) Let flatpak break out of the sandbox specifying a command to run using `flatpak-spawn` 2) Let the flatpak drop user-scoped polkit config files to allow the sandbox to run the command but actually I am hoping for a third option, that allows the flatpak to specify it should be exempted under existing polkit rules. Or maybe as a 4th option patch the client to just assume the plugin is present or in general behave more like eovpn does in https://github.com/jkotra/eOVPN/blob/master/eovpn/connection_manager.py

stephanlachnit commented 2026年03月27日 11:03:49 +01:00

@WebSpider can you post the final flatpak configuration that you used here? I would be interested in trying this as well.

@WebSpider can you post the final flatpak configuration that you used here? I would be interested in trying this as well.

mitiemann commented 2026年04月17日 15:03:00 +02:00

Hi,

I'm also interested in a Flatpak for Bluefin. I can try to contribute to this as well. Should we try to add this logic to this repo or should we start a eduvpn-flatpak repo for this purpose?

Hi, I'm also interested in a Flatpak for Bluefin. I can try to contribute to this as well. Should we try to add this logic to this repo or should we start a eduvpn-flatpak repo for this purpose?

WebSpider commented 2026年05月08日 14:40:56 +02:00

I have a flatpak working, that you can install as a user. More details here: #693 (comment)

Cleanup is needed, it's a mess at the moment, but I will setup an eduvpn-flatpak repo on my account on codeberg for this while we discuss how to move this further.

I will be at the EduVPN BoF at TNC26.

I have a flatpak working, that you can install as a user. More details here: https://codeberg.org/eduVPN/linux-app/issues/693#issuecomment-14495400 Cleanup is needed, it's a mess at the moment, but I will setup an eduvpn-flatpak repo on my account on codeberg for this while we discuss how to move this further. I will be at the EduVPN BoF at TNC26.