DietPi app store i made

General Discussion
1

If you want to request an app just send it on here

2

Where can we see that “app store”?

3

Hi @Greenisus1,

thanks for sharing your project. You also opened a pull request on GitHub to add the store to DietPi, so we had a close look at it and at the Pi App Store from a security point of view. The detailed feedback with code references is in the PR: App store for Dietpi by Greenisus1 · Pull Request #8355 · MichaIng/DietPi · GitHub

A short summary of our concerns:

  • One account, everything as root: The catalog is every repository of a single GitHub account that contains an app-store.sh marker, currently 47 apps. There is no review, no signing and no second maintainer, and the app installers run as root.
  • Self-updates from main: On every start the store checks the main branch, which keeps changing, and replaces itself with what it finds there. Current versions do this without asking. They can also do it on every boot through a root service, with no hash or signature check. Whoever controls the repository controls the systems that run the store.
  • No confirmation before install: Current versions run app installers as root without asking. Older versions only show a small dispatcher script, not the code that actually runs.
  • App quality: At least one app in the catalog has a self-update routine that lets any local user gain root when the app is started through the store.
  • Footprint on the system: The installer creates 256 upper/lower case variants of appstore in /usr/local/bin.
  • No license: The repository has no license file, so legally it isn’t open source.

We’re not assuming bad intent, and it’s clearly a lot of work. But until these points are fixed, we advise against installing the store on DietPi systems.

If there’s a specific, well-maintained application you’d like to see in DietPi, feel free to post a request here in the forum. Software in DietPi is curated through dietpi-software so that it can be reviewed and maintained properly.

4

I am working on fixing the security issues i had and will fix them asap. i need apps to install though. does anybody have any apps that i should add in the next update?

5

So it’s basically kind of dietpi-software but written in python. What benefits has it compared to dietpi-software?

6

In agreement with @MichaIng , we will not integrate the store

7

Thanks for asking. Mine is mainly a fullscreen terminal menu for browsing, installing and launching my small apps and games, including over SSH without a desktop. It isn’t meant to replace dietpi-software, which handles a much broader range of software and its DietPi setup and optimizations.

I understand the decision not to include it in DietPi. I’ll keep it separate as an optional project people can choose to use themselves, and keep working on its safety and Linux CLI support.