If you run your scripts through https://shellcheck.net it’ll pick up things like this. Also available as a Linux package for offline use.

What have you found bad about bash arrays? I have some simple usage of those (in bash) and they work fine.

No worries! I hope this helps you enjoy Flatpak :)

You added the Flatpak repo as a “system” repo with:

flatpak remote-add flathub https://dl.flathub.org/repo/flathub.flatpakrepo

As such, the downloaded applications are stored by the system in /var like you said.

If you run installs as user installs, eg:

flatpak --user install com.example.appname

Then the application is stored in your home directory, not in /var.

You can also add the Flatpak repo as a “user” repo, eg:

flatpak --user remote-add flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Now all installs will behave as if you passed --user to the install command. All installs will go to your home directory, none will go to /var

The installer lets you do a custom partition layout.

It’s fine. I give my systems a 20G or 30G root file system.

If you use Flatpak then make sure you do user installs. If you add the remote as a user remote then all installs are user installs.

If you use VMs then create a storage pool for the disks in your home filesystem. I create a /home/libvirt/ for this.

Basically just be mindful not to fill your root filesystem.

I love XFCE but I use MATE’s Caja file manager on mine.

aiui apt will compare downloads from repositories against the repository signing key, whereas downloading a deb and installing it manually with dpkg bypasses that.

So theoretically the Debian website could get compromised and provide you a malicious deb package. That has happened to other Linux distros before so it’s not entirely unrealistic.

Practically I think that’s very unlikely.

I know apt has the --download option if you’d like to fetch deb packages on the commandline, though I’m not sure if apt compares the package with the key during this process. I hope it does. You could probably run apt in verbose mode and hopefully see this happen.

Some references:

• https://askubuntu.com/questions/131397/what-is-a-repository-key-under-ubuntu-and-how-do-they-work
• https://wiki.debian.org/SecureApt