Well I think you have to distinguish between a messenger and other programms, because a messenger has a lot of sensitive data.

Just because something is built out of love does not make it safe, and attestation is about safety. You wouldn't trust an un-attested surgical device, just because there's a really positive community around its design.

Signal is a life-or-death app for some people.

What warnings?

I just read through the unofficial Flathub Flatpak for Signal and it is very simple. It fetches the .deb from Signal's website, installs it in the sandbox, and uses a launcher script to tell the OS some basic toggles like should it start minimized or should it display a tray icon. In the script it makes use of zypak, which to my understanding is to tell electron (chromium) to allow sandboxing to be handled by Flatpak. Here is the repo and the build instructions is the .yaml file.

Flatpaks are pretty easy to read through. Just go to the links section of Flathub and click the manifest, then read it to see what is done during building.

All of these packaging systems have plenty of tutorials. Speaking from experience, many maintainers were not developers when they started maintaining packages for distros other than the official distros. I have worked with several maintainers who do work in tech and know socially several who had no background. This could be a great place for you to start!

You bother because FOSS is as much paying it forward as it is getting shit for free.

They can't possibly provide a package for every distro.

Signal's model, ie keep tight control over development and distribution of the client, and the absence of federation, it well suited for Apple/Google's stores, but not at all for open-source and Linux' ecosystem.

Building from source is the opposite of hacky. It's the recommended way to deal with things like this where you are concerned about trust and security. I understand that it's not something you've done before, but it not as complicated as it sounds. There are many tutorials on how to build programs from source.

I understand that providing official packages for fedora/rhel, Ubuntu/debian, and arch-based distro packages along with a flatpack and Appimage would make a lot of sense, but for whatever reason, signal has decided not to. Perhaps you can message the signal team to ask why they choose not to do this.

It's an old program that converts between .deb (Debian), .rpm (RedHat), .tgz (Slackware), .slp (Stampede), .pkg (Solaris), and LSB packages.

I don't use it much, but it can be handy in a pinch for installing software that isn't packaged for your distribution. Just don't use it for anything low-level or that's already packaged natively, or you'll break stuff.

Its not official, but you can read the manifest to see what is done during building.

Yeah, I think it's that one. Does Discover pull it's content from flathub.org?

It says "by Signal Foundation" on it and 900,000 people have installed it so it seems good enough to me.

Ah, I'm wrong. Actually, that's a good thing.

TIL - and thank you.

true, then just use the flatpak version

What percentage of Signal users is "grandma" that uses Linux and would be messaging from her PC? I would have to imagine the overwhelming vast majority of Signal users are on mobile only, so packaging for specific distros is probably far down the priority list.