Look up duplicate matches in a hash table instead of scanning the result
list for every component. Key entries by kind, ID and branch, ignoring
architecture as before.
Collect matches before sorting them for output. Record discovery order
to keep newer matches first when scores are equal. Preserve first-match
data and the remote list.
In a warm-cache synthetic test with 8,000 matches, search took 184 ms
instead of 1.87 s.
AppStream data is stored per architecture, but `flatpak remote-ls`
always loaded it for the host architecture by passing NULL to
update_appstream() and flatpak_dir_load_appstream_data(). As a result,
columns sourced from AppStream (name, description, version) were empty
when listing a foreign architecture with --arch.
Pass the architecture provided with --arch through instead. "--arch=*"
still falls back to the host architecture, as before.
Closes: https://github.com/flatpak/flatpak/issues/3805
Name and description can shrink in narrow terminals, but the
application ID is usually what users need to copy for install/run.
Prefer showing the full ID in list, search and remote-ls; other
columns still ellipsize when space is tight.
Closes: #4719
flatpak list already supports filtering by application vs runtime,
but search always mixed both. Add matching flags so users can e.g.
search for games without runtime noise, or list GNOME runtimes.
Closes: #6718
AppStream summaries are allowed to contain embedded newlines and tabs,
which break the fixed-width table layout used by `flatpak search`.
Replace embedded newlines and tabs with spaces before adding the summary
as a table column.
Fixes: https://github.com/flatpak/flatpak/issues/6132
Electron apps often spawn two instances; pick the main one.
Updates: #5923
Assisted-by: Trae:DeepSeek-V4-Pro
Signed-off-by: Shengjing Zhu <zhsj@debian.org>
In commit 21f413f1, flatpak_instance_new was changed to require the pid
file to be written in order to succeed. This causes problems when
calling Spawn with NOTIFY_START, however, because portal expects to be
able to call flatpak_instance_new once the instance ID is retrieved. As
per the comments in the code that writes said instance ID, the idea was
that the instance would be *usable* at the point where the write takes
place (hence it being positioned *after* saving `bwrapinfo.json`), so it
makes sense to now move the write to *after* after the pid file is
written.
Since the pid file write and the instance ID write now go hand-in-hand,
both actions now take place in a separate function, so the logic can be
in one place. Additionally, the write itself is migrated to
`glnx_loop_write`, to shorten the code.
Assisted-by: DeepSeek-V4.1-Flash
Flatpak's progress percentage is a heuristic that includes metadata
discovery and write phases. Using it as a time base can produce
misleading remaining times or reach 00:00 while downloads are still
active.
Track the computed transfer total in FlatpakProgress. Use the remaining
bytes and measured transfer rate to calculate the CLI ETA.
OCI remote checksums identify images rather than imported OSTree commits.
Compare against the deployed alternative ID as well, matching the update
transaction's identity check and avoiding false pending updates.
Test OCI update listings after install, after publishing a real update,
and after applying it, using the existing user/system HTTP/HTTPS tests.
With --noexist, the opened file descriptor refers to the parent directory.
The request correctly uses AddNamed, but is_directory makes the reply
parser expect AddFull's array reply instead of AddNamed's single string.
This produces a GVariant type mismatch and crashes the command.
Only select the AddFull reply parser for directory exports without
--noexist, matching the method used for the request.
Applications using libflatpak currently have to duplicate the CLI's
private cleanup logic to offer the equivalent of uninstall --delete-data.
Add a standalone API that removes ~/.var/app data and resets permission
store entries without requiring the app to be installed. Keep it separate
from transactions so callers can retry partial failures or reset data for
an installed app.
Validate app IDs before constructing paths, propagate cancellation and
permission table errors, and document partial failure behavior.
Permission table discovery reads the on-disk database directory and does
not use the D-Bus permission store proxy. Remove the unused argument and
update callers.
Libflatpak needs to reuse user-data deletion and permission reset logic
that was previously private to the command-line builtins. This will let
software stores offer the equivalent of uninstall --delete-data.
Move each concern into a separate common module without changing behavior
so a public API can be added in a later commit. Name the user-data module
and its helper consistently here, and keep them distinct from the
existing appdata metadata code.
flatpak update --commit and flatpak remote-info read the download size
from xa.download-size in the commit metadata, which only covers the
ostree file objects and not extra-data. The summary cache path used by
a regular flatpak update does add extra-data sizes, so the two differed:
extra-data apps like com.jetbrains.Rider showed 1.3 MB instead of 1.6 GB.
Add flatpak_commit_add_extra_data_sizes() to sum the extra-data sizes
from a commit variant, and use it in resolve_op_from_commit() and
remote-info so they match the summary path. The existing
flatpak_repo_collect_extra_data_sizes() is changed to reuse it.
Fixes: https://github.com/flatpak/flatpak/issues/5947
In flatpak_table_printer_append_cell_with_comma_unique, the duplicate
check only verified the right boundary (match[len] == 0 or comma).
This caused false positives: searching for "all" in "superall" matched
because the character after "all" happened to be a comma, even though
"all" was a substring of "superall", not a separate comma-delimited
entry.
Calculate the position of each match via pointer arithmetic
(match - cell->text) and use cell->text[pos - 1] to check the left
boundary, so that a match is only treated as duplicate when it is at
the start of the cell or preceded by a comma.
flatpak remote-info and remote-ls --updates load version information
from a locally cached AppStream XML file that only gets refreshed during
'flatpak update'. This causes remote-info to show stale version numbers
when a new version has been published.
Fix this by calling update_appstream() before loading cached AppStream
data, unless --cached is specified. Use FLATPAK_APPSTREAM_TTL (1 day)
to avoid re-downloading on every invocation.
Closes: #5974
Signed-off-by: liweinan <liweinan@kylinos.cn>
remote-add registers --no-follow_redirect instead of the documented
--no-follow-redirect. Its reversed flag and both remote-modify redirect
flags set initially false booleans to false, so the policy is not applied.
Correct the option spelling and remove G_OPTION_FLAG_REVERSE so these
switches enable the corresponding configuration updates.
Parse the cursor as a long before narrowing it to the completion
structure's integer field. This lets malformed, negative, and overflowing
positions fail before they can index outside the command-line buffer, while
preserving the existing behavior of clamping positive positions beyond the
line length.
g_format_size() output is unit-suffixed and locale-dependent, which
makes it awkward to sort or parse in scripts.
-b/--bytes prints a plain byte count; human-readable remains the
default. Also update the man page, the completion test and the tests.
A decimal-aligned cell padded itself to widths[j], the natural column
width, while the title row and left-aligned cells padded themselves to
len, the width after expansion and ellipsization. In a table with an
expanding decimal column the title row and the cells therefore ended at
different offsets, and every column after the decimal one lost its
alignment. A cell with no decimal point in it used the left-aligned path,
so it stayed with the title row while its neighbours in the same column
moved.
The natural width of a decimal column is also not the width of its widest
cell: the cells split at the decimal point, so the column needs
lwidths[i] characters before the point and rwidths[i] after it. Take that
into account, so the trailing padding can no longer go negative and push
the rest of the row to the right.
ensure_extensions() used g_file_resolve_relative_path() with
ext->directory, which comes from runtime/SDK metadata and can contain
".." components. This allowed a malicious extension to write outside
the build directory.
Replace the GFile-based path resolution with glnx_chase_and_mkdirat()
using GLNX_CHASE_RESOLVE_BENEATH | GLNX_CHASE_RESOLVE_NO_SYMLINKS,
which rejects any path that escapes the directory fd.
Convert the rest of flatpak_builtin_build_init to fd-relative
operations (mkdirat, symlinkat, glnx_opendirat, glnx_shutil_rm_rf_at,
glnx_file_replace_contents_at, flatpak_cp_a_at) anchored to a
base_dfd opened from the build directory.
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm
The --assumeyes (-y) option was setting both the CLI-level
disable_interaction flag and the library-level no_interaction flag to
TRUE. This caused -y to suppress not just confirmation prompts, but
also credential prompts (basic auth, webflow), polkit authorization
dialogs, and parental control consent -- even though -y is documented
as "automatically answer yes to all questions".
Rename disable_interaction to assume_yes to clarify its purpose: it
auto-answers yes/no confirmations and picks default choices. Stop
calling flatpak_transaction_set_no_interaction() from the CLI
transaction constructor, so the library-level no_interaction flag is
only set by --noninteractive (which uses FlatpakQuietTransaction).
Remove the assume_yes guard from basic_auth_start so credential
prompts are always shown when the CLI transaction is in use.
Assisted-by: Cursor
Copy and paste error which results in the default and explicit usage of
--clear-env to be inverted.
Fixes: f760f1b5 ("run: Add --clear-env option for clearing the outside environment")
As per g_type_ensure's documentation it is technically incorrect to mark
_get_type fns with G_GNUC_CONST since they have side-effects on their
first run.
See https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5223 for more
details.
Both collect exports and flatpak_export_dir recursively export the
directories in their respective directory lists. Because of this,
including share/metainfo/releases when share/metainfo is already in the
lists is unnecessary and can cause exporting to fail because of
duplicate files.
In flatpak_pull_from_oci we can be in in the system helper where we pull
the mirrored OCI image into the system repo. However, to fetch the
signatures in GPG signed repos, we used a remote OciImageSource created
through `flatpak_remote_state_fetch_image_source`. This caused fetching
some data from the registry which we don't want in the deploy method,
and also fails if a token is required to access the repo.
This change fetches the signatures from the mirrored OCI repo instead of
pulling them from the remote OciImageSource. The signatures can come from
anywhere because we verify them against the GPG key in the system repo.
The important bit is the change in `flatpak_pull_from_oci` where we now
pass in the local image_source to fetch the signatures from, and in the
system helper, where we get the right metadata to check the signatures
against (eventually ends up in `flatpak_oci_signatures_verify`).
These fds are stdin, stdout and stderr respectively, and are expected
to remain open at all times (if they are not needed then they can point
to /dev/null, but they should always be open). If the user gives us
`--env-fd=2` or similar, we don't want to close fd 2 before exiting
unsuccessfully: that would give us nowhere to display the error message.
Signed-off-by: Simon McVittie <smcv@collabora.com>
When repair (re)installs runtimes via a transaction, the transaction
auto-pins every runtime it touches. This causes repair --reinstall-all
to pin every installed runtime, cluttering the pin list with runtimes
that were never explicitly pinned by the user and preventing
flatpak remove --unused from cleaning them up.
Fix this by disabling auto-pinning on the repair transaction so that
the pin state is left exactly as it was before the repair.
Fixes https://github.com/flatpak/flatpak/issues/6565
On entry to `flatpak run`, these fds have been inheritable (not
FD_CLOEXEC), otherwise they would not have been inherited; but we don't
want the "payload" command to inherit them, so set them as
non-close-on-exec as soon as we receive them. In the cases where we pass
them down to the underlying bwrap command, we'll either dup them, or
set them to be inheritable again (in practice we dup them).
In particular, Chromium-derived web browsers get very upset when their
subsandbox processes inherit unexpected fds, which has been causing crashes
with no useful diagnostic information since CVE-2026-34078 was fixed.
Fixes: 1b5e886d "run: Add --usr-fd and --app-fd options"
Fixes: b5ae89ed "run: Add --(ro-)bind-fd options"
Resolves: https://github.com/flatpak/flatpak/issues/6582
Signed-off-by: Simon McVittie <smcv@collabora.com>
The flatpak portal allows apps to expose files and folders from within
the sandbox to a side-sandbox using flatpak-spawn. So far it has used
the --filesystem option to mount those files and folders, but it takes a
path. Paths are inherently racy and they allow the app to swap out any
component of the path with a symlink after handing it off. If they win
the race, flatpak will mount a completely different directory.
This adds a new way to mount files and directories based on O_PATH
file descriptor that needs to provided when execing the flatpak binary.
This also allows us to use glnx_chaseat, and other at-functions to
traverse the filesystem tree in a safe way.
This is important because the app and runtime deploy directories can be
under an attackers control. The flatpak portal for example allows
sandboxed apps to provide them.
In particular, attacks where the deploy dirs get replaced by a symlink
pointing into the host system will be stopped by this.
Note that this change alone is not enough to avoid the attack, and the
portal has to be changed as well.
This reverts commit c7824ae5f3.
We want to use the cgroup as authentication for flatpak instances in the
future. Giving explicit control over this to the user destroys the
invariant we need without a backwards incompatible change.
If the user presses any key while we the CLI transaction UI is being
shown, it ends up in stdin. When we issue the Cursor Position command,
the result is appended to stdin and we fail to match on it because of
the proceeding bytes.
Similarily, if we fail to match the command output (bad data, too slow,
..), we leave behind data in stdin which will be echoed back to the
terminal when we restore the initial termios which icnludes ECHO in
c_lflag.
Let's use TCSAFLUSH to flush out stdin data before we issue the command,
which should help with matching the expected response.
Let's also use TCSAFLUSH when we restore the previous termios to make
sure the stdin is clean and we don't echo whatever remains in stdin.
Closes: #2712
The 'arch' parameter of flatpak_dir_remote_fetch_indexed_summary() is
used to construct the names of the caches, and can't be NULL. This
function is used by flatpak_remote_state_ensure_subsummary(), which is
used by ensure_remote_state_arch(). So, the parameter can't be NULL in
those either.
Here are some strings representing valid refs:
app/org.test.App/x86_64/stable - full ref
org.test.App/x86_64/stable - full ref without prefix
org.test.App - only app ID
org.test.App/x86_64 - only app ID and arch
org.test.App//stable - only app ID and branch
Therefore, if a ref's prefix (ie., 'app/' or 'runtime/) is skipped,
then there can only be a maximum of 3 other elements in it.
Right now, it's possible for find_current_element() to return a count
of 4, if the string being completed is invalid and has some extra
elements or slashes in it. This count is later used to index the
cur_parts array which only has 4 elements in it. This opens up the
possibility of a buffer overrun.
Invalid strings with extra elements or slashes can't be further
completed because none of the existing refs will match them.
Therefore, such strings should be outright skipped.
For the rest of the valid strings, the exact intended branch name is
never known, because the branch element doesn't have a trailing slash
and hence appears to be a prefix. Therefore, it's not possible to use
the branch to find a list of existing refs that could possibly
complete the string.
Fallout from 7018717ce2
OpenScanHub [1] triggered this and flagged it as CWE-476 [2]:
app/flatpak-builtins-document-unexport.c:90:7:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘doc_id’
app/flatpak-builtins-document-unexport.c:48:1: enter_function: entry
to ‘flatpak_builtin_document_unexport’
app/flatpak-builtins-document-unexport.c:56:20: release_memory:
‘doc_id’ is NULL
app/flatpak-builtins-document-unexport.c:61:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:66:7: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:66:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:69:6: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:69:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:72:3: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:75:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:78:15: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:82:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:85:7: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:85:6: branch_true: following
‘true’ branch...
app/flatpak-builtins-document-unexport.c:86:14: call_function: inlined
call to ‘g_strdup_inline’ from ‘flatpak_builtin_document_unexport’
app/flatpak-builtins-document-unexport.c:90:7: release_memory:
‘doc_id’ is NULL
app/flatpak-builtins-document-unexport.c:90:7: danger: dereference of
NULL ‘doc_id’
# 88| return FALSE;
# 89|
# 90|-> if (strcmp (doc_id, "") == 0)
# 91| {
# 92| g_print (_("Not exported\n"));
Add an assertion to express that 'doc_id' can't be NULL unless there's a
programmer error.
Spotted by Siteshwar Vashisht.
[1] https://openscanhub.dev/
[2] https://cwe.mitre.org/data/definitions/476.html
Use opt_noninteractive instead of hardcoded values so AppStream
refresh is quiet only when --noninteractive is specified. This allows
to show a better messsage instead of repeating and makes the errors
visible as well.
Related: #5716
Replace the "Nothing to do" message with "Nothing to update." when no
refs have updates available which is slightly clearer.
Fixes: #5716
Co-authored-by: Patrick <github.calorie764@passmail.net>
Co-authored-by: bbhtt <bbhtt.zn0i8@slmail.me>
Since this bug can be reproduced on Ubuntu, Debian, and Fedora, we should set `FLATPAK_FORCE_TEXT_AUTH=1` for all WSL users instead of ignoring its existence. After all, the so-called `graphical prompt` in the flatpak documentation seems to be something unique to GNOME. `WSL_DISTRO_NAME` and `WSL_INTEROP` are both located at https://github.com/microsoft/WSL/blob/master/src/linux/init/util.h .
Razze