Curl's partial-file, empty-reply and send/receive errors were mapped to
G_IO_ERROR_FAILED, so the existing transient-error retry policy skipped
connection losses. Map them to partial-input and connection-closed errors
without changing the retry limit or retrying streams already written to.
Test recovery from empty and truncated replies, including compressed
cache output, and verify no partial contents survive the retry.
When ~/.local/share/fonts existed, Flatpak only bind-mounted that
directory into the sandbox and ignored ~/.fonts. Users who still have
fonts under the legacy path (common after desktop environments changed
the default install location) therefore lost those fonts in Flatpak
apps.
Mount both directories when present: keep XDG fonts at
/run/host/user-fonts, and expose ~/.fonts at /run/host/user-fonts-legacy
with a matching fontconfig remap. If only ~/.fonts exists, keep the
historical /run/host/user-fonts destination.
Closes: #6869
In commit 21f413f1, flatpak_instance_new was changed to require the pid
file to be written in order to succeed. This causes problems when
calling Spawn with NOTIFY_START, however, because portal expects to be
able to call flatpak_instance_new once the instance ID is retrieved. As
per the comments in the code that writes said instance ID, the idea was
that the instance would be *usable* at the point where the write takes
place (hence it being positioned *after* saving `bwrapinfo.json`), so it
makes sense to now move the write to *after* after the pid file is
written.
Since the pid file write and the instance ID write now go hand-in-hand,
both actions now take place in a separate function, so the logic can be
in one place. Additionally, the write itself is migrated to
`glnx_loop_write`, to shorten the code.
Assisted-by: DeepSeek-V4.1-Flash
Including CMD_PREFIX here causes problems for any subcommand that reads
`$FLATPAK` to find the binary path, since then it's no longer actually a
binary path. Instead, we can use a wrapper script, which will then run
flatpak w/ the prefix itself.
Flatpak's progress percentage is a heuristic that includes metadata
discovery and write phases. Using it as a time base can produce
misleading remaining times or reach 00:00 while downloads are still
active.
Track the computed transfer total in FlatpakProgress. Use the remaining
bytes and measured transfer rate to calculate the CLI ETA.
OCI remote checksums identify images rather than imported OSTree commits.
Compare against the deployed alternative ID as well, matching the update
transaction's identity check and avoiding false pending updates.
Test OCI update listings after install, after publishing a real update,
and after applying it, using the existing user/system HTTP/HTTPS tests.
Exercise existing files, directories and nonexistent files against a real
document portal on the private test bus. Verify that --noexist returns a
usable export after the origin is created and preserves its read grant.
The regression fails on the AddNamed reply type mismatch without the fix.
All four checks pass with it.
The document portal is mounted at /run/flatpak/doc inside the sandbox,
but forwarded arguments used its host mount path. With a nonstandard
host runtime directory, that path is inaccessible to the application.
Keep the host path local to mount setup and return the sandbox destination
to argument forwarding. Preserve NULL when the portal is unavailable.
Add real-portal regression tests for user and isolated system installs.
Check file read/write, escaped URIs, directories and passthrough controls.
Skip the directory subtest on portal interfaces older than version 4.
Applications using libflatpak currently have to duplicate the CLI's
private cleanup logic to offer the equivalent of uninstall --delete-data.
Add a standalone API that removes ~/.var/app data and resets permission
store entries without requiring the app to be installed. Keep it separate
from transactions so callers can retry partial failures or reset data for
an installed app.
Validate app IDs before constructing paths, propagate cancellation and
permission table errors, and document partial failure behavior.
Parse the cursor as a long before narrowing it to the completion
structure's integer field. This lets malformed, negative, and overflowing
positions fail before they can index outside the command-line buffer, while
preserving the existing behavior of clamping positive positions beyond the
line length.
g_format_size() output is unit-suffixed and locale-dependent, which
makes it awkward to sort or parse in scripts.
-b/--bytes prints a plain byte count; human-readable remains the
default. Also update the man page, the completion test and the tests.
flatpak_context_to_args() built the D-Bus name options from
flatpak_policy_to_string(). That function gives the values used in the
[Session Bus Policy] and [System Bus Policy] metadata groups. Two of
them, "none" and "see", are not command-line options. A context that
contained such a policy gave --none-name= and --system-none-name=.
flatpak-run(1) writes these arguments to the [Instance] extra-args of
/.flatpak-info. flatpak-portal gives them back to flatpak(1) when a
sandboxed app calls flatpak-spawn(1). flatpak(1) then rejected the whole
command line with "Unknown option --none-name=...", so --no-talk-name
and --system-no-talk-name broke flatpak-spawn(1).
Map each policy to the option that sets it: --no-talk-name for
FLATPAK_POLICY_NONE, --talk-name for FLATPAK_POLICY_TALK, and --own-name
for FLATPAK_POLICY_OWN. FLATPAK_POLICY_SEE has no command-line option,
so emit nothing for it. It cannot occur here: the only caller serializes
a context that comes from the command line.
A decimal-aligned cell padded itself to widths[j], the natural column
width, while the title row and left-aligned cells padded themselves to
len, the width after expansion and ellipsization. In a table with an
expanding decimal column the title row and the cells therefore ended at
different offsets, and every column after the decimal one lost its
alignment. A cell with no decimal point in it used the left-aligned path,
so it stayed with the title row while its neighbours in the same column
moved.
The natural width of a decimal column is also not the width of its widest
cell: the cells split at the decimal point, so the column needs
lwidths[i] characters before the point and rwidths[i] after it. Take that
into account, so the trailing padding can no longer go negative and push
the rest of the row to the right.
Now that our error messages are valid UTF-8, we should no longer need to
do this.
This reverts commit 242e9893e7.
Signed-off-by: Simon McVittie <smcv@collabora.com>
While I'm changing the translatable string anyway, this also
incorporates a suggestion from #6753 to quote the invalid character, so
that output is clearer in the case where the invalid character is
whitespace.
Thanks: Christian Stadelmann
Signed-off-by: Simon McVittie <smcv@collabora.com>
Until now we have been using `%c` to show invalid characters, but in
general that will corrupt our output if the input is non-ASCII,
because the individual bytes of a UTF-8 string are not valid UTF-8 alone.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Instead of announcing ahead of time how many tests will be run, just
log 1..32 or similar at the end, from the done_testing function.
This should go some way towards preventing unnecessary cherry-pick
conflicts when tests added to this script get backported.
Resolves: https://github.com/flatpak/flatpak/issues/6793
Signed-off-by: Simon McVittie <smcv@collabora.com>
This is the equivalent of the function of the same name in Perl's
Test::More. If we already emitted a test plan, it asserts that the
number of tests we planned to do equals the number we actually did.
If not, it assumes that however many tests we have done, that's all of
the tests that we intend to do - this can be useful in test scripts
that routinely increase in length, like test-run.sh which is becoming
rather long (and has frequent conflicts for the "plan" line when we
cherry-pick new test coverage to older branches).
Signed-off-by: Simon McVittie <smcv@collabora.com>
This is approximately the equivalent of 'plan' in Perl Test::More:
it announces how many tests we plan to run.
Signed-off-by: Simon McVittie <smcv@collabora.com>
This will help us to emit correct TAP syntax, without having to always
declare up-front how many tests we are going to run.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Older versions of Meson parsed TAP output very strictly, and would fail
the test when a `g_test_message()` mentions non-UTF-8, which results
in GLib adding a prefix on stdout that is not valid TAP syntax.
Ideally our error messages should all be valid UTF-8 even if the input
is not, but that's a larger refactor that shouldn't block security fix
releases, so for now just tell Meson to get the tests' pass/fail status
from their exit status rather than parsing their stdout.
Signed-off-by: Simon McVittie <smcv@collabora.com>
The original reporter used various tricks to find a way for the sandboxed
app to overwrite these locations with symlinks, but for the purposes
of this test, I'm doing the setup outside the sandbox instead: probably
not all of these potential exploit routes are actually possible, but we
defend against all of them symmetrically.
Signed-off-by: Simon McVittie <smcv@collabora.com>
This use of symlinks to ensure that the canonicalized paths of
`$XDG_CACHE_HOME`, `$XDG_CONFIG_HOME`, `$XDG_DATA_HOME` are
`~/.cache`, `~/.config`, `~/.local/share` is the sort of thing that
could easily regress if not tested.
Signed-off-by: Simon McVittie <smcv@collabora.com>
The --assumeyes (-y) option was setting both the CLI-level
disable_interaction flag and the library-level no_interaction flag to
TRUE. This caused -y to suppress not just confirmation prompts, but
also credential prompts (basic auth, webflow), polkit authorization
dialogs, and parental control consent -- even though -y is documented
as "automatically answer yes to all questions".
Rename disable_interaction to assume_yes to clarify its purpose: it
auto-answers yes/no confirmations and picks default choices. Stop
calling flatpak_transaction_set_no_interaction() from the CLI
transaction constructor, so the library-level no_interaction flag is
only set by --noninteractive (which uses FlatpakQuietTransaction).
Remove the assume_yes guard from basic_auth_start so credential
prompts are always shown when the CLI transaction is in use.
Assisted-by: Cursor
If flatpak is built with code coverage enabled, libgcov sometimes
helpfully emits messages in the output from programs under test.
If we’re strictly comparing the whole output of a program to an expected
string, as `test-history.sh` does in these two places, this can cause
spurious test failures.
Temporarily tell it to send its error messages to `/dev/null` as we
don’t care about them for those tests.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
If we created an instance and we failed to get the PID of the instance,
we would still succeed. If one later calls flatpak_instance_is_running
or uses the result of flatpak_instance_get_pid with kill, it's possible
to terminate the entire process group (kill 0).
Let's just error out as early as possible to avoid those weird
half-initialized cases.
That unfortunately means we have to adjust a bunch of callers as well,
but fortunately, this only affects internal API.
During a system install with the system helper enabled, the initial
network pull goes to a temporary repo and then via pull local from that
repo to the final system repo while during user install there is only
one pull from network to the final repo.
c672c55 set the logger to use the temporary repo path as installation
but the history command afc87ad since the same day filters the initial
pull out as the installation name will never match the temporary path.
This causes the initial pull operation to be never show up in flatpak
history when using system installs while they work for user installs as
`INSTALLATION=user`.
This is presumably also broken for custom installations as they
will similarly not match the temp repo path.
So don't pass the path at all to flatpak_dir_log and we can later
fall back via flatpak_dir_get_name_cached() which sets the correct
`INSTALLATION` for system installs ie. `INSTALLATION=system`.
This also allows us to remove the workaround of adding two different
expected history outputs from ad1ff6d as both branches log the pull.
Without system helper `flatpak install` needs to be executed as
priviledged to operate on system install so the initial pull was
always logged correctly for that branch.
Add a regression test that installs from an auth-protected OCI registry.
The registry requires a bearer token for all /v2/ requests; the client
authenticates via the mock test authenticator and the installation
completes successfully. The test runs for both user and system install
paths.
Assisted-by: Cursor
Add infrastructure for testing OCI installations from auth-protected
registries. The mock server now supports requiring a bearer token on all
/v2/ requests, configurable via a new POST /testing-auth/configure admin
endpoint. The client gains a corresponding 'configure-auth' subcommand.
Assisted-by: Cursor
The warning seems to happen with GCC 11 but not with GCC 13 or newer.
A simple void cast still leaves the warning enabled due to a bug
or intentional choice in GCC [1], so it is assigned to a variable first
and then void-ed.
[1]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425
If we convert fallback-x11 internally to a conditional x11 permission,
we cannot express current fallback-x11 stacking behavior:
lower: empty + upper: !fallback-x11 -> no x11 access
lower: fallback-x11 + upper: !fallback-x11 -> x11 access
The reason is that conditionals have no view of the lower level.
This changes things in a way that fallback-x11 stays its own socket
permission with two interactions with the x11 socket permission:
* If a upper level resets x11 (--socket=x11, --nosocket=x11), the lower
level fallback-x11 permission gets dropped
* When computing the allowed sockets, --socket=fallback-x11 gets
converted to --socket=if:x11:!has-wayland
Fixes: #6556
Instead of trying to read them into variables, which could fail if there
were null bytes in the key.
Fixes: 43642337 ("dir: Try to delete the remote if we failed to add it entirely")
I was convinced that the pattern `! command` with -e aborts when
`command` fails. This is not the case (the result of `false` is the same
as `! true` but somehow this doesn't matter).
Fix the tests and use the newly introduced `assert_not` function. One
could also use `command && assert_not_reached "message"` but who has
time to write error messages for all the cases.
Razze