Look up duplicate matches in a hash table instead of scanning the result
list for every component. Key entries by kind, ID and branch, ignoring
architecture as before.
Collect matches before sorting them for output. Record discovery order
to keep newer matches first when scores are equal. Preserve first-match
data and the remote list.
In a warm-cache synthetic test with 8,000 matches, search took 184 ms
instead of 1.87 s.
AppStream data is stored per architecture, but `flatpak remote-ls`
always loaded it for the host architecture by passing NULL to
update_appstream() and flatpak_dir_load_appstream_data(). As a result,
columns sourced from AppStream (name, description, version) were empty
when listing a foreign architecture with --arch.
Pass the architecture provided with --arch through instead. "--arch=*"
still falls back to the host architecture, as before.
Closes: https://github.com/flatpak/flatpak/issues/3805
Name and description can shrink in narrow terminals, but the
application ID is usually what users need to copy for install/run.
Prefer showing the full ID in list, search and remote-ls; other
columns still ellipsize when space is tight.
Closes: #4719
Users who enabled a named subset (for example verified-only) had no
documented way to undo it. --subset= with an empty value clears the
filter; mention that in flatpak-remote-modify(1).
Closes: #5637
flatpak list already supports filtering by application vs runtime,
but search always mixed both. Add matching flags so users can e.g.
search for games without runtime noise, or list GNOME runtimes.
Closes: #6718
The override man page mentioned global vs per-application files but did
not say how the system and user layers combine, whether system-wide
overrides affect apps from a per-user installation, or how conflicting
settings such as share/unshare resolve.
Describe the storage layout and the command-line selection of the
target file separately, document the merge order implemented by the
deployment code, and note that system-wide overrides only apply to
applications in a system-wide installation.
Closes: #6478
gtk-doc cross-references to GLib/GIO types have been broken since GLib
migrated to gi-docgen and stopped shipping devhelp index files.
Replace gtk-doc with gi-docgen, which generates docs from GIR data and
resolves cross-references via a URL map. Rename the build option from
'gtkdoc' to 'api_docs' and update CI workflows accordingly.
Fix XML parse error caused by unescaped <path> in
flatpak_transaction_add_sideload_image_collection doc comment.
Add missing public API symbols to flatpak-sections.txt and remove
private flatpak_related_ref_new. Add ignore lists for private headers
and source files to prevent gtkdoc-mkdb from scanning them.
AppStream summaries are allowed to contain embedded newlines and tabs,
which break the fixed-width table layout used by `flatpak search`.
Replace embedded newlines and tabs with spaces before adding the summary
as a table column.
Fixes: https://github.com/flatpak/flatpak/issues/6132
GIO only sets standard::symlink-target on the GFileInfo when the queried
path actually is a symlink. Several helpers blindly queried "active" /
"current" with AT_SYMLINK_NOFOLLOW and then called
g_file_info_get_symlink_target(), which emits
GLib-GIO-CRITICAL: GFileInfo created without standard::symlink-target
whenever the entry exists but is not a symlink. This is reproducible
with `flatpak --system remote-ls --updates`, which probes every
deployed ref.
Check g_file_info_get_is_symlink() before reading the target, keeping
the existing "not deployed" result while avoiding the spurious
criticals.
Fixes: https://github.com/flatpak/flatpak/issues/6766
Fixes: https://github.com/flatpak/flatpak/issues/6413
Electron apps often spawn two instances; pick the main one.
Updates: #5923
Assisted-by: Trae:DeepSeek-V4-Pro
Signed-off-by: Shengjing Zhu <zhsj@debian.org>
Curl's partial-file, empty-reply and send/receive errors were mapped to
G_IO_ERROR_FAILED, so the existing transient-error retry policy skipped
connection losses. Map them to partial-input and connection-closed errors
without changing the retry limit or retrying streams already written to.
Test recovery from empty and truncated replies, including compressed
cache output, and verify no partial contents survive the retry.
When ~/.local/share/fonts existed, Flatpak only bind-mounted that
directory into the sandbox and ignored ~/.fonts. Users who still have
fonts under the legacy path (common after desktop environments changed
the default install location) therefore lost those fonts in Flatpak
apps.
Mount both directories when present: keep XDG fonts at
/run/host/user-fonts, and expose ~/.fonts at /run/host/user-fonts-legacy
with a matching fontconfig remap. If only ~/.fonts exists, keep the
historical /run/host/user-fonts destination.
Closes: #6869
In commit 21f413f1, flatpak_instance_new was changed to require the pid
file to be written in order to succeed. This causes problems when
calling Spawn with NOTIFY_START, however, because portal expects to be
able to call flatpak_instance_new once the instance ID is retrieved. As
per the comments in the code that writes said instance ID, the idea was
that the instance would be *usable* at the point where the write takes
place (hence it being positioned *after* saving `bwrapinfo.json`), so it
makes sense to now move the write to *after* after the pid file is
written.
Since the pid file write and the instance ID write now go hand-in-hand,
both actions now take place in a separate function, so the logic can be
in one place. Additionally, the write itself is migrated to
`glnx_loop_write`, to shorten the code.
Assisted-by: DeepSeek-V4.1-Flash
Including CMD_PREFIX here causes problems for any subcommand that reads
`$FLATPAK` to find the binary path, since then it's no longer actually a
binary path. Instead, we can use a wrapper script, which will then run
flatpak w/ the prefix itself.
Flatpak's progress percentage is a heuristic that includes metadata
discovery and write phases. Using it as a time base can produce
misleading remaining times or reach 00:00 while downloads are still
active.
Track the computed transfer total in FlatpakProgress. Use the remaining
bytes and measured transfer rate to calculate the CLI ETA.
COSMIC applets use these keys, and they are harmless.
X-CosmicApplet marks them as an applet for the settings app and the
panel.
X-CosmicHoverPopup marks an applet that it wants a popup on hover if a
popup is open already in another applet.
X-CosmicOverflowPriority marks the priority of an applet for overflow
behavior in the panel.
X-CosmicOverflowMinSize marks the min size of the shrinkable applet in
applet size units.
X-CosmicShrinkable marks a window as having padding that can be
shrinkable in the panel so that it takes up less space.
OCI remote checksums identify images rather than imported OSTree commits.
Compare against the deployed alternative ID as well, matching the update
transaction's identity check and avoiding false pending updates.
Test OCI update listings after install, after publishing a real update,
and after applying it, using the existing user/system HTTP/HTTPS tests.
Uncrustify renamed align_number_left to align_number_right in
https://github.com/uncrustify/uncrustify/pull/1393.
Remove sp_balance_nested_parens, which Uncrustify reports as replaced by
sp_paren_paren.
gpgme_ctx_t was not wrapped with g_auto(), so gpgme_new() allocated
contexts were never released by gpgme_release() on any return path.
All other GPGME types in the same function already use g_auto().
Github's ubuntu-latest is currently 24.04, and the bubblewrap in
Ubuntu 24.04 doesn't have everything that we need.
Signed-off-by: Simon McVittie <smcv@collabora.com>
flatpak_allocate_tmpdir created child repo directories (repo- and
child-oci-) with mode 0777, allowing any local user to modify their
contents between the client pull and the system helper deploy.
Use 0755 instead, which prevents other users from writing while
still allowing the revokefs-fuse frontend to read the backing store
directly. The frontend runs as the calling user while the writer
backend runs as the flatpak system user, so the frontend needs
read access to directories created by the backend. Mode 0700 would
break this.
Resolves: CVE-2026-97026
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8
The .token file was written into the child-oci directory so the
system helper could read it back for remote registry verification.
However, the system helper only ever opens the child-oci registry
as a local source (dfd != -1), and every code path that uses
self->token for HTTP requests is gated behind dfd == -1. The token
was never reachable since it was introduced in commit 5d8fd2d1b.
Persisting credentials to a world-traversable directory in /var/tmp
is a security risk on multi-user systems. Remove the file write
from set_token and the file read from ensure_local. The token
remains available in memory for the client process that actually
needs it for remote access.
Resolves: CVE-2026-97025
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4
The runtime files directory was opened with open() using O_PATH but
without symlink protection, unlike the app files path which used
O_NOFOLLOW. Since "files" is validated as a non-symlink during deploy,
this is not exploitable through normal install flow. However, the open
should still use safe fd-relative operations as defense-in-depth.
Use flatpak_deploy_get_files_fd which validates the path with
glnx_chaseat(GLNX_CHASE_RESOLVE_NO_SYMLINKS), rejecting any symlink
at the directory boundary.
Hardening related to CVE-2026-97023, CVE-2026-97024
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
dir_is_locked() used g_file_resolve_relative_path to construct the
path to files/.ref, then open() without O_NOFOLLOW. Since "files" is
validated as a non-symlink during deploy and ".ref" is atomically
created as a regular file, this is not exploitable through normal
install flow. However, the function should still use safe fd-relative
operations as defense-in-depth.
Rename dir_is_locked to deploy_dir_is_locked to reflect that it
operates specifically on deploy directories, not arbitrary ones.
Hardening related to CVE-2026-97023, CVE-2026-97024
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
The runtime deploy path used GFile operations to manipulate files
inside files/etc (passwd, group, machine-id, resolv.conf). While
the "files" directory is validated with glnx_chaseat using
GLNX_CHASE_RESOLVE_NO_SYMLINKS, "etc" inside it is not checked.
A malicious runtime with files/etc as a symlink causes the GFile
operations (g_file_delete, g_file_replace_contents,
g_file_make_symbolic_link) to follow it and modify files at the
symlink target. On system installs (running as root), this modifies
arbitrary files — e.g. replacing /etc/resolv.conf.
This commit uses fd-based operations to prevent to prevent the symlink
attack.
Resolves: CVE-2026-97024
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
The export directory cleanup during deploy used flatpak_rm_rf which
wraps glnx_shutil_rm_rf_at(AT_FDCWD, path). The kernel resolves
intermediate symlinks in the path, so a malicious ostree commit with
"export" as a symlink causes flatpak_rm_rf(export/bin) to delete files
at the symlink target. On system installs (running as root), this is
arbitrary file deletion.
This commit uses fd-based operations to prevent to prevent the symlink
attack.
Resolves: CVE-2026-97023
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Razze