This means only refs that are allowed will be visible in the deployed
appstream.
This sometimes means we have to uncompress the xml.gz before rewriting
and then re-compressing that.
As a result of this we now always end up with both the compressed and
the uncompressed xml file, whereas we before didn't get an uncompressed
one if the remote was using the old appstream format.
Closes: #2869
Approved by: alexlarsson
Full names are:
* flatpak_remote_state_lookup_ref()
* flatpak_dir_list_all_remote_refs()
This should be enough to not get any stray refs, because due to the
complexities of p2p all accesses go via FlatpakRemoteState.
The one leftover to non-filtered stuff is the appstream file, a later
commit will handle that.
Closes: #2869
Approved by: alexlarsson
If this is set to a pathname in the configuration of a remote we load
that file and keep track of it as a filter. No filter is actually applied
yet though.
There is two levels of caching, consecutive lookups of the filter
with less than 500msec between use the previous value. Once its more
that that we stat() the file and compare the mtime, reloading the file
if the mtime changes. We also directly reload the file if the pathname
changes.
Closes: #2869
Approved by: alexlarsson
Filters are specified as a list of
op glob
where op can be allow or deny, and the blogs are partial refs
where * means anything in this part of the ref, and non-specified
trailing parts of the ref matches anything.
By default everything is allowed, but if you specify some
deny rules all that they match is denied, except if there is
an specific allow rule.
Internally this takes all the allow and deny globs and convert
them into two combined regular expressions.
Some examples:
* - match anything
app/* - match all apps
runtime/* - match all runtimes
app/*/x86_64 - match all x86-64 apps
app/org.gnome.*/*/stable - match all stable gnome apps
org.gnome.frogr* - match frogr and extensions
This means you can do a both whitelisting:
deny *
allow org.the.good.app*
Or blacklisting:
deny org.the.bad.app*
Closes: #2869
Approved by: alexlarsson
The function was already leaking the result of
extract_unix_path_from_dbus_address() in the case where that call
succeeded. Since commit 0e545799 it would also leak the result of
g_build_filename in the case where it checked $XDG_RUNTIME_DIR/bus.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #2877
Approved by: matthiasclasen
This matches what's now implemented in libdbus, GDBus and sd-bus.
If $DBUS_SESSION_BUS_ADDRESS is unset, check whether $XDG_RUNTIME_DIR/bus
is a socket owned by Flatpak's uid; if it is, use it.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #2874
Approved by: alexlarsson
readlink() and readlinkat() have weird semantics (they return the
number of bytes they would have written if there was enough space,
even if that's larger than the buffer), but glnx_readlinkat_malloc()
takes care to do the right thing in all situations.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #2873
Approved by: matthiasclasen
If the buffer is too small, readlink() returns the number of bytes that
would have been stored if the buffer had been large enough.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #2873
Approved by: matthiasclasen
This is a docker seccomp profile that allows you to run flatpak
inside a docker container, given some special requirements:
* The host kernel must support unprivileged user namespaces
(Supported by e.g. fedora and ubuntu kernels)
* The seccomp profile must be used
(--security-opt seccomp=flatpak-docker-seccomp.json)
* flatpak is run as a reguler user, not root, in the container
* The full host /proc must be visible in the container
(-v=/proc:/host/proc)
The last one is a bit weird, but the regular /proc in docker
is mounted with some cover-over mounts, and this makes the kernel
disallow mounting a new procfs for the pid namespace. Adding
in a full copy of the host fs causes this to be allowed.
Closes: #2867
Approved by: alexlarsson
Any log output interferes with comletion.
We already refrain from installing our verbose
log handlers in this case, but we are still
vulnerable to GLib default message handling,
e.g. via the G_MESSAGES_DEBUG environment
variable. To avoid that, explicitly install
a message handler that suppresses all output.
Closes: https://github.com/flatpak/flatpak/issues/2860Closes: #2862
Approved by: alexlarsson
We now return a NULL error meaning nothing is printed as before
but a FALSE result which means the exist code marks the failure.
Closes: #2858
Approved by: alexlarsson
This is very useful for the CLI where you want to fail the operation and
return a failure exit code, but the user actively chose to do so on
a prompt, so you don't need to print out anything.
Semantics are: if return FALSE => print error if non-null, then exit
with failure code.
Closes: #2858
Approved by: alexlarsson
This mostly worked because QuietTransaction doesn't ask anything, but
some early checks in the commands itself only checked opt_yes.
Closes: #2858
Approved by: alexlarsson
We need to handle operation_error and report errors, and for
fatal errors remember this and report a failure in run(), because
otherwise it returns ABORTED, which is treated as a failure (because
generally that meant the user chose "no" on some question).
Fixes#2839, #2757Closes: #2858
Approved by: alexlarsson
In some OSs, removing a package does not immediately remove its
configuration files in /etc. In particular, `dpkg --remove` or
`apt-get remove` in Debian derivatives leaves configuration files intact
so that the package can be reinstalled later without having to
reconfigure it, with `dpkg --purge` or `apt-get purge` used to remove
the configuration files too.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #2840Closes: #2849
Approved by: alexlarsson
There is no great place for this, but the transaction api is
the primary place affected by this problem so I put the note there.
Closes: #2856
Approved by: alexlarsson
We enforce an umask of 022 (no world/group writable) in the cli and
the system helper. This is necessary, because we need to create
ostree repositories shared between the helper and the client, and
a more strict umask breaks this.
It would be nice if we could just set this in a thread-local way when
needed, but unfortunately umask() is not threadsafe or overridable in
any local way.
This unfortunately means this it will not automatically work for
libflatpak users...
Closes: #2856
Approved by: alexlarsson
We need this to ensure that the dir can be shared with the new
system-helper flatpak user. Old dirs can happen to get less
permissions if there was a umask set when it was created.
Closes: #2856
Approved by: alexlarsson
Instead of combining name and comment we split them into two columns.
We also disable the comment column by default for list and remote-ls
as it is very poor in long tables. However, it is still there for search
where it seems more useful.
Also, the Application column title changed to Application ID to make
it clearer what it is compared to the "Name" column.
Closes: #2852
Approved by: alexlarsson
Old versions of the create-usb command created a summary file in the
local repo being pulled from (e.g. /var/lib/flatpak/repo) but this
summary generation turned out not to be necessary and was removed. So
any computer which used the create-usb command before commit 7c5751a4f
will have a leftover /var/lib/flatpak/repo/summary file which becomes
outdated as apps are updated and installed. This causes problems for the
next invocation of (a recent version of) the create-usb command which
will use the outdated summary during the pull and fail with an error
message like:
error: Importing 3b1293596e9aa67f6fd0daeae477cb94603a4e8ca9e825f446d3dd04a2b5d5ec.commit:
fstatat(3b/1293596e9aa67f6fd0daeae477cb94603a4e8ca9e825f446d3dd04a2b5d5ec.commit): No such file or directory
So this commit makes the create-usb command delete the summary if it
exists before pulling onto the repo on the USB drive. This means USB
copies will work again for any users that used the USB app copy feature
in Endless OS 3.4.7.
Closes: #2854
Approved by: alexlarsson
Additionally flatpak_table_printer_set_columns now takes a boolean
to say whether the arguments in use are the default.
Closes: #2850
Approved by: matthiasclasen
Alexander Larsson