remote-add registers --no-follow_redirect instead of the documented
--no-follow-redirect. Its reversed flag and both remote-modify redirect
flags set initially false booleans to false, so the policy is not applied.
Correct the option spelling and remove G_OPTION_FLAG_REVERSE so these
switches enable the corresponding configuration updates.
Parse the cursor as a long before narrowing it to the completion
structure's integer field. This lets malformed, negative, and overflowing
positions fail before they can index outside the command-line buffer, while
preserving the existing behavior of clamping positive positions beyond the
line length.
g_format_size() output is unit-suffixed and locale-dependent, which
makes it awkward to sort or parse in scripts.
-b/--bytes prints a plain byte count; human-readable remains the
default. Also update the man page, the completion test and the tests.
A decimal-aligned cell padded itself to widths[j], the natural column
width, while the title row and left-aligned cells padded themselves to
len, the width after expansion and ellipsization. In a table with an
expanding decimal column the title row and the cells therefore ended at
different offsets, and every column after the decimal one lost its
alignment. A cell with no decimal point in it used the left-aligned path,
so it stayed with the title row while its neighbours in the same column
moved.
The natural width of a decimal column is also not the width of its widest
cell: the cells split at the decimal point, so the column needs
lwidths[i] characters before the point and rwidths[i] after it. Take that
into account, so the trailing padding can no longer go negative and push
the rest of the row to the right.
ensure_extensions() used g_file_resolve_relative_path() with
ext->directory, which comes from runtime/SDK metadata and can contain
".." components. This allowed a malicious extension to write outside
the build directory.
Replace the GFile-based path resolution with glnx_chase_and_mkdirat()
using GLNX_CHASE_RESOLVE_BENEATH | GLNX_CHASE_RESOLVE_NO_SYMLINKS,
which rejects any path that escapes the directory fd.
Convert the rest of flatpak_builtin_build_init to fd-relative
operations (mkdirat, symlinkat, glnx_opendirat, glnx_shutil_rm_rf_at,
glnx_file_replace_contents_at, flatpak_cp_a_at) anchored to a
base_dfd opened from the build directory.
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm
The --assumeyes (-y) option was setting both the CLI-level
disable_interaction flag and the library-level no_interaction flag to
TRUE. This caused -y to suppress not just confirmation prompts, but
also credential prompts (basic auth, webflow), polkit authorization
dialogs, and parental control consent -- even though -y is documented
as "automatically answer yes to all questions".
Rename disable_interaction to assume_yes to clarify its purpose: it
auto-answers yes/no confirmations and picks default choices. Stop
calling flatpak_transaction_set_no_interaction() from the CLI
transaction constructor, so the library-level no_interaction flag is
only set by --noninteractive (which uses FlatpakQuietTransaction).
Remove the assume_yes guard from basic_auth_start so credential
prompts are always shown when the CLI transaction is in use.
Assisted-by: Cursor
Copy and paste error which results in the default and explicit usage of
--clear-env to be inverted.
Fixes: f760f1b5 ("run: Add --clear-env option for clearing the outside environment")
As per g_type_ensure's documentation it is technically incorrect to mark
_get_type fns with G_GNUC_CONST since they have side-effects on their
first run.
See https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5223 for more
details.
Both collect exports and flatpak_export_dir recursively export the
directories in their respective directory lists. Because of this,
including share/metainfo/releases when share/metainfo is already in the
lists is unnecessary and can cause exporting to fail because of
duplicate files.
In flatpak_pull_from_oci we can be in in the system helper where we pull
the mirrored OCI image into the system repo. However, to fetch the
signatures in GPG signed repos, we used a remote OciImageSource created
through `flatpak_remote_state_fetch_image_source`. This caused fetching
some data from the registry which we don't want in the deploy method,
and also fails if a token is required to access the repo.
This change fetches the signatures from the mirrored OCI repo instead of
pulling them from the remote OciImageSource. The signatures can come from
anywhere because we verify them against the GPG key in the system repo.
The important bit is the change in `flatpak_pull_from_oci` where we now
pass in the local image_source to fetch the signatures from, and in the
system helper, where we get the right metadata to check the signatures
against (eventually ends up in `flatpak_oci_signatures_verify`).
These fds are stdin, stdout and stderr respectively, and are expected
to remain open at all times (if they are not needed then they can point
to /dev/null, but they should always be open). If the user gives us
`--env-fd=2` or similar, we don't want to close fd 2 before exiting
unsuccessfully: that would give us nowhere to display the error message.
Signed-off-by: Simon McVittie <smcv@collabora.com>
When repair (re)installs runtimes via a transaction, the transaction
auto-pins every runtime it touches. This causes repair --reinstall-all
to pin every installed runtime, cluttering the pin list with runtimes
that were never explicitly pinned by the user and preventing
flatpak remove --unused from cleaning them up.
Fix this by disabling auto-pinning on the repair transaction so that
the pin state is left exactly as it was before the repair.
Fixes https://github.com/flatpak/flatpak/issues/6565
On entry to `flatpak run`, these fds have been inheritable (not
FD_CLOEXEC), otherwise they would not have been inherited; but we don't
want the "payload" command to inherit them, so set them as
non-close-on-exec as soon as we receive them. In the cases where we pass
them down to the underlying bwrap command, we'll either dup them, or
set them to be inheritable again (in practice we dup them).
In particular, Chromium-derived web browsers get very upset when their
subsandbox processes inherit unexpected fds, which has been causing crashes
with no useful diagnostic information since CVE-2026-34078 was fixed.
Fixes: 1b5e886d "run: Add --usr-fd and --app-fd options"
Fixes: b5ae89ed "run: Add --(ro-)bind-fd options"
Resolves: https://github.com/flatpak/flatpak/issues/6582
Signed-off-by: Simon McVittie <smcv@collabora.com>
The flatpak portal allows apps to expose files and folders from within
the sandbox to a side-sandbox using flatpak-spawn. So far it has used
the --filesystem option to mount those files and folders, but it takes a
path. Paths are inherently racy and they allow the app to swap out any
component of the path with a symlink after handing it off. If they win
the race, flatpak will mount a completely different directory.
This adds a new way to mount files and directories based on O_PATH
file descriptor that needs to provided when execing the flatpak binary.
This also allows us to use glnx_chaseat, and other at-functions to
traverse the filesystem tree in a safe way.
This is important because the app and runtime deploy directories can be
under an attackers control. The flatpak portal for example allows
sandboxed apps to provide them.
In particular, attacks where the deploy dirs get replaced by a symlink
pointing into the host system will be stopped by this.
Note that this change alone is not enough to avoid the attack, and the
portal has to be changed as well.
This reverts commit c7824ae5f3.
We want to use the cgroup as authentication for flatpak instances in the
future. Giving explicit control over this to the user destroys the
invariant we need without a backwards incompatible change.
If the user presses any key while we the CLI transaction UI is being
shown, it ends up in stdin. When we issue the Cursor Position command,
the result is appended to stdin and we fail to match on it because of
the proceeding bytes.
Similarily, if we fail to match the command output (bad data, too slow,
..), we leave behind data in stdin which will be echoed back to the
terminal when we restore the initial termios which icnludes ECHO in
c_lflag.
Let's use TCSAFLUSH to flush out stdin data before we issue the command,
which should help with matching the expected response.
Let's also use TCSAFLUSH when we restore the previous termios to make
sure the stdin is clean and we don't echo whatever remains in stdin.
Closes: #2712
The 'arch' parameter of flatpak_dir_remote_fetch_indexed_summary() is
used to construct the names of the caches, and can't be NULL. This
function is used by flatpak_remote_state_ensure_subsummary(), which is
used by ensure_remote_state_arch(). So, the parameter can't be NULL in
those either.
Here are some strings representing valid refs:
app/org.test.App/x86_64/stable - full ref
org.test.App/x86_64/stable - full ref without prefix
org.test.App - only app ID
org.test.App/x86_64 - only app ID and arch
org.test.App//stable - only app ID and branch
Therefore, if a ref's prefix (ie., 'app/' or 'runtime/) is skipped,
then there can only be a maximum of 3 other elements in it.
Right now, it's possible for find_current_element() to return a count
of 4, if the string being completed is invalid and has some extra
elements or slashes in it. This count is later used to index the
cur_parts array which only has 4 elements in it. This opens up the
possibility of a buffer overrun.
Invalid strings with extra elements or slashes can't be further
completed because none of the existing refs will match them.
Therefore, such strings should be outright skipped.
For the rest of the valid strings, the exact intended branch name is
never known, because the branch element doesn't have a trailing slash
and hence appears to be a prefix. Therefore, it's not possible to use
the branch to find a list of existing refs that could possibly
complete the string.
Fallout from 7018717ce2
OpenScanHub [1] triggered this and flagged it as CWE-476 [2]:
app/flatpak-builtins-document-unexport.c:90:7:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘doc_id’
app/flatpak-builtins-document-unexport.c:48:1: enter_function: entry
to ‘flatpak_builtin_document_unexport’
app/flatpak-builtins-document-unexport.c:56:20: release_memory:
‘doc_id’ is NULL
app/flatpak-builtins-document-unexport.c:61:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:66:7: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:66:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:69:6: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:69:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:72:3: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:75:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:78:15: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:82:6: branch_false: following
‘false’ branch...
app/flatpak-builtins-document-unexport.c:85:7: branch_false: ...to
here
app/flatpak-builtins-document-unexport.c:85:6: branch_true: following
‘true’ branch...
app/flatpak-builtins-document-unexport.c:86:14: call_function: inlined
call to ‘g_strdup_inline’ from ‘flatpak_builtin_document_unexport’
app/flatpak-builtins-document-unexport.c:90:7: release_memory:
‘doc_id’ is NULL
app/flatpak-builtins-document-unexport.c:90:7: danger: dereference of
NULL ‘doc_id’
# 88| return FALSE;
# 89|
# 90|-> if (strcmp (doc_id, "") == 0)
# 91| {
# 92| g_print (_("Not exported\n"));
Add an assertion to express that 'doc_id' can't be NULL unless there's a
programmer error.
Spotted by Siteshwar Vashisht.
[1] https://openscanhub.dev/
[2] https://cwe.mitre.org/data/definitions/476.html
Use opt_noninteractive instead of hardcoded values so AppStream
refresh is quiet only when --noninteractive is specified. This allows
to show a better messsage instead of repeating and makes the errors
visible as well.
Related: #5716
Replace the "Nothing to do" message with "Nothing to update." when no
refs have updates available which is slightly clearer.
Fixes: #5716
Co-authored-by: Patrick <github.calorie764@passmail.net>
Co-authored-by: bbhtt <bbhtt.zn0i8@slmail.me>
Since this bug can be reproduced on Ubuntu, Debian, and Fedora, we should set `FLATPAK_FORCE_TEXT_AUTH=1` for all WSL users instead of ignoring its existence. After all, the so-called `graphical prompt` in the flatpak documentation seems to be something unique to GNOME. `WSL_DISTRO_NAME` and `WSL_INTEROP` are both located at https://github.com/microsoft/WSL/blob/master/src/linux/init/util.h .
Several glibc functions now return a const pointer if the input is a const pointer and a non-const pointer if the input is non-const, causing a build failure.
Fix this by declaring the output pointers as const if they are never modified and for the lone failure where the output is modified instead make the input non-const.
What I did
Repository rules / “don’t edit” areas
From CONTRIBUTING.md and subprojects/README.md, subprojects/ contains vendored/submodule/copylib code (bubblewrap, libglnx, dbus-proxy, variant-schema-compiler). I treated subprojects/ as third-party and excluded it from typo fixing.
You already skip po/ (translations) and node_modules/, and I kept those exclusions.
Typos fixed (project-owned files only)
I ran codespell with write mode and exclusions, and fixed the reported typos across:
NEWS
app/…
common/…
doc/…
tests/…
session-helper/…
portal/…
data/…
Then I handled the remaining items individually:
NEWS: thse -> these
common/flatpak-utils-private.h: Thse -> These
app/flatpak-polkit-agent-text-listener.c: identies -> identities
tests/test-auth.sh: Propertly -> Properly
tests/testlibrary.c: remore -> remote
common/flatpak-transaction.c: improved wording to avoid the xwindows typo (X11 window ID)
Added .codespellrc
Created .codespellrc:
skip: node_modules,po,subprojects
ignore-regex: .*(ratatui|Affinitized|affinitized).*
ignore-words-list: nd,ot,THUR,IST,fo,hel,bu
(these were confirmed as legitimate tokens/abbreviations/namespace prefix/test strings in this repo, so they should not be “fixed”)
Verification:
codespell --config .codespellrc . now exits clean.
Signed-off-by: rezky_nightky <with.rezky@gmail.com>
If the command calling `flatpak build` has already specified a
font-dirs.xml to map, then mapping in again may break (as exemplified in
Builder and Foundry).
This checks to see if an argument has already been mapped in before doing
so and resolves the issue with Builder/Foundry.
Follow-up to !6138Fixes: GNOME/gnome-builder#2387
In the following usages, the "Install:" and "Download:" strings were used as a short form
of the "Download Size" and "Installed Size", which makes translation tricky.
Therefore, using the normal forms will be good from the translation side.
This gives us conditionals for shares and features. So far we have no
use case for this, but the system already exists, it makes the code
simpler, and when we need this in the future, we don't have to wait for
it to roll out.
Allow specifying a lookside URL for downloading signatures for
an OCI remote. This can be specified:
In a .repofile with the SignatureLookaside key
As the --signature-lookaside option to remote-add/remote-modify
At the moment the --runtime-repo flags of flatpak build-bundle export is
ignored when building an OCI image. So an Flatpak OCI registry which
wants to supports a .flatpakref file has no information about the
runtime repo. With this PR the runtime repo gets added as the
org.flatpak.runtime-repo label to the OCI image.
This is currently only metadata to be used by repositories and not
used by flatpak during install.
A few years ago there was a very painful attempt at porting from
libsoup2 to libsoup3. Flatpak libsoup3 support never landed and it seems
like a large amount of distros have switched over to libcurl instead.
This commit removes libsoup2 support completely instead of growing
libsoup3 support.
Closes#5915Closes#4582
Add an option to build OCI bundles with zstd compressed layers.
gzip is kept as the default for maximum compatibility:
Ecosystem support:
distribution/distribution: no explicit support, but works
quay.io: sinc 2021
Amazon ECR: supported
pulp_container: since 2022
flatpak: since first-OCI supporting version
tardiff: since first version
- Make percent values translatable
Various languages use different ways to format the percentage
values[1], making it translatable will allow a more coherent way to
display the information.
- Make remaining time abbreviation translatable
Making this value translatable will allow languages to display the
seconds abbreviation in their language. This is particulary an issue
for Turkish, in which hours and seconds start with the same letter, so
it's not possible to distinguish which is which. We use a second
letter (sa, sn) to figure it out.
[1] https://en.wikipedia.org/wiki/Percent_sign#Form_and_spacing
Signed-off-by: Emir SARI <emir_sari@icloud.com>
In 4febfb59 ("flatpak: Disable progress escape sequence by default") the
escape sequence has been disabled by default, but we want to enable it
again for 1.18.
There are a number of races, and failure conditions which can lead to a
pid of 0 being returned from flatpak_instance_get_child_pid. This would
lead to a whole bunch of things getting killed.
We will skip the instance in those cases now, and retry a few times. We
also notice when the instance just goes away by itself now.
This should make killing more robust, and especially not SIGKILL pid 0.
Sudo can be used in several ways other than calling a command with the
root user. For example, one can use -u to run the command as the
specified user, or -g to specify a primary group to run the command
as.
Flatpak adds a check when --user is used to prevent an installation in
the root's directory, for example, but it does it by only checking if
sudo was used. As stated previously, it does not necessarily imply
root, so this patch explicitly checks if the command is being run with
the root user.
Fixes: https://github.com/flatpak/flatpak/issues/5979
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Those schemes are in use by flathub, usually to be handled by an app
store, but we can also handle it directly with `flatpak install`.
Base on an idea from user bbb651 in
https://github.com/flatpak/flatpak/pull/6259.
The appstream docs say:
Release data may be present directly in a component metainfo file, but
also optionally be split out into an external metadata file.
The file must be installed as
/usr/share/metainfo/releases/%{cid}.releases.xml, where cid is the
component ID of the component the release information belongs to.
This change allows flatpak build-finish to export those external release
files.
Closes#6057
Razze