This uses various environment variables set during make check
to find the trigger, bwrap and xdg-app-dbusproxy from the build/source dir
rather than the installed location.
This patch adds the --arch option to the build-export builtin command.
Previously build-export derives this from the metadata and then falls back
to xdg_app_get_arch(), except that this does not work when the metadata does
not specify an arch (such as with extensions like .Debug or .Locale).
https://bugs.freedesktop.org/show_bug.cgi?id=95226
Bubblewrap is a new tool from project atomic. Its similar to the old
xdg-app-helper, but even more minimal, and a bit more generic. Its designed
to be easy to git submodule install, but at some point we will probably
support using the system installed version too.
Using bubblewraps lets us share the load of security mainainance and
allows other people to use bubblewrap to do their own unprivileged
sandboxes.
This lets you export and import a runtime or an application into a tarball
that explodes to match the oci runtime spec. This goal of this is to interchange
xdg-app apps with other systems that support OCI.
Note that this is highly experimental, because the oci specs are in flux, and
in fact we should probably use the OCI image spec instead of the runtime spec,
but its not yet finished enough for us to use it. So, don't rely on this for
now other than to experiment with it.
This can be useful to find out what bus names your app
is actually talking to, so you can set up a bus policy
that is narrowed than blanket access without breaking
your application.
This is pretty inefficient in terms of download counts, and its not
cached. Lets store the data we need in the summary, which we need
to download anways, and which we cache.
This adds the app target arch to the list of the allowed arches
in seccomp. It also allows the native arch, because otherwise
xdg-app-helper can't run.
This means that if your userspace (i.e. xdg-app-helper) is built in
64bit mode, then 64bit apps can't run 32bit apps. However, if you're
running a 32bit app it is allowed to run both 32bit and 64bit apps.
Not ideal, but at least the common case is safer.
