Be more systematic about returning FLATPAK_ERROR unmodified
and wrap everything else in a G_DBUS_ERROR_FAILED.
Closes: #2391Closes: #2532
Approved by: alexlarsson
These services were not generating coverage data
because they always get ended by GDBus raising
SIGTERM when the bus goes away. Prevent this by
telling GDBus not to do that, and let the services
exit regularly, on their own terms.
This makes the system helper code show up in the
coverage statistics.
Closes: #2530
Approved by: matthiasclasen
This adds a version to the deply data format, assuming that if
there is no version then it is 0. Also extends all loaders so that
it can specify a required version, with the goal that most users
are fine with old versions, but if you need more recent we have
a (costly) conversion process to upgrade (will be added later).
The library and the flatpak list/info commands require the most
current version for full info, all other users can use any version.
Also, as part of this we now pass the ref to flatpak_load_deploy_data()
as this will be needed later for the backwards compat support.
Closes: #2409
Approved by: alexlarsson
The first element put in the variant created by
flatpak_dir_system_helper_call_deploy() is the repo path, but this is
being treated as the installation ID in
flatpak_authorize_method_handler(), which results in a seg fault when
dir_get_system() returns NULL and this NULL is passed to
dir_ref_is_installed(). Fix the seg fault by getting the correct element
from the variant.
Closes: #2411
Approved by: matthiasclasen
We shouldn't put the unsightly dbus error wrapping in the
UI. The cient already strips the wrapping from the system
helper call, but it can't strip the second level itself.
Closes: #2399
Approved by: mwleeds
GVariant doesn't take it lightly when you are trying to extract
an ay value with an s format. This was causing critical warnings.
Closes: #2393
Approved by: alexlarsson
There was a bunch of handle methods which forgot to do
this manually, so call the flatpak_dir_set_source_pid()
method right when we create the FlatpakDir object.
Closes: #2384
Approved by: alexlarsson
The Deploy method takes an 'update' flag from the caller
and picked the permission to check based on that, which
is not safe. Instead, we can check ourselves if the ref
we are given is already installed (in which case it is
an update, or a reinstall).
After this change, the update flag is ignored by the
system helper.
Closes: #2384
Approved by: alexlarsson
I realized that these messages are a bit confusing, with
keep permissions and implications. We end up asking a
question about one ref, but then use the permission we optained
to operate on other refs. This will get a bit worse with
the new hints, so go back to more generic messages that
don't talk about the details. The ultimate goal here is
less messages, anyway.
Closes: #2384
Approved by: alexlarsson
This is to avoid multiple polkit dialogs, regardless
of transaction ordering.
FlatpakTransaction calculates the 'strongest' op it has,
and passes the hints accordingly. FlatpakInstallation
doesn't pass hints, since it does individual operations.
The system helper uses the hints to determine which PolicyKit
permission to request. Since the policy typically has 'keep'
set, this mean that the following operations in the same
transaction will be able to reuse the permission obtained
for the first one.
Closes: #2384
Approved by: alexlarsson
Add a new 'no-interaction' flag to all system-helper methods
that have flags, and don't allow polkit user interaction if
it is set. This will let tools like GNOME Software do automatic
updates in the background without interrupting the user with dialogs.
For methods that don't have flags, we always allow user interaction.
Closes: #2367
Approved by: alexlarsson
Some methods were missing a flags argument. This
will be a problem in the future, when we want to
pass a no-interaction flag to all methods. Therefore,
add an empty flags enum for every method that is lacking
one now.
This is an api change for the system-helper interface.
Closes: #2370
Approved by: alexlarsson
The OCI support relies on downloading a json index and converting it
to a ostree-style summary, which we the use in all sorts of operations
in the client code. Currently this happens in the user code, which means
that it will fail (due to permissions) in the system installation case.
We could do the conversion as the user, but when eventually installing
something the system-helper will anyway do this download and
conversion, so that would only double the work and risk things going out
of sync. Also, the OCI index is not gpg signed, so we can't realy on
downloads done as the user.
So, the solution done here is to add a GenerateOciSummary
system-helper call which we use instead of directly generating the
oci summary.
This fixes https://github.com/flatpak/flatpak/issues/2350Closes: #2363
Approved by: matthiasclasen
Currently by an accident of history when the system-helper is asked to
deploy updates to the repo metadata (stored on the ref
"ostree-metadata") it uses the polkit action
org.freedesktop.Flatpak.runtime-install since the ref doesn't start with
"app/" and is therefore assumed to be a runtime. This of course doesn't
make much sense, so this commit redirects such invocations of the
"Deploy" method to the "modify-repo" action, which is a bit of a
catch-all of things the system-helper should be allowed to do. It
doesn't seem necessary to split this out into its own action, since
sysadmins probably don't need the ability to break Flatpak's expected
functionality by disabling it. See the PR for more discussion.
Fixes https://github.com/flatpak/flatpak/issues/2328Closes: #2351
Approved by: matthiasclasen
Originally the modify-repo action was only used by the RemoveLocalRef
method, which has "remote" and "ref" parameters, but now other methods
use it which don't have such parameters. So this commit modifies
flatpak_authorize_method_handler() so that we're not trying to pass
information along to polkit that we might not have, and modifies the
message shown by polkit to be more accurate.
Closes: #2351
Approved by: matthiasclasen
This is not a functional change: the default return value is equivalent
to polkit.Result.NOT_HANDLED. However, this makes the behaviour more
obvious.
Signed-off-by: Philip Withnall <withnall@endlessm.com>
Closes: #2354
Approved by: matthiasclasen
This is currently only used in the ‘search’ built-in command, but will
need to be used in upcoming parental controls filtering changes in
Endless OS (which will go upstream eventually) too.
This introduces no functional changes.
The CFLAGS/LIBADD changes are necessary because of the new
AppStream #includes.
Signed-off-by: Philip Withnall <withnall@endlessm.com>
Closes: #2296
Approved by: matthiasclasen
Update the user-visible messages to include some of
the details that are available. An informed user is
a happy user.
String change!
Closes: #2287
Approved by: matthiasclasen
We add the callers pid as OBJECT_PID to our journal
entries, which causes journald to add number of useful
fields, such as the user and binary on whose behalf we
are acting.
Our benchmarks show this significantly reduces the interactivity impact of
ongoing Flatpak operations while the user is continuing other tasks on the
system. The effect is very pronounced with the default CFQ scheduler, and in
combination with BFQ, using the idle class improves the worst case to nearly
the same as an unloaded system.
Closes: #2071
Approved by: alexlarsson
When deploying the appstream for an OCI remote we actually pull the
http remote. This triggers some libsoup code that recurses the default
mainloop. As this happens of the main thread we can get the response
back on the wrong thread leading causing us to never send the reply
back, hanging the call.
Closes: #2010
Approved by: alexlarsson
The normal behavior where we only list already installed refs for
a noenumerate remote doesn't work for the case where flatpak-system-helper
verifies a ref on an OCI server during installation - in that case, the
ref being installed to does not *yet* exist locally.
We previously made a separate request to the registry index to see if
the manifest hash of an image was the hash of the image in the registry.
Since the summary is now downloaded by the system helper and trusted, just
check if the hash matches the hash in the summary data. This is as good,
and in is a lot more efficient if the index is statically generated,
and we can't get the index data for just one image.
Closes: #1910
Approved by: alexlarsson
Checking the registry against a previous etag is now handled inside
flatpak_cache_http_uri(), so remove the etag parameters that were
previously passed around in various places for simplicity.
Closes: #1910
Approved by: alexlarsson
Previously the code assumed that appstream data was stored in a separate
OCI image in the registry. Replace that with storing the appstream data
and icons as image annotations. When we download a new version of the
image index, the appstream data is combined, and icons are downloaded
as necessary.
Since there is no longer a content hash for the appstream data, it's
not practical for the user to download the appstream data and pass it
to the system helper, instead the system helper just downloads the
appstream data directly.
Closes: #1910
Approved by: alexlarsson
This system-helper method will allow flatpak to update the ostree repo
summary while running as a non-root user that's in the "sudo" group.
This will allow the `flatpak create-usb` command to work without
requiring the user to first run `sudo ostree summary -u`, and without
requiring the system to have `core.auto-update-summary` set to true in
the ostree repo config. This is also much more efficient than
`core.auto-update-summary` because it allows us to only update the
summary when we need it rather than after every transaction.
Generating the summary basically just involves traversing the repo to
enumerate all the refs and putting this information into a file, so I
don't think there are security concerns with allowing it to happen
without authentication.
Closes: #1945
Approved by: alexlarsson
Setting an error with second_error->message is going to work poorly
when second_error has never been set non-NULL.
Related to #1845, although not necessarily the full solution.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Closes: #1867
Approved by: alexlarsson
This is used to create the /var/lib/flatpak repo if
needed so that other later operations work. We have
some partial support for it not working in various
operations (using the allow_empty argument) but
this is in no way complete. For example, this
can easily happen if you have a per-user installation
but no system one and then you run flatpak install
with no --user, then it will try to figure out
which one to use and die.
Simplify some of the return logic when handling pushing/popping the
thread default main context by using g_autoptr(GMainContextPopDefault).
Signed-off-by: Philip Withnall <withnall@endlessm.com>
Closes: #1736
Approved by: alexlarsson
This moves the triggers from out of flatpak_install/update/uninstall
and instead calls them manually at all the sites that call this.
This allows FlatpakTransaction to only run the triggers once for the
entire operation.
Closes: #1743
Approved by: alexlarsson
This moves all the files from lib into common, and it also adds all the libflatpak
sources into libflatpak-common, making libflatpak just a wrapper around the common
helper library.
This move allows the CLI to use all the code from libflatpak. We were already doing
this with a few things like flatpak-error*.[ch], and we want to do it even more
when sharing FlatpakTransaction. This also allows use to slowly move
the CLI to using the libflatpak apis for some things.
Closes: #1706
Approved by: alexlarsson
Matthias Clasen