mirror of
https://github.com/flatpak/flatpak.git
synced 2026-03-10 11:12:46 -04:00
6d74eec0a9
Currently we verify the checksum of indexed summary files (which have .sub file names) before writing them to the on-disk cache, so in theory as long as the disk I/O is successful the data integrity should be intact when we use it via the flatpak-variant-impl-private.h helpers generated by variant-schema-compiler. However in practice people sometimes hit assertion failures which are what you would expect to see if the data is corrupt, since GVariant stores some metadata such as the "offset size" toward the end of the data, and if we read this from serialized user data instead it will obviously be incorrect. In one case I was able to acquire the flathub.idx, flathub.idx.sig, and flathub-x86_64-fad08cfb10713e749f02a0e894b5d577b7e9c4931fdf9d2fdc50364c002bc925.sub files which reproduce one of the assertion failures, and the sub file appears to be incomplete, like the writing of it was interrupted. We use g_file_replace_contents() when saving these to the disk, and when not replacing an existing file that function writes directly to the final filename, so if interrupted it would be expected to leave an incomplete file. This commit changes the summary file handling so that we verify the checksum of any indexed subsummary again after reading it from disk. If it doesn't match we delete the on-disk cache and try fetching from the network. Fixes #4127
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
See https://flatpak.org/ for more information.
Community discussion happens in #flatpak:matrix.org, on the mailing list, and on the Flathub Discourse.
Read documentation for Flatpak here.
Contributing
Flatpak welcomes contributions from anyone! Here are some ways you can help:
- Fix one of the issues and submit a PR
- Update flatpak's translations and submit a PR
- Improve flatpak's documentation, hosted at http://docs.flatpak.org and developed over in flatpak-docs
- Find a bug and submit a detailed report including your OS, flatpak version, and the steps to reproduce
- Add your favorite application to Flathub by writing a flatpak-builder manifest and submitting it
- Improve the Flatpak support in your favorite Linux distribution
Hacking
See CONTRIBUTING.md
Related Projects
Here are some notable projects in the Flatpak ecosystem:
- Flatseal: An app for managing permissions of Flatpak apps without using the CLI
- Souk: A Flatpak-only app store
- Flat-manager: A tool for managing Flatpak repositories