flathub: sandbox permissions (home access and secrets) via portals
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 38/100
研究方向
Start by reading the Flatpak manifest and the app’s file chooser and secret storage integrations; the issue does not name their paths. Check how database files are opened and how flutter_secure_storage finds existing entries in a sandbox. Done means replacing broad permissions with portal or app data access where possible, justifying any exception, verifying the local MCP server permissions, and adding a “Running as a Flatpak” note to the docs.
由索引模型根據 Issue 內容生成。
描述
Part of #1060. Reviewer: "Why unrestricted home access?" and "Why unrestricted secrets access?" Linter: finish-args-home-filesystem-access (error).
Rules: "Static permissions must be kept to an absolute minimum"; apps "should rely on XDG Portals"; when a suitable portal exists, "using the portal becomes mandatory instead of static permissions"; "overly permissive configurations will not be accepted."
Current finish-args
--filesystem=home and --talk-name=org.freedesktop.secrets (plus network, ipc, x11/wayland, dri).
Work
- Files: SQLite databases, SQL scripts, export targets, theme and extension folders must come from the file chooser portal or the app's own data dirs. Drop
--filesystem=home. Check.db/.sqlitefile associations (opened files arrive through the portal) - SSH tunnels: private keys and
known_hosts: let the user pick key files through the chooser, or document--filesystem=~/.ssh:roas a narrowly justified exception to ask for - Secrets: use the Secret portal (libsecret speaks it from inside a sandbox) instead of talking to
org.freedesktop.secretsdirectly; verify thatflutter_secure_storageworks and that existing entries are found - Local MCP server / bridge: confirm what needs network and ipc
- Write a short justification for every remaining permission for the reviewer
- Add a "Running as a Flatpak" note to docs listing what changed in behaviour
- 主要語言
- Dart
- 星號
- 23
- 分支
- 1
- 平均合併
- 31 分鐘
- 30 天內合併 PR
- 570
環境準備
在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
QueryaHub/Querya-Desktop 的其他 Issue
-
enhancement ui
難度 2/5 1-3 小時 新手友好度 78/100
QueryaHub/Querya-Desktop#1689 ·
維護者通常 1 天內回覆
-
ui(dialogs): make destructive query and DML preview dialogs adaptive and prevent table name overflow未關閉bug frontend
難度 2/5 1-3 小時 新手友好度 82/100
QueryaHub/Querya-Desktop#1642 ·
維護者通常 1 天內回覆
-
bug error-handling settings
難度 1/5 1-3 小時 新手友好度 78/100
QueryaHub/Querya-Desktop#1637 ·
維護者通常 1 天內回覆
-
enhancement
難度 1/5 1 小時以內 新手友好度 88/100
QueryaHub/Querya-Desktop#1636 ·
維護者通常 1 天內回覆
-
enhancement marketplace
難度 2/5 1-3 小時 新手友好度 78/100
QueryaHub/Querya-Desktop#1635 ·
維護者通常 1 天內回覆
查看 QueryaHub/Querya-Desktop 的全部 Issue
相似的 Issue
-
Standalone dash flashes as its own RSVP step (e.g. Russian dialogue)可能已有人在做 @bezig01 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
daniel-pimenta-cc/ledor#53 ·
-
難度 2/5 1-3 小時 新手友好度 84/100
-
enhancement firebase
難度 2/5 1-3 小時 新手友好度 65/100
brysonddelozier/scribbles#24 ·
-
bug good first issue P2-Medium
難度 2/5 1-3 小時 新手友好度 64/100
basictech01/uniun#305 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 70/100
daohoangson/flutter_widget_from_html#1657 ·
維護者通常 3 天內回覆