flathub: sandbox permissions (home access and secrets) via portals
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 38/100
调研方向
Start by reading the Flatpak manifest and the app’s file chooser and secret storage integrations; the issue does not name their paths. Check how database files are opened and how flutter_secure_storage finds existing entries in a sandbox. Done means replacing broad permissions with portal or app data access where possible, justifying any exception, verifying the local MCP server permissions, and adding a “Running as a Flatpak” note to the docs.
由索引模型根据 Issue 内容生成。
描述
Part of #1060. Reviewer: "Why unrestricted home access?" and "Why unrestricted secrets access?" Linter: finish-args-home-filesystem-access (error).
Rules: "Static permissions must be kept to an absolute minimum"; apps "should rely on XDG Portals"; when a suitable portal exists, "using the portal becomes mandatory instead of static permissions"; "overly permissive configurations will not be accepted."
Current finish-args
--filesystem=home and --talk-name=org.freedesktop.secrets (plus network, ipc, x11/wayland, dri).
Work
- Files: SQLite databases, SQL scripts, export targets, theme and extension folders must come from the file chooser portal or the app's own data dirs. Drop
--filesystem=home. Check.db/.sqlitefile associations (opened files arrive through the portal) - SSH tunnels: private keys and
known_hosts: let the user pick key files through the chooser, or document--filesystem=~/.ssh:roas a narrowly justified exception to ask for - Secrets: use the Secret portal (libsecret speaks it from inside a sandbox) instead of talking to
org.freedesktop.secretsdirectly; verify thatflutter_secure_storageworks and that existing entries are found - Local MCP server / bridge: confirm what needs network and ipc
- Write a short justification for every remaining permission for the reviewer
- Add a "Running as a Flatpak" note to docs listing what changed in behaviour
- 主要语言
- Dart
- 星标
- 23
- 派生
- 1
- 平均合并
- 31 分钟
- 30 天内合并 PR
- 570
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
QueryaHub/Querya-Desktop 的其他 Issue
-
enhancement ui
难度 2/5 1-3 小时 新手友好度 78/100
QueryaHub/Querya-Desktop#1689 ·
维护者通常 1 天内回复
-
ui(dialogs): make destructive query and DML preview dialogs adaptive and prevent table name overflow未关闭bug frontend
难度 2/5 1-3 小时 新手友好度 82/100
QueryaHub/Querya-Desktop#1642 ·
维护者通常 1 天内回复
-
bug error-handling settings
难度 1/5 1-3 小时 新手友好度 78/100
QueryaHub/Querya-Desktop#1637 ·
维护者通常 1 天内回复
-
enhancement
难度 1/5 1 小时以内 新手友好度 88/100
QueryaHub/Querya-Desktop#1636 ·
维护者通常 1 天内回复
-
enhancement marketplace
难度 2/5 1-3 小时 新手友好度 78/100
QueryaHub/Querya-Desktop#1635 ·
维护者通常 1 天内回复
查看 QueryaHub/Querya-Desktop 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
AppFlowy-IO/AppFlowy#9075 ·
-
Paste asks for iOS paste permission because the default context menu ignores SystemContextMenu可能已有人在做 @dorklein 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
maheshj01/searchfield#267 ·
-
难度 2/5 1-3 小时 新手友好度 67/100
-
难度 2/5 1-3 小时 新手友好度 72/100
avdept/JellyBoxPlayer#375 ·
维护者通常 1 天内回复
-
bug good first issue
难度 2/5 1-3 小时 新手友好度 82/100
basictech01/uniun#300 ·
维护者通常 1 天内回复