This lets distributors share a system copy of bubblewrap (>= 0.1.0)
between Flatpak and any other projects that benefit from it, if they are
careful to keep new versions in sync. The default is still to use the
bundled submodule, ensuring compatibility and simplifying dependencies.
Enable $PATH search everywhere that runs bwrap, so that $BWRAP doesn't
necessarily need to be a fully-qualified path.
Signed-off-by: Simon McVittie <smcv@debian.org>
Due to an issue with ostree (https://github.com/ostreedev/ostree/pull/362)
applying non-from-scratch deltas fail when using parent_repo such as
in the system-helper case. We fix this temporarily by disabling the
use of deltas for that case.
This gives the application full access to the host /dev. Obviously
this is not great in terms of sandboxing, but its nice for applications
that use flatpak mostly as a way to do distribution of the app.
Also, its not like the app has full access to anything, its still
limited to the access right of the user.
In a minimal environment (like the one where we run installed-tests
in Debian), we might not have /usr/share/fonts.
Signed-off-by: Simon McVittie <smcv@debian.org>
This has several improvements:
* Writes to a temporary location and renames at the end, so
we never end up with partial checkouts.
* Don't fsync each file during checkout, instead syncfs() at
the end
* Pre-create the target deployment directory so that we get the right
permissions for it.
For a local (file:// uri) remote, do an (untrusted) direct pull instead
of pulling into the users cached repo first. This way we do less copies,
as well as guaranteeing the source of the data. The later means its
mostly safe to also allow this for non-gpg signed remotes.
ostree_repo_remote_fetch_summary can set out_summary to NULL but
still return TRUE according to the documentation, so don't assume
that *out_summary will always be set.
We need an actual active installation, not just the base directory.
This caused a failure if the user had tried to install and app but the
installation failed. After that installation failed due to it claiming
to be installed, while uninstall failed due it it *not* being
installed.
We need to pass LD_LIBRARY_PATH as --setennv, because the setuid
helper strips that. We did this already for run, but this moves it
so its used by build too.
This regressed when we moved to bubblewrap. We need to always use
a direct bind for building, because it may not necessarily happen
in a real user session where the session-helper works.
Alexander Larsson