Flatsonar

spice-up-flatpak

by nedrichards

Flatpak recipe for the Spice Up presentation program

Dangerous permissions Suspicious publisher MIT
Install Source code

About

Flatpak recipe for the Spice Up presentation program

Permissions

5 permissions weaken the sandbox. Flatsonar asks before installing.

  • all devices (/dev): webcams, disks, raw hardware
    --device=all
  • unrestricted access to the session D-Bus (all your running apps)
    --socket=session-bus
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • full access to your home folder
    --filesystem=home
  • dconf: all GNOME settings
    --talk-name=ca.desrt.dconf
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • access to xdg-run/dconf
    --filesystem=xdg-run/dconf
  • access to ~/.config/dconf
    --filesystem=~/.config/dconf:ro
  • sets environment variable DCONF_USER_CONFIG_DIR
    --env=DCONF_USER_CONFIG_DIR=.config/dconf

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • com.github.philipscott.spiceup claims the com.github.philipscott namespace but is hosted by github.com/nedrichards and does not build the owner's code
    publisher:namespace
  • fetches from kernel.org over unencrypted http: anyone on the path can swap the bytes
    source:insecure-url

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.