Flatsonar
Suspicious publisher

Curio

by Curio Contributors

A GUI Flatpak store

Extensive permissions Suspicious publisher
Install Source code

About

Curio is a GUI Flatpak store with search, install, update, and category browsing.

Permissions

5 permissions weaken the sandbox. Flatsonar asks before installing.

  • sandbox escape: can run commands on the host via flatpak-spawn
    --talk-name=org.freedesktop.Flatpak
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • access to unrecognised path 'home/.local/share/flatpak:create'
    --filesystem=home/.local/share/flatpak:create
  • talks to system service org.freedesktop.Flatpak.SystemHelper
    --system-talk-name=org.freedesktop.Flatpak.SystemHelper
  • authorisation (polkit)
    --system-talk-name=org.freedesktop.PolicyKit1
  • network
    --share=network
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • GPU acceleration
    --device=dri
  • access to /var/lib/flatpak
    --filesystem=/var/lib/flatpak
  • access to xdg-data/flatpak
    --filesystem=xdg-data/flatpak
  • access to ~/.var/app
    --filesystem=~/.var/app
  • access to /var/tmp
    --filesystem=/var/tmp

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • io.github.curio.Curio claims the io.github.curio namespace but is hosted by github.com/robojerk and does not build the owner's code
    publisher:namespace

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.