Flatsonar

Atomic Basejump

by Joshua Roman

Manage rpm-ostree deployments and base images on Fedora Atomic

Dangerous permissions Suspicious publisher GPL-3.0-or-later v0.9
Install Source code

About

Atomic Basejump is a desktop application for managing rpm-ostree system deployments and OCI base images on Fedora Atomic desktops (Kinoite, Aurora, Bazzite, Silverblue, and related images). It ships dual native frontends — Kirigami (Plasma) and Libadwaita (GNOME) — selected by desktop environment or user preference, sharing a single Python core. Status and deployment lists come from the system D-Bus interface of rpm-ostreed. System mutations (upgrade, rebase, rollback, pin, package layers) run host rpm-ostree / ostree via the Flatpak portal so transactions complete outside the sandbox. This application is therefore a system utility and is not intended for strict-sandbox catalogs such as Flathub without host access.

Permissions

6 permissions weaken the sandbox. Flatsonar asks before installing.

  • unrestricted access to the system D-Bus (system services, hardware)
    --socket=system-bus
  • sandbox escape: can run commands on the host via flatpak-spawn
    --talk-name=org.freedesktop.Flatpak
  • full access to your entire file system
    --filesystem=host
  • talks to system service org.projectatomic.rpmostree1
    --system-talk-name=org.projectatomic.rpmostree1
  • session management (logout, suspend)
    --system-talk-name=org.freedesktop.login1
  • owns desktop name org.kde.StatusNotifierItem.*: can impersonate a desktop component
    --own-name=org.kde.StatusNotifierItem.*
  • Wayland display
    --socket=wayland
  • X11 display, only when Wayland is unavailable
    --socket=fallback-x11
  • GPU acceleration
    --device=dri
  • network
    --share=network
  • system tray
    --talk-name=org.kde.StatusNotifierWatcher
  • notifications
    --talk-name=org.freedesktop.Notifications

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • io.github.joshuaroman.AtomicBasejump claims the io.github.joshuaroman namespace but is hosted by github.com/joshuaeroman and does not build the owner's code
    publisher:namespace
  • repository is 38 day(s) old with 0 star(s): no track record yet
    publisher:new-repo

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.