Flatsonar

Showdown

by Craig Barnes

Simple Markdown viewer

Broad permissions Suspicious publisher GPL-3.0
Install Source code
Screenshot 1 of Showdown

About

Showdown is a simple application for rendering and viewing Markdown files.

Permissions

2 permissions weaken the sandbox. Flatsonar asks before installing.

  • read-only access to your entire file system
    --filesystem=host:ro
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • inter-process communication (needed for X11)
    --share=ipc
  • network
    --share=network
  • X11 display, only when Wayland is unavailable
    --socket=fallback-x11
  • Wayland display
    --socket=wayland
  • GPU acceleration
    --device=dri

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • io.gitlab.craigbarnes.Showdown claims the io.gitlab.craigbarnes namespace but is hosted by github.com/craigbarnes and does not build the owner's code
    publisher:namespace
  • fetches from github.com over unencrypted git: anyone on the path can swap the bytes
    source:insecure-url
  • git source tracks a moving branch: what gets built can change without the manifest changing
    source:unpinned

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.