Flatsonar

Flatpak Builder Flatpak

by Flatpak and Flathub contributors

Flatpak Builder Flatpak (org.flatpak.Builder)

Dangerous permissions Suspicious publisher LGPL-2.1-only vv0-Flathub
Install Source code

About

This package provides a Flatpak copy of Flatpak Builder. This is primarily meant to be used for Flathub submissions and infrastructure and as such will follow the requirements of Flathub, but it can be useful for general use as well.

It also includes some other tools such as flat-manager-client and flatpak-builder-lint.

Please refer to the Flathub submission docs on how to use this to build Flatpaks for Flathub: https://docs.flathub.org/docs/for-app-authors/submission#build-and-install

The package is continuously updated and deployed from the master branch of the manifest repository. Refer to the manifest to check the latest versions of the included components.

Please refer to the individual components for details about their respective licenses.

Permissions

3 permissions weaken the sandbox. Flatsonar asks before installing.

  • full access to your entire file system
    --filesystem=host
  • sandbox escape: can run commands on the host via flatpak-spawn
    --talk-name=org.freedesktop.Flatpak
  • development features (ptrace, can inspect other processes in its sandbox)
    --allow=devel
  • network
    --share=network
  • access to /var/lib/flatpak
    --filesystem=/var/lib/flatpak
  • access to xdg-data/flatpak
    --filesystem=xdg-data/flatpak

Who publishes this

Something concrete is wrong: the id claims a namespace this repository does not own, or the build does things a build should not. Flatsonar warns twice.

  • runs commands on the host during the build: FLATPAK_BINARY=$(flatpak-spawn --host which flatpak 2> /dev/null) export FLATPAK_BINARY export FLATPAK_USER_DIR=$HOME/.l
    source:command
  • git source tracks a moving branch: what gets built can change without the manifest changing
    source:unpinned
  • verified on Flathub: the developer proved they control this app id
    publisher:flathub

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.