Flatsonar

Kleopatra

by KDE

Certificate manager and cryptography app

Dangerous permissions Verified creator GPL-2.0+ v26.04.2
Install Source code

Support the creators

Flatsonar is just the shop window. The people below made Kleopatra.

Donate
Screenshot 1 of Kleopatra Screenshot 2 of Kleopatra Screenshot 3 of Kleopatra Screenshot 4 of Kleopatra

About

Kleopatra is an open-source certificate manager and graphical front-end for cryptographic services, primarily designed to handle OpenPGP and S/MIME (X.509) certificates. Part of the KDE ecosystem, it provides an accessible interface for managing encryption keys, signing and verifying data, and encrypting or decrypting files and emails.

Permissions

3 permissions weaken the sandbox. Flatsonar asks before installing.

  • access to a sensitive location (~/.gnupg): credentials or autostart
    --filesystem=~/.gnupg:create
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • owns desktop name org.kde.kwatchgnupg: can impersonate a desktop component
    --own-name=org.kde.kwatchgnupg
  • network
    --share=network
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • X11 display, only when Wayland is unavailable
    --socket=fallback-x11
  • GPU acceleration
    --device=dri
  • access to xdg-run/gnupg
    --filesystem=xdg-run/gnupg:ro
  • access to xdg-config/kdeglobals
    --filesystem=xdg-config/kdeglobals:ro
  • talks to com.canonical.AppMenu.Registrar
    --talk-name=com.canonical.AppMenu.Registrar
  • talks to org.kde.kconfig.notify
    --talk-name=org.kde.kconfig.notify
  • talks to org.kde.KGlobalSettings
    --talk-name=org.kde.KGlobalSettings
  • system tray
    --talk-name=org.kde.StatusNotifierWatcher

Who publishes this

The creator demonstrably controls this app id: Flathub verification, the hosting account owns the namespace, or a well-known file on their domain.

  • fetches from www.jabberwocky.com over unencrypted http: anyone on the path can swap the bytes
    source:insecure-url
  • verified on Flathub: the developer proved they control this app id
    publisher:flathub

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.