Unhelpful flathub finish-args-unnecessary-xdg-config-access error

[Hubert Figuière]

On 2023-12-21 15:34, Stephan Bergmann wrote:
> A recent org.libreoffice.LibreOffice PR test build at 
> <https://buildbot.flathub.org/#/builders/6/builds/89263> suddenly 
> started to fail in a "Validate manifest" step with

This is NOT the list for flathub (there is no list for flathub), and 
this problem isn't flatpak.

These error are documented there:
https://docs.flathub.org/docs/for-app-authors/linter/

The check used to be broken so it was recently fixed.

I recommend to file for an exception:
https://docs.flathub.org/docs/for-app-authors/linter/#exceptions

> 
>> flatpak run --command=flatpak-builder-lint org.flatpak.Builder 
>> --exceptions manifest org.libreoffice.LibreOffice.json
>>  in dir /srv/buildbot/worker/build-aarch64-7/build (timeout 1200 secs)
>>  watching logfiles {}
>>  argv: b'flatpak run --command=flatpak-builder-lint 
>> org.flatpak.Builder --exceptions manifest 
>> org.libreoffice.LibreOffice.json'
>>  using PTY: False
>> {
>>     "errors": [
>>         "finish-args-unnecessary-xdg-config-access"
>>     ]
>> }
>> program finished with exit code 1
>> elapsedTime=0.907696
> 
> Now, my guess would be that it wants to complain about any of the three 
> lines at 
> <https://github.com/flathub/org.libreoffice.LibreOffice/blob/bf0eb94c248865432fbdb9283b2407f179afe9f9/org.libreoffice.LibreOffice.json#L828>,
> 
>>         "--filesystem=xdg-config/gtk-3.0",
> 
> (once added with 
> <https://github.com/flathub/org.libreoffice.LibreOffice/commit/e2376fbfdb12b9fca44c9413d08f2ed35b7b3d2f> " Adding access to gtk-3.0 config, mainly to give access to bookmarks for the file picker")
> 
>>         "--filesystem=xdg-config/fontconfig:ro",
> 
> (once added with 
> <https://github.com/flathub/org.libreoffice.LibreOffice/commit/c80b412af7ec1d15b49c64ec6590450e9bacd3f2> " fix missing user-installed fonts")

Access to `xdg-config` is problematic in general because it means 
breaking the sandboxing, and often just wrong.

Just file an exception, I'll make sure it gets deployed quickly.

> 
>>         "--filesystem=xdg-run/gvfsd",
> 
> (once added with 
> <https://github.com/flathub/org.libreoffice.LibreOffice/commit/4226084c374eac66c520837a81c517a98541543d> "Adding xdg-run/gvfsd").
> 
> But which of those three lines (if any) are supposed to be problematic, 
> and why?
> 

This one is NOT xdg-config. It's also a standard permission for gvfs. So 
it's not relevant here.


Hub