Move xdg-native-messaging-proxy under Flatpak project

[Bartłomiej Piotrowski]

I'm fine with moving it (as someone with said permissions) if you are, 
just give me a heads-up. Sebastian will also have to give me admin 
permissions to his repo to retain issues/PRs information.

Bart

On 09/04/2025 20:10, Georges Basile Stavracas Neto wrote:
> Thanks for the email
> 
> Concretely, moving the project to under https://github.com/flatpak/ 
> <https://github.com/flatpak/> is not any sort
> of technical challenge - just needs someone with elevated permissions to 
> do it.
> 
> The interesting question is if there's enough consensus on the whole 
> approach.
> Personally, I agree that something like xdg-native-messaging-proxy is 
> better off
> living in a separate service, given we have extensive knowledge on the 
> issues
> and design mishaps of the whole thing.
> 
> What I'd like to know is if Firefox folks would be open to changing 
> their patches
> slightly to it.
> 
> Does anybody else have thoughts on this?
> 
> With respect,
> Georges
> 
> Em ter., 8 de abr. de 2025 às 12:48, Jan Grulich <jgrulich at redhat.com 
> <mailto:jgrulich at redhat.com>> escreveu:
> 
>     Hi,
> 
> 
>     It’s been three years since the first pull request was made to add a
>     portal for WebExtensions
>     <https://github.com/flatpak/xdg-desktop-portal/pull/705>to
>     xdg-desktop-portal. This version of the portal has been added to
>     Ubuntu packages, but it has never been part of any
>     xdg-desktop-portal release. Recently, there were attempts to push
>     this portal forward, so a new pull request was opened
>     <https://github.com/flatpak/xdg-desktop-portal/pull/1537>, keeping
>     the same portal API, just the code was rebased and updated with some
>     additional fixes, but ended up in the same situation → not being
>     MERGED. This sparked some discussion about whether such a portal
>     should be part of xdg-desktop-portal at all. Sebastian Wick
>     <mailto:sewick at redhat.com>had the idea to create a separate small
>     service and called it xdg-native-messaging-proxy
>     <https://github.com/swick/xdg-native-messaging-proxy>. This service
>     takes the core of the original portal for WebExtensions, but exposes
>     it on a bus address which only is accessible to sandboxed apps if
>     they declare talk permission via their manifest and thus get marked
>     as potentially unsafe. This addresses the concerns that the
>     xdg-desktop-portal APIs are supposed to be secure for sandboxed
>     applications.
> 
> 
>     It seems the consensus is to go with the separate
>     xdg-native-messaging-proxy service, and the original portal will
>     never officially be part of xdg-desktop-portal, so I would like to
>     propose moving xdg-native-messaging-proxy under the flatpak project.
>     The reason for this is that I would like to make this the "official"
>     solution, and having it as someone else's project won't get
>     applications to start adopting it. Also an official Flatpak project
>     will likely get more contributors, reviews and bugs. We're also
>     stuck with the adoption of the xdg-native-messaging-proxy on the
>     Firefox side, where unfortunately the original portal support was
>     merged in <https://phabricator.services.mozilla.com/D140803>,
>     although it was never anything official and is unlikely to be
>     changed and reviewed until we get a clear upstream decision.
> 
> 
>     What are your thoughts on this proposal? What would be the necessary
>     steps if we decide to move forward with integrating
>     xdg-native-messaging into the Flatpak project?
> 
> 
>     Regards,
> 
>     Jan Grulich
> 
> 
> 
>