<div dir="ltr"><div>Thanks for the email</div><div><br></div><div>Concretely, moving the project to under <a href="https://github.com/flatpak/">https://github.com/flatpak/</a> is not any sort</div><div>of technical challenge - just needs someone with elevated permissions to do it.</div><div><br></div><div>The interesting question is if there's enough consensus on the whole approach.</div><div>Personally, I agree that something like xdg-native-messaging-proxy is better off</div><div>living in a separate service, given we have extensive knowledge on the issues</div><div>and design mishaps of the whole thing.</div><div><br></div><div>What I'd like to know is if Firefox folks would be open to changing their patches</div><div>slightly to it.</div><div><br></div><div>Does anybody else have thoughts on this?</div><div><br></div><div>With respect,</div><div>Georges</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Em ter., 8 de abr. de 2025 às 12:48, Jan Grulich <<a href="mailto:jgrulich@redhat.com">jgrulich@redhat.com</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Hi,</span></p><br><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">It’s been three years since the first </span><a href="https://github.com/flatpak/xdg-desktop-portal/pull/705" style="text-decoration:none" target="_blank"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(17,85,204);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap">pull request was made to add a portal for WebExtensions</span></a><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"> to xdg-desktop-portal. This version of the portal has been added to Ubuntu packages, but it has never been part of any xdg-desktop-portal release. Recently, there were attempts to push this portal forward, so </span><a href="https://github.com/flatpak/xdg-desktop-portal/pull/1537" style="text-decoration:none" target="_blank"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(17,85,204);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap">a new pull request was opened</span></a><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">, keeping the same portal API, just the code was rebased and updated with some additional fixes, but ended up in the same situation → not being MERGED. This sparked some discussion about whether such a portal should be part of xdg-desktop-portal at all. </span><a href="mailto:sewick@redhat.com" style="text-decoration:none" target="_blank"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(17,85,204);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap">Sebastian Wick</span></a><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"> </span><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">had the idea to create a separate small service and called it </span><a href="https://github.com/swick/xdg-native-messaging-proxy" style="text-decoration:none" target="_blank"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(17,85,204);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap">xdg-native-messaging-proxy</span></a><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">. This service takes the core of the original portal for WebExtensions, but exposes it on a bus address which only is accessible to sandboxed apps if they declare talk permission via their manifest and thus get marked as potentially unsafe. This addresses the concerns that the xdg-desktop-portal APIs are supposed to be secure for sandboxed applications. </span></p><br><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">It seems the consensus is to go with the separate xdg-native-messaging-proxy service, and the original portal will never officially be part of xdg-desktop-portal, so I would like to propose moving xdg-native-messaging-proxy under the flatpak project. The reason for this is that I would like to make this the "official" solution, and having it as someone else's project won't get applications to start adopting it. Also an official Flatpak project will likely get more contributors, reviews and bugs. We're also stuck with the adoption of the xdg-native-messaging-proxy on the Firefox side, where unfortunately </span><a href="https://phabricator.services.mozilla.com/D140803" style="text-decoration:none" target="_blank"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(17,85,204);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap">the original portal support was merged in</span></a><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">, although it was never anything official and is unlikely to be changed and reviewed until we get a clear upstream decision.</span></p><br><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">What are your thoughts on this proposal? What would be the necessary steps if we decide to move forward with integrating xdg-native-messaging into the Flatpak project?</span></p><br><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Regards,</span></p><p dir="ltr" style="line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Jan Grulich</span></p><br><br><br></div>
</blockquote></div>