[packagekit] libpackagekit-gnome

[Richard Hughes]

On Mon, 2008-04-14 at 13:09 -0400, David Zeuthen wrote:
> No, that won't work - there's a ton of attack vectors. My point isn't
> to try and secure the PackageKit UI tools right now; that's a separate
> thing. My point is simply that you don't want libpackagekit-gnome; you
> want a D-Bus service instead. What do you think about that?

I don't think so - I think the issues are orthogonal. If we use a dbus
service then we loose the auth-per-application feature. Then is there is
an exploit, we are then double screwed.

I do understand why it would help however, but applications don't want
to add packagekit-gnome DBUS API and then depend on a git version of
packagekit so they can install extensions for MyLeetApp

Applications typically want "get this: /usr/share/clipart/ponies.png" -
they don't want all the junk with doing GPK hacking.

Doing per-app interfaces seems like a metric ton of work, when other
apps know exactly what they want.

Richard.