diff options
| author |  sommerfeld <sommerfeld@sommerfeld.dev> | 2026-05-13 13:43:24 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-05-13 13:43:24 +0100 |
| commit | 729087821785cfc4923a14a7aed633850119b723 (patch) | |
| tree | ce5705086772495c18f42f2760bf01bfabfce54f /meta | |
| parent | 68b1ffb42f7644b8a5f2275a16e94820b369818e (diff) | |
| download | dotfiles-729087821785cfc4923a14a7aed633850119b723.tar.gz dotfiles-729087821785cfc4923a14a7aed633850119b723.tar.bz2 dotfiles-729087821785cfc4923a14a7aed633850119b723.zip | |
feat(browser): migrate librewolf to flatpak for host-isolation
Move LibreWolf from native librewolf-bin to Flathub
io.gitlab.librewolf-community. Bubblewrap isolates the browser from
$HOME (\\.ssh, password-store, gnupg, ssh-agent socket) at the cost
of namespace chroot + IPC/network namespace isolation between content
processes (mozilla bug 1756236, P3, considered defense-in-depth).
seccomp-bpf — the dominant sandbox layer — is preserved.
- meta/flatpak.txt: + io.gitlab.librewolf-community
- meta/browser.txt: - librewolf-bin
- run_onchange_after_deploy-firefox.sh.tmpl: profile path moves to
~/.var/app/io.gitlab.librewolf-community/.librewolf
- dot_config/mimeapps.list: librewolf.desktop -> flatpak app id
- dot_local/bin/executable_linkhandler: flatpak run wrapper
- README.md: blurb + new profile path
arkenfox-user.js + chezmoi user-overrides.js deploy keep working
unchanged because the flatpak profile is still on the host fs.
Diffstat (limited to 'meta')
| -rw-r--r-- | meta/browser.txt | 1 | ||||
| -rw-r--r-- | meta/flatpak.txt | 1 |
2 files changed, 1 insertions, 1 deletions
diff --git a/meta/browser.txt b/meta/browser.txt index ca3eb1c..de2d297 100644 --- a/meta/browser.txt +++ b/meta/browser.txt @@ -1,2 +1 @@ arkenfox-user.js -librewolf-bin diff --git a/meta/flatpak.txt b/meta/flatpak.txt index 4f484ed..9635831 100644 --- a/meta/flatpak.txt +++ b/meta/flatpak.txt @@ -1,6 +1,7 @@ # Flathub app IDs. Managed by `just pkg-*` recipes via the magic # `flatpak` group name (see justfile). Installed with --user scope. +io.gitlab.librewolf-community org.chromium.Chromium org.kde.okular org.libreoffice.LibreOffice |