From db229deaef3b0c88f9930bd168e1779f7a4c6074 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 13 May 2026 13:43:25 +0100 Subject: feat(flatpak): sandbox zathura + add mpv hybrid for browser/mail handoffs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Defense-in-depth for the cross-sandbox handoff vector: when the LibreWolf/Thunderbird flatpaks open a downloaded PDF or video via the OpenURI portal, the receiving app currently runs natively with full $HOME access — defeating part of the browser/mail isolation. - meta/flatpak.txt: add org.pwmt.zathura, io.mpv.Mpv - meta/wayland.txt: drop native zathura + zathura-pdf-mupdf - meta/media.txt: keep native mpv (streamlink, /tmp/mpvsocket IPC, fast yt-dlp) — flatpak mpv is *additional*, only as the mimeapps default for video/audio to receive sandboxed handoffs - dot_config/mimeapps.list: rewrite mpv.desktop -> io.mpv.Mpv.desktop, zathura-pdf-mupdf.desktop -> org.pwmt.zathura.desktop, and replace stale userapp-Thunderbird-* entries with org.mozilla.Thunderbird.desktop - run_onchange_after_deploy-flatpak-overrides.sh.tmpl (new): --filesystem=xdg-config/{zathura,mpv}:ro so the flatpaks read our chezmoi-managed configs as a single source of truth - README: media row + new deploy-script row Manual one-shot on host: chezmoi apply -v. The pteid bridge already iterates a flatpak app list, so cartão de cidadão remains correctly registered for the Mozilla flatpaks. Native mpv config (input-ipc-server) keeps working since each flatpak has its own /tmp; no socket collision. --- meta/media.txt | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'meta/media.txt') diff --git a/meta/media.txt b/meta/media.txt index 03a3d10..8e5b5c2 100644 --- a/meta/media.txt +++ b/meta/media.txt @@ -1,3 +1,7 @@ +# Native mpv is kept for streamlink piping and the /tmp/mpvsocket IPC +# integration; the io.mpv.Mpv flatpak (meta/flatpak.txt) is set as the +# mimeapps default for video/* so files handed off by the browser/mail +# sandbox stay sandboxed. mpv streamlink yt-dlp -- cgit v1.3.1