xdg-desktop-portal-gtk VS flatpak-cve-checker

I came across this, could this be playing a role? If it fixes Fedora 37 then it would be a clue and perhaps then the package could enter the string itself? https://github.com/flatpak/xdg-desktop-portal-gtk/issues/72

However, the actual dialogs and access points are provided by a backend, which differs from what desktop are you using. For example, Gnome uses xdg-desktop-portal-gtk, KDE uses xdg-desktop-portal-kde and so on.\ If there is an issue with the implementation of an portal, you need to find the backend you use and report it to them.

Is the Web search provider enabled in Settings? Those can apparently trigger background detection: https://github.com/flatpak/xdg-desktop-portal-gtk/issues/293

That sounds like https://github.com/flatpak/xdg-desktop-portal-gtk/issues/137

gui-libs/xdg-desktop-portal-lxqt Available versions: 0.2.0 Homepage: https://lxqt-project.org/ Description: Backend implementation for xdg-desktop-portal using Qt/KF5/libfm-qt gui-libs/xdg-desktop-portal-wlr Available versions: 0.4.0(0/9999) 0.5.0(0/9999) ~0.6.0(0/9999) **9999(0/9999)*l {elogind systemd} Homepage: https://github.com/emersion/xdg-desktop-portal-wlr Description: xdg-desktop-portal backend for wlroots [I] kde-plasma/xdg-desktop-portal-kde Available versions: (5) 5.24.6 ~5.25.4 {debug} Installed versions: 5.24.6(5)(01:02:06 07/29/22)(-debug) Homepage: https://kde.org/plasma-desktop Description: Backend implementation for xdg-desktop-portal that is using Qt/KDE Frameworks [I] sys-apps/xdg-desktop-portal Available versions: 1.14.6 {geolocation screencast systemd} Installed versions: 1.14.6(20:25:44 08/27/22)(-geolocation -screencast -systemd) Homepage: https://flatpak.org/ https://github.com/flatpak/xdg-desktop-portal Description: Desktop integration portal sys-apps/xdg-desktop-portal-gnome Available versions: 42.3 {X wayland} Homepage: https://gitlab.gnome.org/GNOME/xdg-desktop-portal-gnome Description: Backend implementation for xdg-desktop-portal using GNOME sys-apps/xdg-desktop-portal-gtk Available versions: 1.8.0 1.14.0 {X wayland} Homepage: https://flatpak.org/ https://github.com/flatpak/xdg-desktop-portal-gtk Description: Backend implementation for xdg-desktop-portal using GTK+ Found 6 matches

you still xdg-desktop-portal-wlr in sway for screen sharing. the purpose of the gtk portal on non-gnome setups is to pass through some gtk settings (e.g. fontconfig, aliasing, gtk theme) to flatpak apps. your gtk flatpak apps won't follow the system theme and fontconfig unless you have the xdg-desktop-portal-gtk installed. right now it's borked though see below for more details - https://bugs.archlinux.org/task/72686?project=1&string=xdg-desktop-portal-gtk - https://github.com/flatpak/xdg-desktop-portal-gtk/issues/360

Parsing the manifest for vulns is doable. Here I wrote one: https://github.com/TingPing/flatpak-cve-checker

If Debian (or whatever org/group/project/initiative that) provides the images has a security policy, they can extend that to the images too.

Users don't run CVE checkers [0], at best they reluctantly click on the update button. Of course the authoritarian evergreen auto-update thing is what actually works in practice.

For example as much as snap's UX sucks it does auto update by default.

[0] Though they could, as files in container images are trivially accessible, after all it's their purpose. Plus there are metadata based approaches: https://github.com/TingPing/flatpak-cve-checker (plus the Flatpak project already spends some energy on ensuring that the base image is chechekd against CVEs https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/jobs/18... ) of course duplicating this effort, and building a parallel world besides packages is not ideal, but