Flatpak: let a UnifiedPush distributor see and start the app #13

Closed

asxpi wants to merge 0 commits from asxpi/anotherim-js:fix/flatpak-unifiedpush into develop

asxpi commented

2026-10-16 06:54:32 +00:00

First-time contributor

1. The sandbox could not see a distributor. The shell finds one with ListNames on the session bus (org.unifiedpush.Distributor.*, src-tauri/src/unifiedpush.rs). Flatpak's bus proxy lists and passes only the names the app may talk to, and the manifest granted none for a distributor. Adds --talk-name=org.unifiedpush.Distributor.* to finish-args.

2. The D-Bus activation could not start the app. flatpak/im.another.messenger.service had Exec=/usr/bin/flatpak run --command=anotherim im.another.messenger --unifiedpush. A Flatpak app's service file names the command inside the sandbox, and flatpak wraps it on export in its own flatpak run --command=<first word>. So the exported file ran /usr/bin/flatpak inside the sandbox, which doesn't exist on any distro:

flatpak: bwrap: execvp /usr/bin/flatpak: No such file or directory
dbus-:1.1-im.another.messenger@0.service: Failed with result 'exit-code'
kunifiedpush-distributor: Could not activate remote peer 'im.another.messenger': unit failed

Exec is now anotherim --unifiedpush. The export turns it into the host's own line, here /run/current-system/sw/bin/flatpak run --branch=master --arch=x86_64 --command=anotherim im.another.messenger --unifiedpush; on a distro with flatpak in /usr/bin it is /usr/bin/flatpak run ….

Checked on GNOME (NixOS) with KUnifiedPush 26.04 on KDE's default ntfy server, local Flatpak build of 0.5.2:

The app registers with the distributor.
A D-Bus Ping to im.another.messenger starts it hidden.
With the app closed, a message to an account whose server offers push woke it (the distributor received the push, then dbus-:1.1-im.another.messenger@3.service started), and the message was announced.

Until a release carries this, flatpak override --user --talk-name='org.unifiedpush.Distributor.*' im.another.messenger fixes the first half for an installed build. The second half needs the new build.

🤖 Generated with Claude Code

Push never reached the Flatpak build: the app said "No UnifiedPush distributor is running on this desktop" with one running, and once it could see one, a push could not start it. The official 0.5.2 Flatpak has both problems. **1. The sandbox could not see a distributor.** The shell finds one with `ListNames` on the session bus (`org.unifiedpush.Distributor.*`, `src-tauri/src/unifiedpush.rs`). Flatpak's bus proxy lists and passes only the names the app may talk to, and the manifest granted none for a distributor. Adds `--talk-name=org.unifiedpush.Distributor.*` to `finish-args`. **2. The D-Bus activation could not start the app.** `flatpak/im.another.messenger.service` had `Exec=/usr/bin/flatpak run --command=anotherim im.another.messenger --unifiedpush`. A Flatpak app's service file names the command inside the sandbox, and flatpak wraps it on export in its own `flatpak run --command=<first word>`. So the exported file ran `/usr/bin/flatpak` inside the sandbox, which doesn't exist on any distro: ``` flatpak: bwrap: execvp /usr/bin/flatpak: No such file or directory dbus-:1.1-im.another.messenger@0.service: Failed with result 'exit-code' kunifiedpush-distributor: Could not activate remote peer 'im.another.messenger': unit failed ``` `Exec` is now `anotherim --unifiedpush`. The export turns it into the host's own line, here `/run/current-system/sw/bin/flatpak run --branch=master --arch=x86_64 --command=anotherim im.another.messenger --unifiedpush`; on a distro with flatpak in `/usr/bin` it is `/usr/bin/flatpak run …`. **Checked** on GNOME (NixOS) with KUnifiedPush 26.04 on KDE's default ntfy server, local Flatpak build of 0.5.2: - The app registers with the distributor. - A D-Bus `Ping` to `im.another.messenger` starts it hidden. - With the app closed, a message to an account whose server offers push woke it (the distributor received the push, then `dbus-:1.1-im.another.messenger@3.service` started), and the message was announced. Until a release carries this, `flatpak override --user --talk-name='org.unifiedpush.Distributor.*' im.another.messenger` fixes the first half for an installed build. The second half needs the new build. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

asxpi added 1 commit

2026-10-16 06:54:32 +00:00

flatpak: let a UnifiedPush distributor see and start the app fe4820a35c

Push never reached the Flatpak build, for two reasons.

The sandbox's bus proxy lists and passes only the names the app may
talk to, and none was granted for a distributor, so the shell's
ListNames found none and the app reported "no UnifiedPush
distributor" whatever ran on the desktop. Add
--talk-name=org.unifiedpush.Distributor.*.

And the exported D-Bus service could not start it. Its Exec named
"/usr/bin/flatpak run --command=anotherim ...", but flatpak treats a
service file's Exec as the command inside the sandbox and wraps it
on export in its own "flatpak run --command=<first word>", so the
activation ran /usr/bin/flatpak inside the sandbox, where it is not:
"bwrap: execvp /usr/bin/flatpak: No such file or directory", and the
distributor's "Could not activate remote peer 'im.another.messenger':
unit failed". Exec is now "anotherim --unifiedpush", which the export
turns into the host's own flatpak run line.

Checked on GNOME with KUnifiedPush: the app registers with the
distributor, a D-Bus Ping starts it hidden, and a message sent while
it was closed woke it and was announced.

Assisted-by: Claude:opus-5-5

ann referenced this pull request from a commit

2026-10-16 08:48:53 +00:00

Merge PR #13: Flatpak lets a UnifiedPush distributor see and start the app (fix/flatpak-unifiedpush, fe4820a3). The manifest grants --talk-name=org.unifiedpush.Distributor.*, without which the bus proxy listed no distributor and push read "no distributor" on every desktop; and the D-Bus service file names the command inside the sandbox (anotherim --unifiedpush), since flatpak wraps it on export with the host's own flatpak run, whereas naming /usr/bin/flatpak made every activation fail inside the sandbox.

ann commented

2026-10-16 08:50:02 +00:00

Owner

Reviewed and merged into develop by hand with merge commit ab9c1fc9, released in 0.5.6 (v0.5.6 = 33b27872, https://dev.another.im/another-im/anotherim-js/releases/tag/v0.5.6). The forge does not mark a hand merge as merged, so this PR is closed here.

Reviewed and merged into develop by hand with merge commit ab9c1fc9, released in 0.5.6 (v0.5.6 = 33b27872, https://dev.another.im/another-im/anotherim-js/releases/tag/v0.5.6). The forge does not mark a hand merge as merged, so this PR is closed here.

ann closed this pull request

2026-10-16 08:50:02 +00:00

ann referenced this pull request from a commit

2026-10-27 13:09:52 +00:00

The remaining Lows of the final anotherim-js audit of 2026-10-27 (/data/another-im/audit-2026-10-27-final-anotherim-js.md): XEP-0439 actions are not drawn in rooms (#12: rowActions(m, room), message-row passes showNick, which both callers set from the chat's groupchat; libtacky refuses the press there and any occupant could draw buttons; whether action-selected goes out encrypted in an OMEMO chat is F2's libtacky half), a quick response chip shows the value it sends after its label whenever the two differ but for case and spacing (#13: XEP-0439 sends the value and only shows the label, so the new shownValue keeps the XEP and the reader sees the words before they go), isReportable is false for a room occupant's private chat since Blocking keeps bare JIDs and would block and report the whole room (#17, the safe one of the two choices), a vCard's tel: link carries data-ask and the link guard asks "Call {number}?" / "This opens {number} in your phone or calling app." before the opener in the shells and in a tab alike (#18), the desktop shell's openable hands a TEL: link on as tel: (#21, now a Cow), a gateway's auto-approved contact is added with no roster name instead of the subscribe nick (#19: their nick is their word, the name drawn then comes from their vCard or nick as theirs), and localHost, the page's sticker gate, also refuses a single-label host and names under .local, .localdomain, .home.arpa, .internal, .lan, .home, .intranet, .corp and .private, with the browser edition's remaining gap (a public-looking name resolving to a private address) documented at the function (#20). New strings in en, ru, uk, et and es; CHANGELOG Unreleased has a Security block naming the audit ids. Tests that failed before the fix (9 of them): quick-responses (rowActions in a room, shownValue, the chip showing "Large one Large"), report-spam (PM not reportable), requests (gateway contact added without a name), transfers (localHost local names), os-links (the tel question), links-cov (a data-ask tel opens through the question in a tab), vcard-profiles (tel link has data-ask); links.rs a_tel_scheme_in_upper_case_is_handed_on_in_lower_case. make -o audit check STRICT=1 clean (2110 keys), make test-ui 384 files 4246 passed 8 skipped, make test-shell ok, WebKit smoke 6769 ok with the contact info and profile card screens, its 4 FAILs the stale Android lock-line checks b1bdb10a fixed on develop.