Sebastian Wick

We will have the same problem with webauthn/fido where an app should not be able to access any credentials but only ones scoped to itself or specific remotes (hosts basically)....

Okay, but how does the calling app know which is not the evil app? The calling app must understand both the URL and that one specific app that should then...

I think someone needs to create and adjust the permissions on the xdg-desktop-portal-build container package in the flatpak org. edit: mh, it seems like we can't make the package free-for-all?...

The whole mechanism to build the container is a bit meh. While working on something unrelated I had a look at it and created a mechanism that's closer to FDO/gnome...

Yes, and that is on purpose. The idea here is that if someone works on a branch they might need to adjust the image for CI to pass. Having a...

Besides the image rebuild logic this MR LGTM.

Sure, the image always had the latest dependencies, but because it was always build it also means that it had exactly the image that one wanted on a specific branch.

LGTM. Even though portals are versioned and this isn't really required, this makes it much nicer for apps to use. e: I'll redact this. The notifications test is crashing. This...

Probably just some environment variable to override the icon_validator executable path that you set in test-portals.c and the python test framework.

Might want to take a look at https://github.com/flatpak/xdg-desktop-portal/pull/1309/commits. If the env var is only for testing then we probably want the names to be consistent (`XDG_DESKTOP_PORTAL_TEST_VALIDATE_ICON` or something like that)....