Profile format standardization

[mgord9518]

Hello, I maintain a project called aisap, which seems to have similar goals in mind, but is targeted at AppImages instead of traditionally-installed applications. In this thread, I would like to discuss a standard layout for application profiles that our projects could share in order to allow a seamless experience for users and possible future projects which may also want to utilize a simple profile system. I have written over 100 profiles for aisap, and I would love to see them easily usable for their non-AppImage counterparts

Asiap's profile system appears to be very similar to bubblejail's, so I believe both projects would be able to make a switch fairly easily if everyone is on board.

Some initial thoughts:

• Both user and system-wide configuration
• Simple parsing: bubblejail already uses TOML, which is good and I would have no issue switching but maybe we could also discuss pros and cons of other formats? aisap's current solution is using an additional section in the desktop file (INI). JSON is another good option, while not being as readable as TOML would have the advantage of being parseable from pretty much any language in existence
• Generic profile location that isn't necessarily bound to a single project. Maybe something like ~/.config/application_profiles?
• Formally-defined permissions with clear explanations, which we can also discuss here

I'm eager to hear feedback and further ideas if willing to discuss.

[igo95862]

Hello @mgord9518

While this sounds attractive I believe this will only slow down the development of our projects. We already have a divergent permission system.

Instead we can exchange the knowledge of how to sandbox different resources.

For example, it looks like your X11 code does not account for multiple X displays environments. Multiple X displays is not the same as single X display spanning multiple screens.

https://github.com/mgord9518/aisap/blob/44ea1c3e6b01d761df9227c2b4665aa6fe917e02/wrap.go#L282

The 'unix/:0.0' is actually equivalent to :0 and both should resolve to /tmp/.X11-unix/X0.

See #54

[igo95862]

Also running bubblejail with AppImage was requested for a long time: #8

[mgord9518]

@igo95862 Thanks for the tip about multiple X11 displays, I'll have to investigate.

As far as the profile system, aisap is still in alpha and I do not believe a revamp of the profile system would slow it down if it meant future users could use the same tooling for both of our projects.

I understand if a reworking of your profile system is impractical, in which case I'll probably just end up allowing aisap to import bubblejail profiles.

Is running AppImages through bubblejail a planned feature? I took a quick scroll through that thread, finding the AppImage offset is pretty trivial and should be very easy to do in Python, I guess the main issue is the reliance on FUSE.

[igo95862]

As far as the profile system, aisap is still in alpha and I do not believe a revamp of the profile system would slow it down if it meant future users could use the same tooling for both of our projects.

I understand if a reworking of your profile system is impractical, in which case I'll probably just end up allowing aisap to import bubblejail profiles.

I am skeptical how much profiles can be shared between our projects.

For example, bubblejail uses Desktop Entries a lot. Each profile has to contain the desktop entry name that is expected to be present in the file system. The AppImage as I believe is a self contained application.

A knowledge base of what resources there are and what resource each application might require would probably be helpful for both projects. (just like that X11 example I gave)

Is running AppImages through bubblejail a planned feature? I took a quick scroll through that thread, finding the AppImage offset is pretty trivial and should be very easy to do in Python, I guess the main issue is the reliance on FUSE.

It is in a very very long backlog primarily because I don't personally use AppImages. However, many people expressed interest in running the AppImages sandboxes.

[mgord9518]

@igo95862 I've thought about this a bit. While it wouldn't be practical to try to detect what AppImage is being referred to by a bubblejail profile, I would be able to add tool options to interpret the actual permissions.

For the CLI, it would probably just be aisap application.AppImage --profile /my/profile/path.toml. Aisap already has a flag to import profiles, so it would just have to interpret them differently depending on the file extension/contents.

I've also been messing with a GUI tool and it would essentially be the same thing. Click on the AppImage in the interface and there would be an option to configure its permissions from file

[mgord9518]

But I definitely agree on sharing profile information. In the next few months I'll try to make some good documentation on the flags aisap passes and we could share issues as I'm sure plenty of them we have experienced are in common. One big issue I'm interested in tackling is file portals, it seems to be hard to find documentation about exactly how flatpak does it

[igo95862]

There is a portal documentation: https://flatpak.github.io/xdg-desktop-portal/

I actually developed my own Python D-Bus library that I plan to use in bubblejail: https://github.com/python-sdbus/python-sdbus