Bug 496733

Summary: KleverNotes should not exit the sandbox
Product: [Applications] KleverNotes Reporter: Yaakov Selkowitz <yselkowi>
Component: PluginsAssignee: Louis Schul <schul9louis>
Status: REPORTED ---    
Severity: normal    
Priority: NOR    
Version First Reported In: 1.1.0   
Target Milestone: ---   
Platform: Flatpak   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Yaakov Selkowitz 2024-11-27 02:17:52 UTC 
SUMMARY
KleverNotes currently uses `KSandbox` to call applications on the host to support the syntax highlighters and UML diagram plugins.  Instead, the necessary tools should be included in the flatpak (either directly, or as extensions).  This would make the app self-sufficient, not require the elevated `org.freedesktop.Flatpak` permission to break out of the sandbox, and not require the user to install additional software on their host.

If you concur, I can provide a patch which removes `KleverUtility::isFlatpak()` and all use of `KSandbox` which works for me in a locally built Fedora flatpak with the additional tools included.

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: on Fedora
KDE Plasma Version: 6.2.3
KDE Frameworks Version: 6.8.0
Qt Version: 6.8.0
Comment 1 Louis Schul 2024-11-27 08:56:31 UTC 
(In reply to Yaakov Selkowitz from comment #0)

Thanks for the suggestion but I'm opposed to it. 

Including them directly is a no go for me :
- Currently there's already 4 that should be included (3 syntax highlighter and PUML) that could be okay. But what if I want to support more highlighter or more external program where is the limit ? How big could this flatpak be ?
- KleverNotes is a note taking app which happen to support the use of external program. User should receive a note taking app and nothing else, if they want the rest they have the choice to download the other program, I wont force the rest.

Extensions:
The current system is the closest thing I was able to do to mimic extension without to much overhead. But if you're able to pull that off without exiting the sandbox and without including everything, I'm sold !

Side note:
- I have a feature on my list to let people use script (python, C, C++, whatever) to interact with the note. And I have a working proof of concept with the current system.

To sum things up:
- Including everything: You can forget that idea, I won't change my opinion about it.
- Having an extension system: The current one was an easy way to do it. I don't plan on changing it (at least now, who knows), but if you have the tools to do it, I would be happy to review the code.