AppImage sandboxing release with compatibility improvements
Testers needed
Please provide feedback and file any issues you find with apps not working properly in sandboxed environment
What's Changed
- feat(autostart): add a "Autostart on login" feature. Appplications built-in autostart options often fail due to AppImage mounted nature (see Bitwarden issue #21621 (0ac90cd)
- feat(sandbox): add a Screenshots permission toggle. Grant only org.freedesktop.portal.Screenshot calls on the filtered session bus so a tool can capture without handing the app the whole portal. (Test with Gradia) (9657d9c)
- fix(sandbox): disable the libadwaita settings portal on a filtered bus. The portal is hidden by the filtered session bus, so GTK4 apps lost the color scheme and accent color; ADW_DISABLE_PORTAL=1 makes libadwaita fall back to the ro-bound dconf. (bc2e528)
- fix(sandbox): search deeper for the Chromium sandbox helper. CEF apps like Karere nest chrome-sandbox in usr/lib/cef/, so raise the AppDir search depth to four and drop the --no-sandbox workaround for them. (47f9fec)
- fix(sandbox): add system authentication (polkit) permission toggle. Route CheckAuthorization through the filtered system bus, apply a narrow call rule set that refuses agent registration, and share host pids when granted so the caller check resolves. (c2cfb23)
- fix(sandbox): grant the freedesktop StatusNotifierItem tray names. Chromium and Electron register org.freedesktop.StatusNotifierItem--; without the rule the proxy refuses the name and the tray icon is dropped. (dd8ec9f)
- fix(sandbox): route app links through a bound FIFO to the host browser. xdg-open on PATH and a GIO default handler write http(s) URLs to a per-instance pipe the supervisor filters and opens outside the sandbox. (877b8fc)
- fix(sandbox): bind $TMPDIR at a stable host path for tray icons. Private /tmp makes Chromium's tray IconThemePath a dead path on GNOME; hash the app id, bind it at its own path and export TMPDIR. (9b31b42)
- fix(sandbox): add keyring sandbox permission toggle. Expose GNOME Keyring and KWallet (Secret Service) access as a sandbox toggle, off by default. (53f127d)
- fix:(sandbox) export app icon-theme files so tray and notification icons resolve. Mirror Flatpak's $FLATPAK_ID* icon export for AppImages by copying id-prefixed icons from the bundled theme into ~/.local/share/icons, otherwise runtime lookups (e.g. SNI tray icons) render as missing. (34384b7)
- fix: apply container's bundled environment variables. Parse the Exec of each desktop entry into command, arguments and env assignments rather than splitting on the first space, so quoted and prefixed tokens survive intact. Fixes #192 (bfc3365)
- fix(package): parse project version with prerelease suffixes. Should fix #198 (61f7536)
Translations
- i18n(uk): update Ukrainian translation by @Dymkom in #197
- French translation by @denisrennes in #199
New Contributors
Full Changelog: v4.0.0-beta1...v4.0.0-beta2