Skip to main content

max / alloy

Teach a Flatpak example that the sandbox rule does not forbid pkg.rs used org.chromium.Chromium as its running example of the sandboxed rung, in the doc comment on Spec::by_app that teaches the spec format, in list's runtime-filtering comment, and throughout the fixtures. Under the rule written up 2026-08-17 (wiki alloy-packaging-policy, "Do not Flatpak a program with its own trusted sandbox") a Chromium-family browser is precisely the thing not to Flatpak, so the module was teaching the counter-example to anyone reading it to learn what the rung is for. Inkscape throughout: a leaf GUI application with no internal sandbox, needing nothing past portals, which is what the rung is actually for. Strings and identifiers only, no behaviour. The one substantive line is `a_declared_box_the_system_lacks_gets_a_row`, whose expected array is name-sorted, so "chromium" sorted before "dev" and "inkscape" sorts after it. That the test caught the reorder is the test doing its job. 949 tests pass, clippy clean.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-17 23:06 UTC
Signed with PGP, not checked
Commit: 98fbfa6dabf61dfb2f2bde53b29c530f7f4b53ed
Parent: 37446f0
1 file changed, +45 insertions, -45 deletions
M crates/alloy/src/pkg.rs +45 -45
@@ -305,8 +305,8 @@
305 305 /// App id to declared name, so a sandboxed row finds its entry.
306 306 ///
307 307 /// A sandboxed box is identified to flatpak by its app id and to the user by
308 - /// its spec key, and those are different strings: `[box.chromium]` carries
309 - /// `app = "org.chromium.Chromium"`. Without this index a declared flatpak
308 + /// its spec key, and those are different strings: `[box.inkscape]` carries
309 + /// `app = "org.inkscape.Inkscape"`. Without this index a declared flatpak
310 310 /// app reads as ad-hoc, because the row's only handle is the id and the spec
311 311 /// is keyed by the name.
312 312 by_app: BTreeMap<String, String>,
@@ -947,7 +947,7 @@
947 947 }
948 948
949 949 /// `--app` so runtimes stay out. A user has one row's worth of interest in
950 - /// Chromium and none in `org.freedesktop.Platform`, which is an
950 + /// Inkscape and none in `org.freedesktop.Platform`, which is an
951 951 /// implementation detail of the app above it.
952 952 fn list(&self) -> Invocation {
953 953 Invocation::new("flatpak").args(["list", "--app", &format!("--columns={FLATPAK_COLUMNS}")])
@@ -2341,7 +2341,7 @@
2341 2341 // Tab-separated, and the app id is the first field. The two rows differ in
2342 2342 // installation on purpose: that is the field `remove` addresses, and a
2343 2343 // fixture where every row agrees cannot show it being read.
2344 - const FLATPAK: &str = "org.chromium.Chromium\tChromium Web Browser\tflathub\tuser\n\
2344 + const FLATPAK: &str = "org.inkscape.Inkscape\tInkscape\tflathub\tuser\n\
2345 2345 dev.edfloreshz.Tasks\tTasks\tflathub\tsystem\n";
2346 2346
2347 2347 // Captured from a real `alloy install` booted in QEMU, 2026-07-22, by running
@@ -2539,11 +2539,11 @@
2539 2539 #[test]
2540 2540 fn a_sandboxed_row_shows_the_name_and_carries_the_app_id() {
2541 2541 let boxes = Flatpak.parse(FLATPAK, &Spec::default()).unwrap();
2542 - let chromium = boxes
2542 + let inkscape = boxes
2543 2543 .iter()
2544 - .find(|b| b.source == "org.chromium.Chromium")
2544 + .find(|b| b.source == "org.inkscape.Inkscape")
2545 2545 .unwrap();
2546 - assert_eq!(chromium.name, "Chromium Web Browser");
2546 + assert_eq!(inkscape.name, "Inkscape");
2547 2547 }
2548 2548
2549 2549 // A sandboxed spec entry is keyed by the box name and carries the app id in
@@ -2554,22 +2554,22 @@
2554 2554 fn a_declared_flatpak_app_is_matched_by_app_id() {
2555 2555 let spec = Spec::parse(
2556 2556 r#"
2557 - [box.chromium]
2557 + [box.inkscape]
2558 2558 level = "sandboxed"
2559 - app = "org.chromium.Chromium"
2559 + app = "org.inkscape.Inkscape"
2560 2560 "#,
2561 2561 )
2562 2562 .unwrap();
2563 2563
2564 2564 let boxes = Flatpak.parse(FLATPAK, &spec).unwrap();
2565 - let chromium = boxes
2565 + let inkscape = boxes
2566 2566 .iter()
2567 - .find(|b| b.source == "org.chromium.Chromium")
2567 + .find(|b| b.source == "org.inkscape.Inkscape")
2568 2568 .unwrap();
2569 - assert_eq!(chromium.origin(), Origin::Declared);
2569 + assert_eq!(inkscape.origin(), Origin::Declared);
2570 2570 assert_eq!(
2571 - chromium.declared.as_deref(),
2572 - Some("chromium"),
2571 + inkscape.declared.as_deref(),
2572 + Some("inkscape"),
2573 2573 "the row carries the spec's name for it, not the app id"
2574 2574 );
2575 2575
@@ -2594,15 +2594,15 @@
2594 2594 #[test]
2595 2595 fn a_sandboxed_row_carries_the_installation_it_was_found_in() {
2596 2596 let boxes = Flatpak.parse(FLATPAK, &Spec::default()).unwrap();
2597 - let chromium = boxes
2597 + let inkscape = boxes
2598 2598 .iter()
2599 - .find(|b| b.source == "org.chromium.Chromium")
2599 + .find(|b| b.source == "org.inkscape.Inkscape")
2600 2600 .unwrap();
2601 2601 let tasks = boxes
2602 2602 .iter()
2603 2603 .find(|b| b.source == "dev.edfloreshz.Tasks")
2604 2604 .unwrap();
2605 - assert_eq!(chromium.scope, Some(Scope::User));
2605 + assert_eq!(inkscape.scope, Some(Scope::User));
2606 2606 assert_eq!(tasks.scope, Some(Scope::System));
2607 2607 assert_eq!(
2608 2608 Flatpak.remove(tasks).display(),
@@ -2640,7 +2640,7 @@
2640 2640 let without =
2641 2641 Spec::parse("[box.thing]\nlevel = \"sandboxed\"\napp = \"org.example.T\"\n").unwrap();
2642 2642 for argv in [
2643 - create_argv(&Flatpak, &with_remote, "chromium"),
2643 + create_argv(&Flatpak, &with_remote, "inkscape"),
2644 2644 create_argv(&Flatpak, &without, "thing"),
2645 2645 ] {
2646 2646 assert!(argv.contains(" --user "), "got: {argv}");
@@ -2728,9 +2728,9 @@
2728 2728 #[test]
2729 2729 fn flatpak_commands_address_the_app_id() {
2730 2730 let boxes = Flatpak.parse(FLATPAK, &Spec::default()).unwrap();
2731 - let chromium = boxes
2731 + let inkscape = boxes
2732 2732 .iter()
2733 - .find(|b| b.source == "org.chromium.Chromium")
2733 + .find(|b| b.source == "org.inkscape.Inkscape")
2734 2734 .unwrap();
2735 2735
2736 2736 assert_eq!(
@@ -2738,15 +2738,15 @@
2738 2738 "flatpak list --app --columns=application,name,origin,installation"
2739 2739 );
2740 2740 assert_eq!(
2741 - Flatpak.remove(chromium).display(),
2742 - "flatpak uninstall --user org.chromium.Chromium"
2741 + Flatpak.remove(inkscape).display(),
2742 + "flatpak uninstall --user org.inkscape.Inkscape"
2743 2743 );
2744 2744 assert_eq!(
2745 - Flatpak.enter(chromium).display(),
2746 - "flatpak run --command=sh org.chromium.Chromium"
2745 + Flatpak.enter(inkscape).display(),
2746 + "flatpak run --command=sh org.inkscape.Inkscape"
2747 2747 );
2748 - assert!(Flatpak.start(chromium).is_none());
2749 - assert!(Flatpak.stop(chromium).is_none());
2748 + assert!(Flatpak.start(inkscape).is_none());
2749 + assert!(Flatpak.stop(inkscape).is_none());
2750 2750 }
2751 2751
2752 2752 // ---- exporting ----
@@ -2775,9 +2775,9 @@
2775 2775 level = "workspace"
2776 2776 image = "alpine"
2777 2777
2778 - [box.chromium]
2778 + [box.inkscape]
2779 2779 level = "sandboxed"
2780 - app = "org.chromium.Chromium"
2780 + app = "org.inkscape.Inkscape"
2781 2781 "#,
2782 2782 )
2783 2783 .unwrap()
@@ -2910,7 +2910,7 @@
2910 2910 #[test]
2911 2911 fn flatpak_refuses_to_export_and_says_the_app_is_already_there() {
2912 2912 let spec = export_spec();
2913 - let err = exports(&Flatpak, &spec, "chromium")
2913 + let err = exports(&Flatpak, &spec, "inkscape")
2914 2914 .unwrap_err()
2915 2915 .to_string();
2916 2916 assert!(err.contains("already exports"), "{err}");
@@ -2947,9 +2947,9 @@
2947 2947 image = "registry.fedoraproject.org/fedora-toolbox:43"
2948 2948 mounts = ["/srv/thing", "/srv/read-only:ro"]
2949 2949
2950 - [box.chromium]
2950 + [box.inkscape]
2951 2951 level = "sandboxed"
2952 - app = "org.chromium.Chromium"
2952 + app = "org.inkscape.Inkscape"
2953 2953 remote = "flathub"
2954 2954 "#,
2955 2955 )
@@ -2992,8 +2992,8 @@
2992 2992 fn a_sandboxed_box_is_installed_from_its_declared_remote() {
2993 2993 let spec = creation_spec();
2994 2994 assert_eq!(
2995 - create_argv(&Flatpak, &spec, "chromium"),
2996 - "flatpak install --user --noninteractive flathub org.chromium.Chromium"
2995 + create_argv(&Flatpak, &spec, "inkscape"),
2996 + "flatpak install --user --noninteractive flathub org.inkscape.Inkscape"
2997 2997 );
2998 2998 }
2999 2999
@@ -3120,16 +3120,16 @@
3120 3120 image = "registry.fedoraproject.org/fedora-toolbox:43"
3121 3121 mounts = ["~/code/thing"]
3122 3122
3123 - [box.chromium]
3123 + [box.inkscape]
3124 3124 level = "sandboxed"
3125 - app = "org.chromium.Chromium"
3125 + app = "org.inkscape.Inkscape"
3126 3126 "#,
3127 3127 )
3128 3128 .unwrap();
3129 3129
3130 3130 assert_eq!(spec.level("dev"), Some(Level::Host));
3131 3131 assert_eq!(spec.level("scratch"), Some(Level::Workspace));
3132 - assert_eq!(spec.level("chromium"), Some(Level::Sandboxed));
3132 + assert_eq!(spec.level("inkscape"), Some(Level::Sandboxed));
3133 3133 assert_eq!(spec.level("absent"), None);
3134 3134 assert_eq!(spec.declared_name("dev").as_deref(), Some("dev"));
3135 3135 assert_eq!(spec.declared_name("absent"), None);
@@ -3143,8 +3143,8 @@
3143 3143 );
3144 3144 let (_, scratch) = spec.resolve("scratch").unwrap();
3145 3145 assert_eq!(scratch.mounts, ["~/code/thing"]);
3146 - let (_, chromium) = spec.resolve("chromium").unwrap();
3147 - assert_eq!(chromium.app.as_deref(), Some("org.chromium.Chromium"));
3146 + let (_, inkscape) = spec.resolve("inkscape").unwrap();
3147 + assert_eq!(inkscape.app.as_deref(), Some("org.inkscape.Inkscape"));
3148 3148 }
3149 3149
3150 3150 // Keys this Alloy does not read yet must not make the file unparseable, or a
@@ -3474,7 +3474,7 @@
3474 3474 let rows = view.absent_rows(&BTreeSet::new(), &[0]);
3475 3475
3476 3476 let names: Vec<&str> = rows.iter().map(|row| row.boxed.name.as_str()).collect();
3477 - assert_eq!(names, ["chromium", "dev", "scratch"], "every declared box");
3477 + assert_eq!(names, ["dev", "inkscape", "scratch"], "every declared box");
3478 3478 for row in &rows {
3479 3479 assert_eq!(row.boxed.state, BoxState::Absent);
3480 3480 assert_eq!(row.boxed.origin(), Origin::Declared);
@@ -3491,7 +3491,7 @@
3491 3491 let names: Vec<&str> = rows.iter().map(|row| row.boxed.name.as_str()).collect();
3492 3492 assert_eq!(
3493 3493 names,
3494 - ["chromium", "scratch"],
3494 + ["inkscape", "scratch"],
3495 3495 "dev is present, so it is not missing"
3496 3496 );
3497 3497 }
@@ -3507,7 +3507,7 @@
3507 3507 let names: Vec<&str> = rows.iter().map(|row| row.boxed.name.as_str()).collect();
3508 3508 assert_eq!(
3509 3509 names,
3510 - ["chromium"],
3510 + ["inkscape"],
3511 3511 "podman said nothing, so its boxes are unknown rather than missing"
3512 3512 );
3513 3513 }
@@ -3520,10 +3520,10 @@
3520 3520 let view = podman_only(creation_spec());
3521 3521 let rows = view.absent_rows(&BTreeSet::new(), &[0]);
3522 3522
3523 - let chromium = named(&rows, "chromium");
3524 - assert_eq!(chromium.backend, None, "flatpak is not installed here");
3525 - assert_eq!(chromium.boxed.level, Some(Level::Sandboxed));
3526 - assert_eq!(chromium.boxed.source, "org.chromium.Chromium");
3523 + let inkscape = named(&rows, "inkscape");
3524 + assert_eq!(inkscape.backend, None, "flatpak is not installed here");
3525 + assert_eq!(inkscape.boxed.level, Some(Level::Sandboxed));
3526 + assert_eq!(inkscape.boxed.source, "org.inkscape.Inkscape");
3527 3527 }
3528 3528
3529 3529 // Acting on a row with no backend has to say why rather than doing nothing,