Remove Flatpak filesystem permissions

(Using Sonny Piers’s technique in GNOME Commit)

Author: aral

README.md

@@ -220,7 +220,7 @@ Testing with the Flatpak build is slower but you can be sure that you’re seein
 2. Either carry out a `git commit` or, to run Comet using one of the test messages:
 
     ```shell
-    flatpak run org.small_tech.comet tests/<name of test message>
+    flatpak run --file-forwarding org.small_tech.comet tests/<name of test message>
     ```
 
 To test the Welcome screen, either launch Comet from the Applications Menu or, via Terminal, run the Comet flatpak without passing it any arguments:

org.small_tech.comet.yml

@@ -47,14 +47,6 @@ finish-args:
   #   - https://flatkill.org/2020/
   #   - https://github.com/flatpak/flatpak/issues/3637
 
-  # Host permissions are necessary as this is a developer tool and people
-  # can mount external drives and network shares in a plethora of different locations.
-  - '--filesystem=host'
-
-  # For use if a developer clones an app into the /tmp folder and attempts to
-  # make a commit.
-  - '--filesystem=/tmp'
-
   # Necessary to configure Git from the welcome screen using flatpak-spawn --host.
   - '--talk-name=org.freedesktop.Flatpak'
 

src/WelcomeWindow.vala

@@ -9,7 +9,7 @@ namespace Comet {
 
         private string GIT_CONFIG_GLOBAL_CORE_EDITOR = "git config --global core.editor";
         private string FLATPAK_SPAWN_HOST = "flatpak-spawn --host";
-        private string FLATPAK_RUN = "flatpak run";
+        private string FLATPAK_RUN = "flatpak run --file-forwarding";
 
         private string? current_editor {
             owned get {
@@ -174,7 +174,7 @@ namespace Comet {
 
         private bool is_comet_enabled () {
             var comet_path = Application.is_running_as_flatpak ?
-                @"$(FLATPAK_RUN) $(Application.flatpak_id)" :
+                @"$(FLATPAK_RUN) $(Application.flatpak_id) @@" :
                 Application.binary_path;
 
             return current_editor == comet_path;
@@ -185,7 +185,7 @@ namespace Comet {
             Comet.saved_state.set("previous-editor", "s", current_editor);
 
             var command = Application.is_running_as_flatpak ?
-                @"$(FLATPAK_SPAWN_HOST) $(GIT_CONFIG_GLOBAL_CORE_EDITOR) \"$(FLATPAK_RUN) $(Application.flatpak_id)\""
+                @"$(FLATPAK_SPAWN_HOST) $(GIT_CONFIG_GLOBAL_CORE_EDITOR) \"$(FLATPAK_RUN) $(Application.flatpak_id) @@\""
                 : @"$(GIT_CONFIG_GLOBAL_CORE_EDITOR) $(Application.binary_path)";
 
             var result = Posix.system (command);