Run updates to remove "potentially unsafe" warning in Flathub

[pikurasa]

https://flathub.org/apps/org.sugarlabs.MusicBlocks gives MB a "potentially unsafe" warning.

Here's more info, as discussed in Matrix: https://matrix.to/#/!fETQQkzsRKJLNYNuqN:matrix.org/$eK5DdLsXnmxBdkDdWu89GRI0jKR1cn-v7MLbBnGD9P0?via=matrix.org&via=srev.in

Devin's question:
What steps need to be done for https://flathub.org/apps/org.sugarlabs.MusicBlocks to remove the "potentially unsafe" warning?

Martin's response:
this permission needs to be removed... but, it's not that simple...

Music Blocks is a web app, and therefore, to work as a desktop app, it's using some framework.... This framework doesn't support the file chooser portal, which allows apps to access files.. and to workaround we punched a huge hole in the app sandbox to so it can access all home directory files instead...

org.sugarlabs.MusicBlocks/org.sugarlabs.MusicBlocks.yaml at master · flathub/org.sugarlabs.MusicBlocks - GitHub
Contribute to flathub/org.sugarlabs.MusicBlocks development by creating an account on GitHub.
We don't have this issue with GTK apps because GTK does support this file choser portal.. so we don't need that hole
maybe newer versions of electron (or whatever we used to run music blocks), do support portals now... but someone would have to look at it
another strategy could be to switch to another framework that does support portals, but not sure which one could be... we could also try just to embed it in a gtkwebkit wrapper... but, since it's webkit and not chrome or firefox, who knows if something could break in the app

[SainiAdi-04]

Hi @pikurasa

Thanks for clarifying that the --filesystem=home permission was a workaround due to the framework not supporting the file chooser portal — that makes sense.

I’ve set up and built the project locally using the latest Flatpak runtime (23.08) and can confirm it runs fine. I also modernized the Flatpak manifest (using pip install, updated metainfo paths, etc.), so the build is fully reproducible.

I’d like to help explore how we can eventually remove or limit --filesystem=home.
Some ideas worth testing:

1. Check if newer Electron BaseApps (e.g., org.electronjs.Electron3 or later) support xdg-desktop-portal integration.
2. As a short-term mitigation, we could restrict access to --filesystem=xdg-documents or similar instead of the full home directory.

Would you be open to me experimenting with these approaches and reporting back here before making a PR?

Thanks again for the context — really appreciate your guidance on keeping this both functional and safe.