Ignores remote information in flatpak ref
I just landed org.gnome.Totem.Devel
on the flathub beta channel. org.gnome.Totem.Devel
is also the app-id of the totem nightly (which should be going away soon: totem!232 (merged)).
With a gnome-nighty remote enabled, but no flathub-beta remote enabled, clicking on the flatpakref at https://flathub.org/beta-repo/appstream/org.gnome.Totem.Devel.flatpakref will offer to install the gnome-nighty version, and no other.
I'll mark this as security because if a piece of software in an installed remote was compromised (eg. org.gnome.Totem.Devel on the gnome-nightly repo in my case), clicking on the link would install from the wrong place. This is a namesquatting problem.
Installing using the Flatpak command-line works correctly:
$ flatpak install --user org.gnome.Totem.Devel.flatpakref
The remote 'flathub-beta', referred to by 'org.gnome.Totem.Devel' at location https://dl.flathub.org/beta-repo/ contains additional applications.
Should the remote be kept for future installations? [Y/n]:
org.gnome.Totem.Devel permissions:
ipc network fallback-x11 pulseaudio wayland x11 dri file access [1] dbus access [2] bus ownership [3] system dbus access [4] tags [5]
[1] xdg-download, xdg-videos
[2] com.intel.dleyna-server, org.gnome.Nautilus, org.gnome.OnlineAccounts, org.gnome.ScreenSaver, org.gnome.SessionManager, org.gnome.SettingsDaemon.MediaKeys, org.gnome.Shell, org.gtk.vfs, org.gtk.vfs.*
[3] org.mpris.MediaPlayer2.totem
[4] org.freedesktop.Avahi
[5] nightly
ID Branch Op Remote Download
1. [✓] org.gnome.Totem.Devel.Locale master i flathub-beta 9.5 kB / 3.4 MB
2. [✓] org.gnome.Totem.Devel master i flathub-beta 5.4 MB / 7.6 MB
Installation complete.