bump to v1.3.1

Signed-off-by: Boris Yumankulov <boria138@altlinux.org>

.gitea/workflows/build.yml

@@ -8,7 +8,7 @@ on:
 
 env:
   # Common version, will be used for tagging the release
-  VERSION: 1.3.0
+  VERSION: 1.3.1
   PKGDEST: "/tmp/portprotonqt"
   PACKAGE: "portprotonqt"
   GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}

CHANGELOG.md

@@ -3,6 +3,16 @@
 Все заметные изменения в этом проекте фиксируются в этом файле.
 Формат основан на [Keep a Changelog](https://keepachangelog.com/) и придерживается принципов [Semantic Versioning](https://semver.org/).
 
+## [1.3.1] - 2026-07-18
+
+### Fixed
+- Исправлено CVE-2026-59678: уязвимость повышения привилегий в Polkit-правилах udisks и NetworkManager, где проверка командной строки через `ps` позволяла локальным пользователям обойти авторизацию
+
+### Changed
+- `--ppqtos` теперь требует что бы пользователь был в группе `portprotonqt`
+
+---
+
 ## [1.3.0] - 2026-07-13
 
 ### Added

build-aux/PKGBUILD

@@ -1,5 +1,5 @@
 pkgname=('portprotonqt')
-pkgver=1.3.0
+pkgver=1.3.1
 pkgrel=1
 pkgdesc="Modern GUI for managing and launching games from PortProton and Steam"
 arch=('any')

build-aux/fedora-git.spec

@@ -1,5 +1,5 @@
 %global pypi_name portprotonqt
-%global pypi_version 1.3.0
+%global pypi_version 1.3.1
 %global oname PortProtonQt
 %global build_timestamp %(date +"%Y%m%d")
 %global _python_no_extras_requires 1
@@ -111,6 +111,7 @@ install -Dpm 0644 ./completions/_portprotonqt -t %{buildroot}%{zsh_completions_d
 %{_datadir}/icons/hicolor/scalable/apps/ru.linux_gaming.PortProtonQt.svg
 %{_metainfodir}/ru.linux_gaming.PortProtonQt.metainfo.xml
 %{_udevrulesdir}/60-portprotonqt.rules
+%{_sysusersdir}/portprotonqt.conf
 %{_datadir}/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules
 %{_datadir}/applications/ru.linux_gaming.PortProtonQt.desktop
 %{_datadir}/mime/packages/ru.linux_gaming.PortProtonQt.xml

build-aux/fedora.spec

@@ -1,5 +1,5 @@
 %global pypi_name portprotonqt
-%global pypi_version 1.3.0
+%global pypi_version 1.3.1
 %global oname PortProtonQt
 %global _python_no_extras_requires 1
 
@@ -109,6 +109,7 @@ install -Dpm 0644 ./completions/_portprotonqt -t %{buildroot}%{zsh_completions_d
 %{_datadir}/icons/hicolor/scalable/apps/ru.linux_gaming.PortProtonQt.svg
 %{_metainfodir}/ru.linux_gaming.PortProtonQt.metainfo.xml
 %{_udevrulesdir}/60-portprotonqt.rules
+%{_sysusersdir}/portprotonqt.conf
 %{_datadir}/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules
 %{_datadir}/applications/ru.linux_gaming.PortProtonQt.desktop
 %{_datadir}/mime/packages/ru.linux_gaming.PortProtonQt.xml

build-aux/lib/sysusers.d/portprotonqt.conf

@@ -0,0 +1 @@
+g portprotonqt - -

build-aux/share/metainfo/ru.linux_gaming.PortProtonQt.metainfo.xml

@@ -24,9 +24,12 @@
   </developer>
 
   <releases>
-    <release version="1.3.0" date="2026-07-13">
+    <release version="1.3.1" date="2026-07-17">
       <description></description>
     </release>
+    <release version="1.3.0" date="2026-07-13">
+      <description/>
+    </release>
     <release version="1.2.0" date="2026-06-10">
       <description/>
     </release>

build-aux/share/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules

@@ -1,21 +1,15 @@
 polkit.addRule(function(action, subject) {
-	var cmd_line = polkit.spawn(["ps", "-o", "args=", "-p", String(subject.pid)]);
-    var ppid = polkit.spawn(["ps", "-o", "ppid=", "-p", String(subject.pid)]).trim();
-    var parent_cmd_line = "";
-    if (ppid) {
-        parent_cmd_line = polkit.spawn(["ps", "-o", "args=", "-p", ppid]);
+    if (!subject.local || !subject.active ||
+        !subject.isInGroup("portprotonqt")) {
+        return polkit.Result.NOT_HANDLED;
     }
-    var is_ppqt_call =
-        cmd_line.includes("ppqtos") ||
-        parent_cmd_line.includes("ppqtos");
 
-    if (  (
-    action.id === "org.freedesktop.NetworkManager.settings.modify.system" ||
-	action.id == "org.freedesktop.udisks2.filesystem-mount-system" ||
-	action.id == "org.freedesktop.udisks2.filesystem-mount-other-seat" ||
-	action.id == "org.freedesktop.udisks2.filesystem-unmount-others" ) &&
-    is_ppqt_call)
-    {
-    return polkit.Result.YES;
+    if (action.id === "org.freedesktop.NetworkManager.settings.modify.system" ||
+        action.id === "org.freedesktop.udisks2.filesystem-mount-system" ||
+        action.id === "org.freedesktop.udisks2.filesystem-mount-other-seat" ||
+        action.id === "org.freedesktop.udisks2.filesystem-unmount-others") {
+        return polkit.Result.YES;
     }
+
+    return polkit.Result.NOT_HANDLED;
 });

debian/changelog

@@ -1,3 +1,9 @@
+portprotonqt (1.3.1) unstable; urgency=medium
+
+  * New upstream release.
+
+ -- Ivan Mazhukin <vanyamajukin@outlook.com>  Fri, 17 Jul 2026 19:46:59 +0500
+
 portprotonqt (1.3.0) unstable; urgency=medium
 
   * New upstream release.

debian/portprotonqt.install

@@ -1,6 +1,7 @@
 usr/bin/portprotonqt
 usr/bin/vk_gpu_info
 usr/lib/python3/dist-packages/portprotonqt/
+usr/lib/sysusers.d/portprotonqt.conf
 usr/lib/udev/rules.d/60-portprotonqt.rules
 usr/share/applications/ru.linux_gaming.PortProtonQt.desktop
 usr/share/bash-completion/completions/portprotonqt

debian/rules

@@ -19,3 +19,6 @@ execute_after_dh_auto_install:
 		debian/tmp/usr/share/zsh/site-functions/_portprotonqt
 	install -Dpm 0644 completions/portprotonqt.fish \
 		debian/tmp/usr/share/fish/vendor_completions.d/portprotonqt.fish
+
+execute_after_dh_install:
+	dh_installsysusers

meson.build

@@ -1,5 +1,5 @@
 project('portprotonqt', 'c',
-  version: '1.3.0',
+  version: '1.3.1',
   meson_version: '>= 0.61.2',
   license: 'GPL-3.0',
 )
@@ -139,3 +139,8 @@ install_data(
   'build-aux/share/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules',
   install_dir: prefix / 'share' / 'polkit-1' / 'rules.d',
 )
+
+install_data(
+  'build-aux/lib/sysusers.d/portprotonqt.conf',
+  install_dir: prefix / 'lib' / 'sysusers.d',
+)

portprotonqt/app.py

@@ -18,7 +18,7 @@ try:
     APP_VERSION = version_module.APP_VERSION
 except ImportError:
     APP_COMMIT = ""
-    APP_VERSION = "1.3.0"
+    APP_VERSION = "1.3.1"
 
 __app_version__ = os.environ.get("PORTPROTONQT_VERSION", APP_VERSION)
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "portprotonqt"
-version = "1.3.0"
+version = "1.3.1"
 description = "A project to rewrite PortProton (PortWINE) using PySide"
 requires-python = ">=3.10"
 readme = "README.md"

tests/test_polkit_rules.py

@@ -0,0 +1,21 @@
+from pathlib import Path
+
+
+def test_polkit_rule_does_not_grant_application_privileges() -> None:
+    rule_path = Path(__file__).parents[1] / (
+        "build-aux/share/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules"
+    )
+    rule = rule_path.read_text()
+
+    assert "polkit.spawn" not in rule
+    assert "ppqtos" not in rule
+    assert "!subject.local || !subject.active ||" in rule
+    assert '!subject.isInGroup("portprotonqt")' in rule
+
+
+def test_portprotonqt_group_is_provisioned() -> None:
+    sysusers_path = Path(__file__).parents[1] / (
+        "build-aux/lib/sysusers.d/portprotonqt.conf"
+    )
+
+    assert sysusers_path.read_text() == "g portprotonqt - -\n"

uv.lock

@@ -214,7 +214,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -492,7 +492,7 @@ wheels = [
 
 [[package]]
 name = "portprotonqt"
-version = "1.3.0"
+version = "1.3.1"
 source = { editable = "." }
 dependencies = [
     { name = "babel" },