[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#940818: marked as done (buster-pu: package flatpak/1.2.5-0+deb10u1)



Your message dated Sat, 16 Nov 2019 10:08:47 +0000
with message-id <83c9ffab6f08361485f70dda4733a7a24aeec09b.camel@adam-barratt.org.uk>
and subject line Closing bugs for 10.2 point release fixes
has caused the Debian Bug report #940818,
regarding buster-pu: package flatpak/1.2.5-0+deb10u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
940818: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940818
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian.org@packages.debian.org
Usertags: pu

Flatpak's upstream developer has released version 1.2.5, backporting
some crash fixes and a feature that is recommended for newer versions
of the org.freedesktop.Platform reference runtime. This release (and
the whole 1.2.x branch) is specifically intended for distributions like
Debian that do not want to switch between branches in a stable release.

The attached diff has been filtered through:

    filterdiff -p1 --exclude='po/*' --exclude=configure
    --exclude='doc/reference/html/*' --exclude=config.guess
    --exclude=config.sub

to exclude Autotools- and gtk-doc-generated files, and translations.

Does this look OK to upload? Changelog so far:

flatpak (1.2.5-0+deb10u1) UNRELEASED; urgency=medium

  * New upstream stable release
    - Allow runtimes (not just apps) to use extra_data, which is required
      by the new org.freedesktop.Platform.openh264 extension
    - Support apps that specify several required Flatpak versions,
      such as 1.4.2;1.2.5; for runtimes that require the above feature
    - Backport some crash bug fixes from 1.4.x
    - Fix installation of bundles
    - Set looser permissions on the /run/host/monitor directory, to
      work better with tools like Fedora Toolbox on the host system
    - Do not wrongly remove extensions as "unused" if they are referenced
      by the 'versions' extension key rather than by 'version'
  * d/gbp.conf: Use debian/buster packaging branch
  * d/watch: Only look for 1.2.x releases

(Obviously I'll set the suite to buster before uploading.)

Thanks,
    smcv
 NEWS                                               |   30 +
 app/flatpak-main.c                                 |    9 +
 common/flatpak-dir.c                               |  169 +-
 common/flatpak-installation.c                      |   14 +-
 common/flatpak-oci-registry.c                      |   12 +-
 common/flatpak-transaction.c                       |    8 +-
 common/flatpak-utils.c                             |   67 +-
 common/flatpak-version-macros.h                    |    2 +-
 config.guess                                       |  120 +-
 config.sub                                         | 2427 ++++++++++----------
 configure                                          |   26 +-
 configure.ac                                       |    2 +-
 debian/changelog                                   |   18 +
 debian/gbp.conf                                    |    2 +-
 debian/watch                                       |    2 +-
 doc/flatpak-metadata.xml                           |   20 +-
 doc/reference/html/FlatpakBundleRef.html           |   17 +-
 doc/reference/html/FlatpakInstallation.html        |   12 +-
 doc/reference/html/FlatpakInstalledRef.html        |   48 +-
 doc/reference/html/FlatpakInstance.html            |   12 +-
 doc/reference/html/FlatpakRef.html                 |   42 +-
 doc/reference/html/FlatpakRelatedRef.html          |   32 +-
 doc/reference/html/FlatpakRemote.html              |   18 +-
 doc/reference/html/FlatpakRemoteRef.html           |   42 +-
 doc/reference/html/FlatpakTransaction.html         |   23 +-
 .../html/FlatpakTransactionOperation.html          |   12 +-
 doc/reference/html/FlatpakTransactionProgress.html |   18 +-
 doc/reference/html/annotation-glossary.html        |    8 +-
 doc/reference/html/api-index-full.html             |    4 +-
 doc/reference/html/ch01.html                       |    4 +-
 doc/reference/html/flatpak-Error-codes.html        |   14 +-
 .../html/flatpak-Version-information.html          |   14 +-
 doc/reference/html/flatpak.devhelp2                |   24 +-
 doc/reference/html/index.html                      |    6 +-
 doc/reference/html/object-tree.html                |    4 +-
 doc/reference/html/style.css                       |   88 +-
 doc/reference/libflatpak-docs.xml                  |   91 +-
 icon-validator/validate-icon.c                     |    2 +-
 po/cs.gmo                                          |  Bin 76885 -> 76885 bytes
 po/cs.po                                           |  188 +-
 po/de.gmo                                          |  Bin 41316 -> 41316 bytes
 po/de.po                                           |  188 +-
 po/es.gmo                                          |  Bin 39897 -> 39897 bytes
 po/es.po                                           |  188 +-
 po/flatpak.pot                                     |  190 +-
 po/gl.gmo                                          |  Bin 39989 -> 39989 bytes
 po/gl.po                                           |  188 +-
 po/hu.gmo                                          |  Bin 49228 -> 49228 bytes
 po/hu.po                                           |  188 +-
 po/id.gmo                                          |  Bin 79657 -> 79657 bytes
 po/id.po                                           |  188 +-
 po/pl.gmo                                          |  Bin 91634 -> 91634 bytes
 po/pl.po                                           |  188 +-
 po/pt_BR.gmo                                       |  Bin 58332 -> 58332 bytes
 po/pt_BR.po                                        |  188 +-
 po/ru.gmo                                          |  Bin 60415 -> 60415 bytes
 po/ru.po                                           |  188 +-
 po/sk.gmo                                          |  Bin 11107 -> 11107 bytes
 po/sk.po                                           |  188 +-
 po/sv.gmo                                          |  Bin 43671 -> 43671 bytes
 po/sv.po                                           |  188 +-
 po/tr.gmo                                          |  Bin 34503 -> 34503 bytes
 po/tr.po                                           |  188 +-
 po/uk.gmo                                          |  Bin 99647 -> 99647 bytes
 po/uk.po                                           |  188 +-
 po/zh_TW.gmo                                       |  Bin 67730 -> 67730 bytes
 po/zh_TW.po                                        |  188 +-
 portal/flatpak-portal.c                            |    2 +-
 session-helper/flatpak-session-helper.c            |    2 +-
 tests/make-test-app.sh                             |    8 +
 tests/package_version.txt                          |    2 +-
 tests/test-repo.sh                                 |  103 +-
 72 files changed, 3382 insertions(+), 3020 deletions(-)

diff --git a/NEWS b/NEWS
index bed1b394..7c6c0065 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,33 @@
+Changes in 1.2.5
+================
+
+This release to the 1.2 old stable series matches some new features
+that were added in 1.4.3 stable release. These are backported because
+these features are in use on flathub at the moment.
+
+The main feature is the support for allowing the use of extra_data
+for runtimes (as opposed to only for apps) which is used by the new
+org.freedesktop.Platform.openh264 extension.
+
+Supporting this, flatpak now supports specifying several flatpak
+versions to require, rather than just a single one. This is used by
+the above extension in order to express that it needs flatpak 1.2.5 or
+1.4.2 (but not e.g. 1.4.1).
+
+Only the client side features for this are backported. To build such
+extensions you need to use a newer flatpak.
+
+Other changes are:
+ * Various fixes for OCI repos
+ * Some crashers fixes
+ * Set looser permissions on the /run/host/monitor directory to
+   work with e.g. toolbox on the host.
+ * Fix installation of bundles.
+ * Handle 'versions' extension key (in addition to 'version') when
+   checking for installed extensions. Thg lack of this was causing
+   flatpak to incorrectly consider some extensions not in use,
+   thus removing them in 'uninstall --unused'.
+
 Changes in 1.2.4
 ================
 
diff --git a/app/flatpak-main.c b/app/flatpak-main.c
index 6ac953da..d9f52822 100644
--- a/app/flatpak-main.c
+++ b/app/flatpak-main.c
@@ -532,6 +532,15 @@ install_polkit_agent (void)
 #ifdef USE_SYSTEM_HELPER
   PolkitAgentListener *listener = NULL;
   g_autoptr(GError) local_error = NULL;
+  g_autoptr(GDBusConnection) bus = NULL;
+
+  bus = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, &local_error);
+
+  if (bus == NULL)
+    {
+      g_debug ("Unable to connect to system bus: %s", local_error->message);
+      return NULL;
+    }
 
   /* Install a polkit agent as fallback, in case we're running on a console */
   listener = flatpak_polkit_agent_text_listener_new (NULL, &local_error);
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 79fa361d..40a2e586 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -18,6 +18,7 @@
  * Authors:
  *       Alexander Larsson <alexl@redhat.com>
  *       Philip Withnall <withnall@endlessm.com>
+ *       Matthew Leeds <matthew.leeds@endlessm.com>
  */
 
 #include "config.h"
@@ -2422,11 +2423,7 @@ flatpak_dir_get_origin (FlatpakDir   *self,
   deploy_data = flatpak_dir_get_deploy_data (self, ref, FLATPAK_DEPLOY_VERSION_ANY,
                                              cancellable, error);
   if (deploy_data == NULL)
-    {
-      g_set_error (error, FLATPAK_ERROR, FLATPAK_ERROR_NOT_INSTALLED,
-                   _("%s not installed"), ref);
-      return NULL;
-    }
+    return NULL;
 
   return g_strdup (flatpak_deploy_data_get_origin (deploy_data));
 }
@@ -6743,6 +6740,9 @@ apply_extra_data (FlatpakDir   *self,
 
   runtime = g_key_file_get_string (metakey, group,
                                    FLATPAK_METADATA_KEY_RUNTIME, error);
+  if (runtime == NULL)
+    runtime = g_key_file_get_string (metakey, FLATPAK_METADATA_GROUP_EXTENSION_OF,
+                                     FLATPAK_METADATA_KEY_RUNTIME, NULL);
   if (runtime == NULL)
     return FALSE;
 
@@ -7442,7 +7442,7 @@ flatpak_dir_deploy_install (FlatpakDir   *self,
   ret = TRUE;
 
   commit = flatpak_dir_read_active (self, ref, cancellable);
-  flatpak_dir_log (self, "deploy install", origin, ref, commit, old_active,
+  flatpak_dir_log (self, "deploy install", origin, ref, commit, old_active, NULL,
                    "Installed %s from %s", ref, origin);
 
 out:
@@ -8364,22 +8364,6 @@ flatpak_dir_update (FlatpakDir                           *self,
       if (no_pull)
         {
         }
-      else if ((!gpg_verify_summary && state->collection_id == NULL) || !gpg_verify)
-        {
-          /* The remote is not gpg verified, so we don't want to allow installation via
-             a download in the home directory, as there is no way to verify you're not
-             injecting anything into the remote. However, in the case of a remote
-             configured to a local filesystem we can just let the system helper do
-             the installation, as it can then avoid network i/o and be certain the
-             data comes from the right place.
-
-             If @collection_id is non-%NULL, we can verify the refs in commit
-             metadata, so don’t need to verify the summary. */
-          if (g_str_has_prefix (url, "file:"))
-            helper_flags |= FLATPAK_HELPER_DEPLOY_FLAGS_LOCAL_PULL;
-          else
-            return flatpak_fail_error (error, FLATPAK_ERROR_UNTRUSTED, _("Can't pull from untrusted non-gpg verified remote"));
-        }
       else if (is_oci)
         {
           g_autoptr(FlatpakOciRegistry) registry = NULL;
@@ -8396,6 +8380,22 @@ flatpak_dir_update (FlatpakDir                           *self,
           if (!flatpak_dir_mirror_oci (self, registry, state, ref, NULL, progress, cancellable, error))
             return FALSE;
         }
+      else if ((!gpg_verify_summary && state->collection_id == NULL) || !gpg_verify)
+        {
+          /* The remote is not gpg verified, so we don't want to allow installation via
+             a download in the home directory, as there is no way to verify you're not
+             injecting anything into the remote. However, in the case of a remote
+             configured to a local filesystem we can just let the system helper do
+             the installation, as it can then avoid network i/o and be certain the
+             data comes from the right place.
+
+             If @collection_id is non-%NULL, we can verify the refs in commit
+             metadata, so don’t need to verify the summary. */
+          if (g_str_has_prefix (url, "file:"))
+            helper_flags |= FLATPAK_HELPER_DEPLOY_FLAGS_LOCAL_PULL;
+          else
+            return flatpak_fail_error (error, FLATPAK_ERROR_UNTRUSTED, _("Can't pull from untrusted non-gpg verified remote"));
+        }
       else
         {
           /* We're pulling from a remote source, we do the network mirroring pull as a
@@ -11284,6 +11284,34 @@ flatpak_dir_create_remote_for_ref_file (FlatpakDir *self,
   return TRUE;
 }
 
+static gboolean
+_flatpak_uri_equal (const char *uri1,
+                    const char *uri2)
+{
+  g_autofree char *uri1_norm = NULL;
+  g_autofree char *uri2_norm = NULL;
+  gsize uri1_len = strlen (uri1);
+  gsize uri2_len = strlen (uri2);
+
+  /* URIs handled by libostree are equivalent with or without a trailing slash,
+   * but this isn't otherwise guaranteed to be the case.
+   */
+  if (g_str_has_prefix (uri1, "oci+") || g_str_has_prefix (uri2, "oci+"))
+    return g_strcmp0 (uri1, uri2) == 0;
+
+  if (g_str_has_suffix (uri1, "/"))
+    uri1_norm = g_strndup (uri1, uri1_len - 1);
+  else
+    uri1_norm = g_strdup (uri1);
+
+  if (g_str_has_suffix (uri2, "/"))
+    uri2_norm = g_strndup (uri2, uri2_len - 1);
+  else
+    uri2_norm = g_strdup (uri2);
+
+  return g_strcmp0 (uri1_norm, uri2_norm) == 0;
+}
+
 /* This tries to find a pre-configured remote for the specified uri
  * and (optionally) collection id. This is a bit more complex than it
  * sounds, because a local remote could be configured in different
@@ -11298,6 +11326,8 @@ flatpak_dir_create_remote_for_ref_file (FlatpakDir *self,
  *  If the collection id is the same (and specified), its going to be
  *  the same remote, even if the url is different (because it could be
  *  some other mirror of the same repo).
+ *
+ *  We also consider non-OCI URLs equal even if one lacks a trailing slash.
  */
 char *
 flatpak_dir_find_remote_by_uri (FlatpakDir *self,
@@ -11306,6 +11336,9 @@ flatpak_dir_find_remote_by_uri (FlatpakDir *self,
 {
   g_auto(GStrv) remotes = NULL;
 
+  g_return_val_if_fail (self != NULL, NULL);
+  g_return_val_if_fail (uri != NULL, NULL);
+
   if (!flatpak_dir_ensure_repo (self, NULL, NULL))
     return NULL;
 
@@ -11334,9 +11367,9 @@ flatpak_dir_find_remote_by_uri (FlatpakDir *self,
               strcmp (collection_id, remote_collection_id) == 0)
             return g_strdup (remote);
 
-          /* Same repo if uris matches, unless both have collection-id
+          /* Same repo if uris match, unless both have collection-id
              specified but different */
-          if (strcmp (uri, remote_uri) == 0 &&
+          if (_flatpak_uri_equal (uri, remote_uri) &&
               !(collection_id != NULL &&
                 remote_collection_id != NULL &&
                 strcmp (collection_id, remote_collection_id) != 0))
@@ -12626,6 +12659,9 @@ flatpak_dir_find_local_related_for_metadata (FlatpakDir   *self,
           g_autofree char *extension = NULL;
           g_autofree char *version = g_key_file_get_string (metakey, groups[i],
                                                             FLATPAK_METADATA_KEY_VERSION, NULL);
+          g_auto(GStrv) versions = g_key_file_get_string_list (metakey, groups[i],
+                                                               FLATPAK_METADATA_KEY_VERSIONS,
+                                                               NULL, NULL);
           gboolean subdirectories = g_key_file_get_boolean (metakey, groups[i],
                                                             FLATPAK_METADATA_KEY_SUBDIRECTORIES, NULL);
           gboolean no_autodownload = g_key_file_get_boolean (metakey, groups[i],
@@ -12638,19 +12674,24 @@ flatpak_dir_find_local_related_for_metadata (FlatpakDir   *self,
                                                         FLATPAK_METADATA_KEY_AUTODELETE, NULL);
           gboolean locale_subset = g_key_file_get_boolean (metakey, groups[i],
                                                            FLATPAK_METADATA_KEY_LOCALE_SUBSET, NULL);
-          const char *branch;
-          g_autofree char *extension_ref = NULL;
-          g_autofree char *prefixed_extension_ref = NULL;
-          g_autofree char *checksum = NULL;
           g_autofree char *extension_collection_id = NULL;
+          const char *default_branches[] = { NULL, NULL};
+          const char **branches;
+          int branch_i;
 
           /* Parse actual extension name */
           flatpak_parse_extension_with_tag (tagged_extension, &extension, NULL);
 
-          if (version)
-            branch = version;
+          if (versions)
+            branches = (const char **) versions;
           else
-            branch = parts[3];
+            {
+              if (version)
+                default_branches[0] = version;
+              else
+                default_branches[0] = parts[3];
+              branches = default_branches;
+            }
 
           extension_collection_id = g_key_file_get_string (metakey, groups[i],
                                                            FLATPAK_METADATA_KEY_COLLECTION_ID, NULL);
@@ -12670,38 +12711,46 @@ flatpak_dir_find_local_related_for_metadata (FlatpakDir   *self,
           g_clear_pointer (&extension_collection_id, g_free);
           extension_collection_id = g_strdup (collection_id);
 
-          extension_ref = g_build_filename ("runtime", extension, parts[2], branch, NULL);
-          prefixed_extension_ref = g_strdup_printf ("%s:%s", remote_name, extension_ref);
-          if (ostree_repo_resolve_rev (self->repo,
-                                       prefixed_extension_ref,
-                                       FALSE,
-                                       &checksum,
-                                       NULL))
-            {
-              add_related (self, related, extension, extension_collection_id, extension_ref,
-                           checksum, no_autodownload, download_if, autoprune_unless, autodelete, locale_subset);
-            }
-          else if (subdirectories)
+          for (branch_i = 0; branches[branch_i] != NULL; branch_i++)
             {
-              g_autoptr(GPtrArray) matches = local_match_prefix (self, extension_ref, remote_name);
-              int j;
-              for (j = 0; j < matches->len; j++)
-                {
-                  const char *match = g_ptr_array_index (matches, j);
-                  g_autofree char *prefixed_match = NULL;
-                  g_autofree char *match_checksum = NULL;
-
-                  prefixed_match = g_strdup_printf ("%s:%s", remote_name, match);
+              g_autofree char *extension_ref = NULL;
+              g_autofree char *checksum = NULL;
+              g_autofree char *prefixed_extension_ref = NULL;
+              const char *branch = branches[branch_i];
 
-                  if (ostree_repo_resolve_rev (self->repo,
-                                               prefixed_match,
-                                               FALSE,
-                                               &match_checksum,
-                                               NULL))
+              extension_ref = g_build_filename ("runtime", extension, parts[2], branch, NULL);
+              prefixed_extension_ref = g_strdup_printf ("%s:%s", remote_name, extension_ref);
+              if (ostree_repo_resolve_rev (self->repo,
+                                           prefixed_extension_ref,
+                                           FALSE,
+                                           &checksum,
+                                           NULL))
+                {
+                  add_related (self, related, extension, extension_collection_id, extension_ref,
+                               checksum, no_autodownload, download_if, autoprune_unless, autodelete, locale_subset);
+                }
+              else if (subdirectories)
+                {
+                  g_autoptr(GPtrArray) matches = local_match_prefix (self, extension_ref, remote_name);
+                  int j;
+                  for (j = 0; j < matches->len; j++)
                     {
-                      add_related (self, related, extension,
-                                   extension_collection_id, match, match_checksum,
-                                   no_autodownload, download_if, autoprune_unless, autodelete, locale_subset);
+                      const char *match = g_ptr_array_index (matches, j);
+                      g_autofree char *prefixed_match = NULL;
+                      g_autofree char *match_checksum = NULL;
+
+                      prefixed_match = g_strdup_printf ("%s:%s", remote_name, match);
+
+                      if (ostree_repo_resolve_rev (self->repo,
+                                                   prefixed_match,
+                                                   FALSE,
+                                                   &match_checksum,
+                                                   NULL))
+                        {
+                          add_related (self, related, extension,
+                                       extension_collection_id, match, match_checksum,
+                                       no_autodownload, download_if, autoprune_unless, autodelete, locale_subset);
+                        }
                     }
                 }
             }
diff --git a/common/flatpak-installation.c b/common/flatpak-installation.c
index 5fef0e63..8e8420f2 100644
--- a/common/flatpak-installation.c
+++ b/common/flatpak-installation.c
@@ -1185,7 +1185,8 @@ flatpak_installation_list_installed_refs_for_update (FlatpakInstallation *self,
 /* Find all USB and LAN repositories which share the same collection ID as
  * @remote_name, and add a #FlatpakRemote to @remotes for each of them. The caller
  * must initialise @remotes. Returns %TRUE without modifying @remotes if the
- * given remote doesn’t have a collection ID configured.
+ * given remote doesn’t have a collection ID configured or if the @dir doesn’t
+ * have a repo.
  *
  * FIXME: If this were async, the parallelisation could be handled in the caller. */
 static gboolean
@@ -1197,6 +1198,7 @@ list_remotes_for_configured_remote (FlatpakInstallation *self,
                                     GCancellable        *cancellable,
                                     GError             **error)
 {
+  OstreeRepo *repo;
   g_autofree gchar *collection_id = NULL;
   OstreeCollectionRef ref;
   OstreeCollectionRef ref2;
@@ -1216,8 +1218,12 @@ list_remotes_for_configured_remote (FlatpakInstallation *self,
       !types_filter[FLATPAK_REMOTE_TYPE_LAN])
     return TRUE;
 
+  repo = flatpak_dir_get_repo (dir);
+  if (repo == NULL)
+    return TRUE;
+
   /* Find the collection ID for @remote_name, or bail if there is none. */
-  if (!ostree_repo_get_remote_option (flatpak_dir_get_repo (dir),
+  if (!ostree_repo_get_remote_option (repo,
                                       remote_name, "collection-id",
                                       NULL, &collection_id, error))
     return FALSE;
@@ -1261,7 +1267,7 @@ list_remotes_for_configured_remote (FlatpakInstallation *self,
         }
     }
 
-  ostree_repo_find_remotes_async (flatpak_dir_get_repo (dir),
+  ostree_repo_find_remotes_async (repo,
                                   (const OstreeCollectionRef * const *) refs,
                                   NULL,  /* no options */
                                   finders,
@@ -1273,7 +1279,7 @@ list_remotes_for_configured_remote (FlatpakInstallation *self,
   while (result == NULL)
     g_main_context_iteration (context, TRUE);
 
-  results = ostree_repo_find_remotes_finish (flatpak_dir_get_repo (dir), result, error);
+  results = ostree_repo_find_remotes_finish (repo, result, error);
 
   if (types_filter[FLATPAK_REMOTE_TYPE_LAN])
     ostree_repo_finder_avahi_stop (OSTREE_REPO_FINDER_AVAHI (finder_avahi));
diff --git a/common/flatpak-oci-registry.c b/common/flatpak-oci-registry.c
index fe9afbdd..e6e1d1aa 100644
--- a/common/flatpak-oci-registry.c
+++ b/common/flatpak-oci-registry.c
@@ -2223,13 +2223,18 @@ add_icon_image (SoupSession  *soup_session,
       g_autoptr(SoupURI) base_uri = soup_uri_new (index_uri);
       g_autoptr(SoupURI) icon_uri = soup_uri_new_with_base (base_uri, icon_data);
       g_autofree char *icon_uri_s = soup_uri_to_string (icon_uri, FALSE);
+      g_autoptr(GError) local_error = NULL;
 
       if (!flatpak_cache_http_uri (soup_session, icon_uri_s,
                                    0 /* flags */,
                                    icons_dfd, icon_path,
                                    NULL, NULL,
-                                   cancellable, error))
-        return FALSE;
+                                   cancellable, &local_error) &&
+          !g_error_matches (local_error, FLATPAK_OCI_ERROR, FLATPAK_OCI_ERROR_NOT_CHANGED))
+        {
+          g_propagate_error (error, g_steal_pointer (&local_error));
+          return FALSE;
+        }
 
       g_hash_table_replace (used_icons, g_steal_pointer (&icon_path), GUINT_TO_POINTER (1));
 
@@ -2473,6 +2478,9 @@ flatpak_oci_index_make_appstream (SoupSession  *soup_session,
         }
     }
 
+  if (g_cancellable_set_error_if_cancelled (cancellable, error))
+    return NULL;
+
   if (!flatpak_appstream_xml_root_to_data (appstream_root,
                                            &bytes, NULL, error))
     return NULL;
diff --git a/common/flatpak-transaction.c b/common/flatpak-transaction.c
index e84860b5..a870d300 100644
--- a/common/flatpak-transaction.c
+++ b/common/flatpak-transaction.c
@@ -1581,11 +1581,13 @@ add_deps (FlatpakTransaction          *self,
   g_autofree char *runtime_remote = NULL;
   FlatpakTransactionOperation *runtime_op = NULL;
 
-  if (!g_str_has_prefix (op->ref, "app/"))
+  if (!op->resolved_metakey)
     return TRUE;
 
-  if (op->resolved_metakey)
+  if (g_str_has_prefix (op->ref, "app/"))
     runtime_ref = g_key_file_get_string (op->resolved_metakey, "Application", "runtime", NULL);
+  else
+    runtime_ref = g_key_file_get_string (op->resolved_metakey, "ExtensionOf", "runtime", NULL);
 
   if (runtime_ref == NULL)
     return TRUE;
@@ -1805,7 +1807,7 @@ flatpak_transaction_add_install_bundle (FlatpakTransaction *self,
 {
   FlatpakTransactionPrivate *priv = flatpak_transaction_get_instance_private (self);
 
-  priv->bundles = g_list_append (priv->flatpakrefs, bundle_data_new (file, gpg_data));
+  priv->bundles = g_list_append (priv->bundles, bundle_data_new (file, gpg_data));
 
   return TRUE;
 }
diff --git a/common/flatpak-utils.c b/common/flatpak-utils.c
index a2740db1..4af75860 100644
--- a/common/flatpak-utils.c
+++ b/common/flatpak-utils.c
@@ -5917,32 +5917,79 @@ flatpak_check_required_version (const char *ref,
                                 GKeyFile   *metakey,
                                 GError    **error)
 {
-  g_autofree char *required_version = NULL;
+  g_auto(GStrv) required_versions = NULL;
   const char *group;
-  int required_major, required_minor, required_micro;
+  int max_required_major = 0, max_required_minor = 0;
+  const char *max_required_version = "0.0";
+  int i;
 
   if (g_str_has_prefix (ref, "app/"))
     group = "Application";
   else
     group = "Runtime";
 
-  required_version = g_key_file_get_string (metakey, group, "required-flatpak", NULL);
-  if (required_version)
+  /* We handle handle multiple version requirements here. Each requirement must
+   * be in the form major.minor.micro, and if the flatpak version matches the
+   * major.minor part, t must be equal or later in the micro. If the major.minor part
+   * doesn't exactly match any of the specified requirements it must be larger
+   * than the maximum specified requirement.
+   *
+   * For example, specifying
+   *   required-flatpak=1.6.2;1.4.2;1.0.2;
+   * would allow flatpak versions:
+   *  1.7.0, 1.6.2, 1.6.3, 1.4.2, 1.4.3, 1.0.2, 1.0.3
+   * but not:
+   *  1.6.1, 1.4.1 or 1.2.100.
+   *
+   * The goal here is to be able to specify a version (like 1.6.2 above) where a feature
+   * was introduced, but also allow backports of said feature to earlier version series.
+   *
+   * Earlier versions that only support specifying one version will only look at the first
+   * element in the list, so put the largest version first.
+   */
+  required_versions = g_key_file_get_string_list (metakey, group, "required-flatpak", NULL, NULL);
+  if (required_versions == 0 || required_versions[0] == NULL)
+    return TRUE;
+
+  for (i = 0; required_versions[i] != NULL; i++)
     {
+      int required_major, required_minor, required_micro;
+      const char *required_version = required_versions[i];
+
       if (sscanf (required_version, "%d.%d.%d", &required_major, &required_minor, &required_micro) != 3)
         return flatpak_fail_error (error, FLATPAK_ERROR_INVALID_DATA,
                                    _("Invalid require-flatpak argument %s"), required_version);
       else
         {
-          if (required_major > PACKAGE_MAJOR_VERSION ||
-              (required_major == PACKAGE_MAJOR_VERSION && required_minor > PACKAGE_MINOR_VERSION) ||
-              (required_major == PACKAGE_MAJOR_VERSION && required_minor == PACKAGE_MINOR_VERSION && required_micro > PACKAGE_MICRO_VERSION))
-            return flatpak_fail_error (error, FLATPAK_ERROR_NEED_NEW_FLATPAK,
-                                       _("%s needs a later flatpak version (%s)"),
-                                       ref, required_version);
+          /* If flatpak is in the same major.minor series as the requirement, do a micro check */
+          if (required_major == PACKAGE_MAJOR_VERSION && required_minor == PACKAGE_MINOR_VERSION)
+            {
+              if (required_micro <= PACKAGE_MICRO_VERSION)
+                return TRUE;
+              else
+                return flatpak_fail_error (error, FLATPAK_ERROR_NEED_NEW_FLATPAK,
+                                           _("%s needs a later flatpak version (%s)"),
+                                           ref, required_version);
+            }
+
+          /* Otherwise, keep track of the largest major.minor that is required */
+          if ((required_major > max_required_major) ||
+              (required_major == max_required_major &&
+               required_minor > max_required_minor))
+            {
+              max_required_major = required_major;
+              max_required_minor = required_minor;
+              max_required_version = required_version;
+            }
         }
     }
 
+  if (max_required_major > PACKAGE_MAJOR_VERSION ||
+      (max_required_major == PACKAGE_MAJOR_VERSION && max_required_minor > PACKAGE_MINOR_VERSION))
+    return flatpak_fail_error (error, FLATPAK_ERROR_NEED_NEW_FLATPAK,
+                               _("%s needs a later flatpak version (%s)"),
+                               ref, max_required_version);
+
   return TRUE;
 }
 
diff --git a/common/flatpak-version-macros.h b/common/flatpak-version-macros.h
index cc086ae1..81f0abc3 100644
--- a/common/flatpak-version-macros.h
+++ b/common/flatpak-version-macros.h
@@ -44,7 +44,7 @@
  *
  * The micro version.
  */
-#define FLATPAK_MICRO_VERSION (4)
+#define FLATPAK_MICRO_VERSION (5)
 
 /**
  * FLATPAK_CHECK_VERSION:
diff --git a/configure.ac b/configure.ac
index 24866b8f..ed4ab1df 100644
--- a/configure.ac
+++ b/configure.ac
@@ -15,7 +15,7 @@ AC_PREREQ([2.63])
 
 m4_define([flatpak_major_version], [1])
 m4_define([flatpak_minor_version], [2])
-m4_define([flatpak_micro_version], [4])
+m4_define([flatpak_micro_version], [5])
 m4_define([flatpak_extra_version], [])
 m4_define([flatpak_interface_age], [0])
 m4_define([flatpak_binary_age],
diff --git a/debian/changelog b/debian/changelog
index 683190b3..18ba708a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+flatpak (1.2.5-0+deb10u1) UNRELEASED; urgency=medium
+
+  * New upstream stable release
+    - Allow runtimes (not just apps) to use extra_data, which is required
+      by the new org.freedesktop.Platform.openh264 extension
+    - Support apps that specify several required Flatpak versions,
+      such as 1.4.2;1.2.5; for runtimes that require the above feature
+    - Backport some crash bug fixes from 1.4.x
+    - Fix installation of bundles
+    - Set looser permissions on the /run/host/monitor directory, to
+      work better with tools like Fedora Toolbox on the host system
+    - Do not wrongly remove extensions as "unused" if they are referenced
+      by the 'versions' extension key rather than by 'version'
+  * d/gbp.conf: Use debian/buster packaging branch
+  * d/watch: Only look for 1.2.x releases
+
+ -- Simon McVittie <smcv@debian.org>  Thu, 19 Sep 2019 15:57:26 +0100
+
 flatpak (1.2.4-1) unstable; urgency=medium
 
   * New upstream stable release
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 87199012..00cf1211 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,7 +1,7 @@
 [DEFAULT]
 pristine-tar = True
 compression = xz
-debian-branch = debian/master
+debian-branch = debian/buster
 upstream-branch = upstream/1.2.x
 patch-numbers = False
 upstream-vcs-tag = %(version)s
diff --git a/debian/watch b/debian/watch
index 4eaffe93..efd3cca1 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,2 +1,2 @@
 version=4
-https://github.com/@PACKAGE@/@PACKAGE@/releases .*/@PACKAGE@-(\d+\.\d*[02468]\.[\-+\.:\~\da-zA-Z]*)@ARCHIVE_EXT@
+https://github.com/@PACKAGE@/@PACKAGE@/releases .*/@PACKAGE@-(1\.2\.[\-+\.:\~\da-zA-Z]*)@ARCHIVE_EXT@
diff --git a/doc/flatpak-metadata.xml b/doc/flatpak-metadata.xml
index c2fdc7d8..e3e60bf4 100644
--- a/doc/flatpak-metadata.xml
+++ b/doc/flatpak-metadata.xml
@@ -100,12 +100,19 @@
                     </listitem>
                 </varlistentry>
                 <varlistentry>
-                    <term><option>required-flatpak</option> (string)</term>
+                    <term><option>required-flatpak</option> (string list)</term>
                     <listitem><para>
                         The required version of Flatpak to run this application
                         or runtime. For applications, this was available since
                         0.8.0. For runtimes, this was available since 0.9.1,
                         and backported to 0.8.3 for the 0.8.x branch.
+                      </para><para>
+                        Flatpak after version 1.4.3 and 1.2.5 support multiple versions here.
+                        This can be useful if you need to support features that are backported
+                        to a previous stable series. For example if you want to use a feature
+                        added in 1.6.0 that was also backported to 1.4.4 you would use
+                        <literal>1.6.0;1.4.4;</literal>. Note that older versions of flatpak will
+                        just use the first element in the list, so make that the largest version.
                     </para></listitem>
                 </varlistentry>
                 <varlistentry>
@@ -498,7 +505,7 @@
                 <varlistentry>
                     <term><option>build</option> (boolean)</term>
                     <listitem><para>
-                        Whether this instance was created by flatpak build. 
+                        Whether this instance was created by flatpak build.
                     </para></listitem>
                 </varlistentry>
                 <varlistentry>
@@ -804,6 +811,15 @@
                         belongs to. Available since 0.9.1.
                     </para></listitem>
                 </varlistentry>
+                <varlistentry>
+                    <term><option>runtime</option> (string)</term>
+                    <listitem><para>
+                        The runtime this extension will be inside of. If it is an
+                        app extension, this is the app's runtime; otherwise, this
+                        is identical to ref, without the runtime/ prefix.
+                        Available since 1.5.0.
+                    </para></listitem>
+                </varlistentry>
                 <varlistentry>
                     <term><option>priority</option> (integer)</term>
                     <listitem><para>
diff --git a/doc/reference/libflatpak-docs.xml b/doc/reference/libflatpak-docs.xml
index f2005000..ac7fa384 100644
--- a/doc/reference/libflatpak-docs.xml
+++ b/doc/reference/libflatpak-docs.xml
@@ -6,7 +6,7 @@
   <!ENTITY % gtkdocentities SYSTEM "xml/gtkdocentities.ent">
   %gtkdocentities;
 ]>
-<book id="index">
+<book id="index" xmlns:xi="http://www.w3.org/2003/XInclude";>
   <bookinfo>
     <title>&package_name; Reference Manual</title>
     <releaseinfo>
@@ -18,7 +18,7 @@
 
   <chapter>
     <title>[Insert title here]</title>
-        <xi:include href="xml/flatpak-installation.xml"/>
+    <xi:include href="xml/flatpak-installation.xml"/>
     <xi:include href="xml/flatpak-installed-ref.xml"/>
     <xi:include href="xml/flatpak-remote-ref.xml"/>
     <xi:include href="xml/flatpak-related-ref.xml"/>
@@ -31,7 +31,6 @@
     <xi:include href="xml/flatpak-error.xml"/>
     <xi:include href="xml/flatpak-bundle-ref.xml"/>
     <xi:include href="xml/flatpak-instance.xml"/>
-
   </chapter>
   <chapter id="object-tree">
     <title>Object Hierarchy</title>
@@ -45,65 +44,81 @@
     <title>Index of deprecated API</title>
     <xi:include href="xml/api-index-deprecated.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-1-1-1" role="1.1.1">
-    <title>Index of new API in 1.1.1</title>
-    <xi:include href="xml/api-index-1.1.1.xml"><xi:fallback /></xi:include>
-  </index>
-  <index id="api-index-0-8" role="0.8">
-    <title>Index of new API in 0.8</title>
-    <xi:include href="xml/api-index-0.8.xml"><xi:fallback /></xi:include>
+  <index id="api-index-0-6-13" role="0.6.13">
+    <title>Index of new API in 0.6.13</title>
+    <xi:include href="xml/api-index-0.6.13.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-1-1-2" role="1.1.2">
-    <title>Index of new API in 1.1.2</title>
-    <xi:include href="xml/api-index-1.1.2.xml"><xi:fallback /></xi:include>
+  <index id="api-index-1-0-3" role="1.0.3">
+    <title>Index of new API in 1.0.3</title>
+    <xi:include href="xml/api-index-1.0.3.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-0-11-8" role="0.11.8">
-    <title>Index of new API in 0.11.8</title>
-    <xi:include href="xml/api-index-0.11.8.xml"><xi:fallback /></xi:include>
+  <index id="api-index-2-26" role="2.26">
+    <title>Index of new API in 2.26</title>
+    <xi:include href="xml/api-index-2.26.xml"><xi:fallback /></xi:include>
   </index>
   <index id="api-index-1-1" role="1.1">
     <title>Index of new API in 1.1</title>
     <xi:include href="xml/api-index-1.1.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-0-10-0" role="0.10.0">
-    <title>Index of new API in 0.10.0</title>
-    <xi:include href="xml/api-index-0.10.0.xml"><xi:fallback /></xi:include>
+  <index id="api-index-1-1-1" role="1.1.1">
+    <title>Index of new API in 1.1.1</title>
+    <xi:include href="xml/api-index-1.1.1.xml"><xi:fallback /></xi:include>
   </index>
   <index id="api-index-0-9-8" role="0.9.8">
     <title>Index of new API in 0.9.8</title>
     <xi:include href="xml/api-index-0.9.8.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-1-0-3" role="1.0.3">
-    <title>Index of new API in 1.0.3</title>
-    <xi:include href="xml/api-index-1.0.3.xml"><xi:fallback /></xi:include>
-  </index>
-  <index id="api-index-0-6-7" role="0.6.7">
-    <title>Index of new API in 0.6.7</title>
-    <xi:include href="xml/api-index-0.6.7.xml"><xi:fallback /></xi:include>
-  </index>
-  <index id="api-index-0-8-0" role="0.8.0">
-    <title>Index of new API in 0.8.0</title>
-    <xi:include href="xml/api-index-0.8.0.xml"><xi:fallback /></xi:include>
-  </index>
-  <index id="api-index-0-6-13" role="0.6.13">
-    <title>Index of new API in 0.6.13</title>
-    <xi:include href="xml/api-index-0.6.13.xml"><xi:fallback /></xi:include>
-  </index>
   <index id="api-index-0-6-12" role="0.6.12">
     <title>Index of new API in 0.6.12</title>
     <xi:include href="xml/api-index-0.6.12.xml"><xi:fallback /></xi:include>
   </index>
+  <index id="api-index-0-8" role="0.8">
+    <title>Index of new API in 0.8</title>
+    <xi:include href="xml/api-index-0.8.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-0-10-0" role="0.10.0">
+    <title>Index of new API in 0.10.0</title>
+    <xi:include href="xml/api-index-0.10.0.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-0-11-8" role="0.11.8">
+    <title>Index of new API in 0.11.8</title>
+    <xi:include href="xml/api-index-0.11.8.xml"><xi:fallback /></xi:include>
+  </index>
   <index id="api-index-0-6-10" role="0.6.10">
     <title>Index of new API in 0.6.10</title>
     <xi:include href="xml/api-index-0.6.10.xml"><xi:fallback /></xi:include>
   </index>
-  <index id="api-index-2-26" role="2.26">
-    <title>Index of new API in 2.26</title>
-    <xi:include href="xml/api-index-2.26.xml"><xi:fallback /></xi:include>
+  <index id="api-index-0-8-0" role="0.8.0">
+    <title>Index of new API in 0.8.0</title>
+    <xi:include href="xml/api-index-0.8.0.xml"><xi:fallback /></xi:include>
   </index>
   <index id="api-index-0-6-15" role="0.6.15">
     <title>Index of new API in 0.6.15</title>
     <xi:include href="xml/api-index-0.6.15.xml"><xi:fallback /></xi:include>
   </index>
+  <index id="api-index-0-6-7" role="0.6.7">
+    <title>Index of new API in 0.6.7</title>
+    <xi:include href="xml/api-index-0.6.7.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-1-1-2" role="1.1.2">
+    <title>Index of new API in 1.1.2</title>
+    <xi:include href="xml/api-index-1.1.2.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-1-3-4" role="1.3.4">
+    <title>Index of new API in 1.3.4</title>
+    <xi:include href="xml/api-index-1.3.4.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-1-3-3-" role="1.3.3.">
+    <title>Index of new API in 1.3.3.</title>
+    <xi:include href="xml/api-index-1.3.3..xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-1-4" role="1.4">
+    <title>Index of new API in 1.4</title>
+    <xi:include href="xml/api-index-1.4.xml"><xi:fallback /></xi:include>
+  </index>
+  <index id="api-index-1-3-3" role="1.3.3">
+    <title>Index of new API in 1.3.3</title>
+    <xi:include href="xml/api-index-1.3.3.xml"><xi:fallback /></xi:include>
+  </index>
   <xi:include href="xml/annotation-glossary.xml"><xi:fallback /></xi:include>
 </book>
diff --git a/icon-validator/validate-icon.c b/icon-validator/validate-icon.c
index 6e23d9f2..6c4cae20 100644
--- a/icon-validator/validate-icon.c
+++ b/icon-validator/validate-icon.c
@@ -136,7 +136,7 @@ rerun_in_sandbox (const char *arg_width,
   ssize_t symlink_size;
 
   symlink_size = readlink ("/proc/self/exe", validate_icon, sizeof (validate_icon) - 1);
-  if (symlink_size < 0)
+  if (symlink_size < 0 || (size_t) symlink_size >= sizeof (validate_icon))
     {
       g_printerr ("Error: failed to read /proc/self/exe\n");
       return 1;
diff --git a/po/cs.gmo b/po/cs.gmo
index ffcd36f3..d69b4381 100644
Binary files a/po/cs.gmo and b/po/cs.gmo differ
diff --git a/po/de.gmo b/po/de.gmo
index 15354612..dada02b6 100644
Binary files a/po/de.gmo and b/po/de.gmo differ
diff --git a/po/es.gmo b/po/es.gmo
index 963bfc90..9a5620b2 100644
Binary files a/po/es.gmo and b/po/es.gmo differ
diff --git a/po/gl.gmo b/po/gl.gmo
index 28f64d7f..b970a19f 100644
Binary files a/po/gl.gmo and b/po/gl.gmo differ
diff --git a/po/hu.gmo b/po/hu.gmo
index 16cabe89..5bf8d107 100644
Binary files a/po/hu.gmo and b/po/hu.gmo differ
diff --git a/po/id.gmo b/po/id.gmo
index e4c914ef..8e147de8 100644
Binary files a/po/id.gmo and b/po/id.gmo differ
diff --git a/po/pl.gmo b/po/pl.gmo
index ba879fa9..3bb62389 100644
Binary files a/po/pl.gmo and b/po/pl.gmo differ
diff --git a/po/pt_BR.gmo b/po/pt_BR.gmo
index fb58f998..ad716417 100644
Binary files a/po/pt_BR.gmo and b/po/pt_BR.gmo differ
diff --git a/po/ru.gmo b/po/ru.gmo
index 2a3f3cd6..17a85a8c 100644
Binary files a/po/ru.gmo and b/po/ru.gmo differ
diff --git a/po/sk.gmo b/po/sk.gmo
index ae0d2c1f..dbe81f7d 100644
Binary files a/po/sk.gmo and b/po/sk.gmo differ
diff --git a/po/sv.gmo b/po/sv.gmo
index 5b2714b7..e2541599 100644
Binary files a/po/sv.gmo and b/po/sv.gmo differ
diff --git a/po/tr.gmo b/po/tr.gmo
index b8bdb297..e6e448ce 100644
Binary files a/po/tr.gmo and b/po/tr.gmo differ
diff --git a/po/uk.gmo b/po/uk.gmo
index cdef8363..976ba45d 100644
Binary files a/po/uk.gmo and b/po/uk.gmo differ
diff --git a/po/zh_TW.gmo b/po/zh_TW.gmo
index acd85bed..90817070 100644
Binary files a/po/zh_TW.gmo and b/po/zh_TW.gmo differ
diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
index 868ea642..5c4f2fe9 100644
--- a/portal/flatpak-portal.c
+++ b/portal/flatpak-portal.c
@@ -907,7 +907,7 @@ main (int    argc,
     }
 
   exe_path_len = readlink ("/proc/self/exe", exe_path, sizeof (exe_path) - 1);
-  if (exe_path_len > 0)
+  if (exe_path_len > 0 && (size_t) exe_path_len < sizeof (exe_path))
     {
       exe_path[exe_path_len] = 0;
       GFileMonitor *monitor;
diff --git a/session-helper/flatpak-session-helper.c b/session-helper/flatpak-session-helper.c
index 1953305b..d90f2b15 100644
--- a/session-helper/flatpak-session-helper.c
+++ b/session-helper/flatpak-session-helper.c
@@ -845,7 +845,7 @@ main (int    argc,
     g_debug ("p11-kit not found");
 
   monitor_dir = g_build_filename (flatpak_dir, "monitor", NULL);
-  if (g_mkdir_with_parents (monitor_dir, 0700) != 0)
+  if (g_mkdir_with_parents (monitor_dir, 0755) != 0)
     {
       g_print ("Can't create %s\n", monitor_dir);
       exit (1);
diff --git a/tests/make-test-app.sh b/tests/make-test-app.sh
index 86afd48d..cd341603 100755
--- a/tests/make-test-app.sh
+++ b/tests/make-test-app.sh
@@ -25,7 +25,15 @@ cat > ${DIR}/metadata <<EOF
 name=$APP_ID
 runtime=org.test.Platform/$ARCH/master
 sdk=org.test.Platform/$ARCH/master
+EOF
+
+if [ x${REQUIRED_VERSION-} != x ]; then
+cat >> ${DIR}/metadata <<EOF
+required-flatpak=$REQUIRED_VERSION
+EOF
+fi
 
+cat >> ${DIR}/metadata <<EOF
 [Extension org.test.Hello.Locale]
 directory=share/runtime/locale
 autodelete=true
diff --git a/tests/package_version.txt b/tests/package_version.txt
index e8ea05db..c813fe11 100644
--- a/tests/package_version.txt
+++ b/tests/package_version.txt
@@ -1 +1 @@
-1.2.4
+1.2.5
diff --git a/tests/test-repo.sh b/tests/test-repo.sh
index 4a309760..dca0a0d5 100755
--- a/tests/test-repo.sh
+++ b/tests/test-repo.sh
@@ -23,7 +23,7 @@ set -euo pipefail
 
 skip_without_bwrap
 
-echo "1..27"
+echo "1..29"
 
 #Regular repo
 setup_repo
@@ -169,6 +169,44 @@ fi
 
 echo "ok missing remote name auto-corrects for install"
 
+# Use a new remote so we can be sure it doesn't match any existing one's URL
+setup_repo_no_add flatpakref org.test.Collection.Flatpakref
+
+cat << EOF > repos/flatpakref/flatpakref-repo.flatpakrepo
+[Flatpak Repo]
+Version=1
+Url=http://127.0.0.1:$(cat httpd-port-main)/flatpakref/
+Title=The Title
+GPGKey=${FL_GPG_BASE64}
+EOF
+
+if [ x${USE_COLLECTIONS_IN_CLIENT-} == xyes ]; then
+    echo "DeployCollectionID=org.test.Collection.Flatpakref" >> repos/flatpakref/flatpakref-repo.flatpakrepo
+fi
+
+cat << EOF > org.test.Hello.flatpakref
+[Flatpak Ref]
+Name=org.test.Hello
+Branch=master
+Url=http://127.0.0.1:$(cat httpd-port-main)/flatpakref
+GPGKey=${FL_GPG_BASE64}
+RuntimeRepo=http://127.0.0.1:$(cat httpd-port-main)/flatpakref/flatpakref-repo.flatpakrepo
+EOF
+
+${FLATPAK} ${U} uninstall -y org.test.Platform org.test.Hello
+
+# Ensure that only one remote is added even though the URL in the flatpakref
+# does not have a trailing slash and the URL in the flatpakrepo file does
+NUM_REMOTES_BEFORE=$(flatpak remotes | wc -l)
+${FLATPAK} ${U} install -y org.test.Hello.flatpakref
+NUM_REMOTES_AFTER=$(flatpak remotes | wc -l)
+
+if [ $NUM_REMOTES_AFTER -ne $((NUM_REMOTES_BEFORE + 1)) ]; then
+    assert_not_reached "install of flatpakref should only add one remote"
+fi
+
+echo "ok install flatpakref normalizes remote URL trailing slash"
+
 ${FLATPAK} ${U} uninstall -y org.test.Platform org.test.Hello
 
 if ${FLATPAK} ${U} install -y test-missing-gpg-repo org.test.Platform 2> install-error-log; then
@@ -196,6 +234,69 @@ assert_file_has_content install-error-log "GPG signatures found, but none are in
 
 echo "ok fail with wrong gpg key"
 
+make_required_version_app () {
+    APP_ID=${1}
+    VERSION=${2}
+    if [ x${USE_COLLECTIONS_IN_SERVER-} == xyes ] ; then
+        CID=org.test.Collection.test
+    else
+        CID=""
+    fi
+
+    REQUIRED_VERSION="${VERSION}" GPGARGS="${FL_GPGARGS}" $(dirname $0)/make-test-app.sh repos/test ${APP_ID} "${CID}" > /dev/null
+}
+
+CURRENT_VERSION=`cat "$test_builddir/package_version.txt"`
+V=( ${CURRENT_VERSION//./ } )  # Split parts to array
+
+make_required_version_app org.test.SameVersion "${V[0]}.${V[1]}.${V[2]}"
+make_required_version_app org.test.NeedNewerMicro "${V[0]}.${V[1]}.$(expr ${V[2]} + 1)"
+make_required_version_app org.test.NeedNewerMinor "${V[0]}.$(expr ${V[1]} + 1).${V[2]}"
+make_required_version_app org.test.NeedNewerMaster "$(expr ${V[0]} + 1).${V[1]}.${V[2]}"
+make_required_version_app org.test.NeedOlderMinor "${V[0]}.$(expr ${V[1]} - 1).${V[2]}"
+make_required_version_app org.test.MultiVersionFallback "${V[0]}.${V[1]}.${V[2]};1.0.0;"
+make_required_version_app org.test.MultiVersionFallbackFail "${V[0]}.$(expr ${V[1]} + 1).${V[2]};1.0.0;"
+make_required_version_app org.test.MultiVersionOk "${V[0]}.$(expr ${V[1]} + 1).0;${V[0]}.${V[1]}.${V[2]};"
+make_required_version_app org.test.MultiVersionNotOk "${V[0]}.$(expr ${V[1]} + 1).0;${V[0]}.${V[1]}.$(expr ${V[2]} + 1);"
+
+update_repo $REPONAME "${COLLECTION_ID}"
+
+${FLATPAK} ${U} install -y test-repo org.test.SameVersion
+${FLATPAK} ${U} install -y test-repo org.test.NeedOlderMinor
+
+if ${FLATPAK} ${U} install -y test-repo org.test.NeedNewerMicro 2> install-error-log; then
+    assert_not_reached "Should not be able to install with wrong micro version"
+fi
+assert_file_has_content install-error-log "needs a later flatpak version"
+
+if ${FLATPAK} ${U} install -y test-repo org.test.NeedNewerMinor 2> install-error-log; then
+    assert_not_reached "Should not be able to install with wrong minor version"
+fi
+assert_file_has_content install-error-log "needs a later flatpak version"
+
+if ${FLATPAK} ${U} install -y test-repo org.test.NeedNewerMajor 2> install-error-log; then
+    assert_not_reached "Should not be able to install with wrong micro version"
+fi
+assert_file_has_content install-error-log "needs a later flatpak version"
+
+${FLATPAK} ${U} install -y test-repo org.test.MultiVersionFallback
+
+if ${FLATPAK} ${U} install -y test-repo org.test.MultiVersionFallbackFail 2> install-error-log; then
+    assert_not_reached "Should not be able to install with wrong fallback version"
+fi
+assert_file_has_content install-error-log "needs a later flatpak version"
+
+${FLATPAK} ${U} install -y test-repo org.test.MultiVersionOk
+
+if ${FLATPAK} ${U} install -y test-repo org.test.MultiVersionNotOk 2> install-error-log; then
+    assert_not_reached "Should not be able to install with wrong multi version"
+fi
+assert_file_has_content install-error-log "needs a later flatpak version"
+
+${FLATPAK} ${U} uninstall -y --all
+
+echo "ok handles version requirements"
+
 ${FLATPAK} ${U} remotes -d | grep ^test-repo > repo-info
 assert_not_file_has_content repo-info "new-title"
 UPDATE_REPO_ARGS=--title=new-title update_repo

--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 10.2

Hi,

The fixes referenced by these bugs were included in today's 10.2 stable
point release.

Regards,

Adam

--- End Message ---

Reply to: