From 623536348cf332650ca64f2e8c7e2772d2c11511 Mon Sep 17 00:00:00 2001
From: Mateus Rodrigues Costa <mateusrodcosta@gmail.com>
Date: Sun, 5 Jul 2026 18:55:39 -0300
Subject: [PATCH] Upgrade to fdo 25.08 and tighten sandbox

- Upgrade runtime from fdo 24.08 to 25.08 and LLVM from 18 to 20
- Remove network permission
- Add ipc permission
- Replace broad devices permission with only dri and input permissions
- Make filesystem permissions read-only (:ro)
- Remove ccache support (conflicts with flatpak cache)
---
 .../io.github.hedge_dev.unleashedrecomp.json  | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/flatpak/io.github.hedge_dev.unleashedrecomp.json b/flatpak/io.github.hedge_dev.unleashedrecomp.json
index 5821bad23..afca70b08 100644
--- a/flatpak/io.github.hedge_dev.unleashedrecomp.json
+++ b/flatpak/io.github.hedge_dev.unleashedrecomp.json
@@ -1,26 +1,27 @@
 {
   "id": "io.github.hedge_dev.unleashedrecomp",
   "runtime": "org.freedesktop.Platform",
-  "runtime-version": "24.08",
+  "runtime-version": "25.08",
   "sdk": "org.freedesktop.Sdk",
-  "sdk-extensions" : [ "org.freedesktop.Sdk.Extension.llvm18" ],
+  "sdk-extensions" : [ "org.freedesktop.Sdk.Extension.llvm20" ],
   "finish-args": [
-    "--share=network",
+    "--share=ipc",
     "--socket=wayland",
     "--socket=fallback-x11",
     "--socket=pulseaudio",
-    "--device=all",
-    "--filesystem=host",
-    "--filesystem=/media",
-    "--filesystem=/run/media",
-    "--filesystem=/mnt"
+    "--device=dri",
+    "--device=input",
+    "--filesystem=host:ro",
+    "--filesystem=/media:ro",
+    "--filesystem=/run/media:ro",
+    "--filesystem=/mnt:ro"
   ],
   "modules": [
     {
       "name": "UnleashedRecomp",
       "buildsystem": "simple",
       "build-commands": [
-        "cmake --preset linux-release -DUNLEASHED_RECOMP_FLATPAK=ON -DSDL2MIXER_VORBIS=VORBISFILE -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_C_COMPILER_LAUNCHER=ccache",
+        "cmake --preset linux-release -DUNLEASHED_RECOMP_FLATPAK=ON -DSDL2MIXER_VORBIS=VORBISFILE",
         "cmake --build out/build/linux-release --target UnleashedRecomp",
         "mkdir -p /app/bin",
         "cp out/build/linux-release/UnleashedRecomp/UnleashedRecomp /app/bin/UnleashedRecomp",
@@ -35,8 +36,8 @@
         }
       ],
       "build-options": {
-        "append-path": "/usr/lib/sdk/llvm18/bin",
-        "prepend-ld-library-path": "/usr/lib/sdk/llvm18/lib",
+        "append-path": "/usr/lib/sdk/llvm20/bin",
+        "prepend-ld-library-path": "/usr/lib/sdk/llvm20/lib",
         "build-args": [
           "--share=network"
         ]