QueryaHub · ZhuchkaTriplesix · Jul 27, 2026 · Jul 27, 2026 · Jul 27, 2026 · Jul 27, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -146,13 +146,30 @@ jobs:
       - name: Build Linux .deb (Debian/Ubuntu)
         run: ./scripts/linux/build_deb.sh
 
+      - name: Build Linux .rpm (Fedora/RHEL)
+        run: |
+          sudo apt-get install -y rpm
+          ./scripts/linux/build_rpm.sh
+
+      - name: Install Flatpak toolchain
+        run: |
+          sudo apt-get install -y flatpak flatpak-builder
+          flatpak remote-add --if-not-exists --system flathub \
+            https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install -y --system flathub org.gnome.Platform//48 org.gnome.Sdk//48
+
+      - name: Build Linux Flatpak (installable)
+        run: ./scripts/linux/build_flatpak.sh
+
       - uses: actions/upload-artifact@v4
         with:
           name: bundle-linux
           path: |
             Querya-Desktop-${{ steps.version.outputs.version }}-linux.zip
             Querya-Desktop-${{ steps.version.outputs.version }}-linux.AppImage
             Querya-Desktop-${{ steps.version.outputs.version }}-linux.deb
+            Querya-Desktop-${{ steps.version.outputs.version }}-linux.rpm
+            Querya-Desktop-${{ steps.version.outputs.version }}-linux.flatpak
           if-no-files-found: error
 
   build-macos:
@@ -266,11 +283,13 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p dist
-          find artifacts \( -name '*.zip' -o -name '*.AppImage' -o -name '*.deb' -o -name '*-windows-setup.exe' \) \
+          find artifacts \( -name '*.zip' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.rpm' -o -name '*.flatpak' -o -name '*-windows-setup.exe' \) \
             -exec mv -t dist/ {} +
           test "$(find dist -name '*.zip' | wc -l)" -eq 3
           test "$(find dist -name '*.AppImage' | wc -l)" -eq 1
           test "$(find dist -name '*.deb' | wc -l)" -eq 1
+          test "$(find dist -name '*.rpm' | wc -l)" -eq 1
+          test "$(find dist -name '*.flatpak' | wc -l)" -eq 1
           test "$(find dist -name '*-windows-setup.exe' | wc -l)" -eq 1
           cd dist
           sha256sum *.* | tee SHA256SUMS.txt
@@ -296,9 +315,11 @@ jobs:
             echo "#### Installable"
             echo "- **Linux AppImage**: \`Querya-Desktop-${VERSION}-linux.AppImage\` (\`chmod +x\` then run)"
             echo "- **Linux .deb** (Debian/Ubuntu): \`Querya-Desktop-${VERSION}-linux.deb\` — \`sudo apt install ./Querya-Desktop-${VERSION}-linux.deb\`"
+            echo "- **Linux .rpm** (Fedora/RHEL): \`Querya-Desktop-${VERSION}-linux.rpm\` — \`sudo dnf install ./Querya-Desktop-${VERSION}-linux.rpm\`"
+            echo "- **Linux Flatpak**: \`Querya-Desktop-${VERSION}-linux.flatpak\` — \`flatpak install --user ./Querya-Desktop-${VERSION}-linux.flatpak\`"
             echo "- **Windows setup**: \`Querya-Desktop-${VERSION}-windows-setup.exe\` (Inno Setup)"
             echo ""
-            echo "RPM / Flatpak / AUR — follow-ups on #386."
+            echo "**Arch (AUR):** PKGBUILD in \`packaging/linux/aur/\` (community-maintained)."
             echo ""
             echo "Verify checksums: \`SHA256SUMS.txt\`"
             echo ""
@@ -326,6 +347,8 @@ jobs:
           files: |
             dist/*.zip
             dist/*.deb
+            dist/*.rpm
+            dist/*.flatpak
             dist/*.AppImage
             dist/*-windows-setup.exe
             dist/SHA256SUMS.txt

diff --git a/.gitignore b/.gitignore
@@ -45,5 +45,7 @@ docker/sqlite/data/
 
 # Local packaging outputs
 Querya-Desktop-*.deb
+Querya-Desktop-*.rpm
+Querya-Desktop-*.flatpak
 Querya-Desktop-*.AppImage
 Querya-Desktop-*.zip
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.11-a] - 2026-07-27
+
+Post-0.4.11 patch: security review hardening (#395–#402) and remaining Linux distro packages (#386).
+
+### Added
+
+- **Linux distro packaging (#386)** — `.rpm`, Flatpak (`.flatpak` bundle + manifest), and AUR PKGBUILD; Release CI publishes rpm + Flatpak alongside existing `.deb` / AppImage — see [packaging.md](docs/packaging.md).
+
+### Security
+
+- **Theme remote install localhost (#399)** — `ThemeRemoteInstallService` defaults `allowLocalhostInDebug` to `kDebugMode`.
+- **Archive path guard (#401)** — zip extraction uses `p.isWithin()` bounds checks (`archive_path_guard.dart`).
+- **Marketplace SHA256 (#396)** — `HttpMarketplaceRepository` requires manifest checksum before install.
+- **Marketplace download URLs (#397)** — HTTPS allowlist / SSRF policy (`MarketplaceDownloadPolicy`).
+- **Safe zip extraction (#398)** — shared zip-bomb limits via `SafeZipExtractor` (extensions, updater, themes).
+- **Remote theme SHA256 (#400)** — remote theme install requires checksum when provided by metadata.
+- **Sandbox OS consent (#395)** — fail-closed unsandboxed driver launch without OS wrapper (bubblewrap / consent dialog).
+- **Sideload integrity UX (#402)** — local `.zip`/`.qext` install dialog with security notice and optional SHA256.
+
 ## [0.4.11] - 2026-07-27
 
 Universal UI standard for drivers/extensions, shell UX hardening, Fluid QueryaMotion morphing, virtual grid/pool reliability, performance follow-ups, and dual-channel packaging (portable + installable).

diff --git a/docs/packaging.md b/docs/packaging.md
@@ -6,7 +6,7 @@ Querya Desktop ships (and will ship) two download channels. See epic
 | Channel | Typical artifact | Profile data |
 |---------|------------------|--------------|
 | **Portable** | `Querya-Desktop-{ver}-{os}.zip` (Flutter bundle) | OS app-support by default; optional sidecar — see below |
-| **Installable** | AppImage, Windows setup, deb/rpm/Flatpak (planned) | Normal OS locations |
+| **Installable** | AppImage, Windows setup, `.deb`, `.rpm`, Flatpak | Normal OS locations |
 
 ## Portable profile (`QueryaData`)
 
@@ -54,3 +54,38 @@ Legacy `com.example.*` support directories are migrated once into the new paths
 - `lib/core/storage/app_data_root.dart` — portable detection, support-dir redirect, id migration
 - Updater packaging context: `lib/core/updater/installers/update_install_context.dart`
 - Release workflow: `.github/workflows/release.yml`
+
+## Linux distro packages
+
+All installable Linux formats reuse the same Flutter `build/linux/x64/release/bundle`
+payload as the portable zip and AppImage.
+
+| Format | Build script | Install |
+|--------|--------------|---------|
+| `.deb` | [`scripts/linux/build_deb.sh`](../scripts/linux/build_deb.sh) | `sudo apt install ./Querya-Desktop-{ver}-linux.deb` |
+| `.rpm` | [`scripts/linux/build_rpm.sh`](../scripts/linux/build_rpm.sh) | `sudo dnf install ./Querya-Desktop-{ver}-linux.rpm` |
+| Flatpak | [`scripts/linux/build_flatpak.sh`](../scripts/linux/build_flatpak.sh) | `flatpak install --user ./Querya-Desktop-{ver}-linux.flatpak` |
+| AUR | [`packaging/linux/aur/`](../packaging/linux/aur/) | Community PKGBUILD (Release zip under `/opt`) |
+
+**Runtime dependencies (deb/rpm):** GTK 3, libsecret, GLib; app indicator recommended for tray.
+
+### Updater policy
+
+| Install type | In-app updater |
+|--------------|----------------|
+| Portable zip / AppImage | Downloads matching release asset (zip or AppImage) |
+| `.deb` / `.rpm` | Use **apt** / **dnf** (or distro equivalent); in-app install is not offered |
+| Flatpak | Use **`flatpak update`** (`FLATPAK_ID` / managed runtime — see `update_install_context.dart`) |
+| Snap | Use **`snap refresh`** when/if a Snap build ships |
+
+### Flatpak sandbox notes
+
+The bundled Flatpak grants network, home, and D-Bus access to the freedesktop
+secrets service (libsecret). Some database setups (Unix sockets outside `$HOME`,
+custom TLS stores) may need extra permissions, e.g.:
+
+```bash
+flatpak override --user com.queryahub.querya_desktop --filesystem=/var/run/postgresql:ro
+```
+
+Flathub submission can reuse [`packaging/linux/flatpak/com.queryahub.querya_desktop.yml`](../packaging/linux/flatpak/com.queryahub.querya_desktop.yml).
diff --git a/docs/release-checklist.md b/docs/release-checklist.md
@@ -70,7 +70,7 @@ Verify the 0.4.4 motion tokens, smooth animations, and high refresh rate support
 - [x] After merge to `main`, confirm any **Auto Version Bump** still yields a **0.4.11+…** product version (do not ship as 0.4.12).
 - [x] **Tag** `0.4.11` is placed on the **commit that includes all fixes** you want in binaries (a tag does not auto-include later commits; see [CONTRIBUTING.md](../CONTRIBUTING.md)).
 - [x] Run the **Release** workflow from GitHub Actions (see [tags-and-releases.md](tags-and-releases.md)).
-- [ ] Verify **portable** zips (`*-linux.zip`, `*-windows.zip`, `*-macos.zip`), **installable** artifacts (`*.AppImage`, `*.deb`, `*-windows-setup.exe`), and `SHA256SUMS.txt` on the GitHub Release.
+- [ ] Verify **portable** zips (`*-linux.zip`, `*-windows.zip`, `*-macos.zip`), **installable** artifacts (`*.AppImage`, `*.deb`, `*.rpm`, `*.flatpak`, `*-windows-setup.exe`), and `SHA256SUMS.txt` on the GitHub Release.
 
 ## Docs
 

diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -3,6 +3,7 @@
 Living document for planned work. Not a commitment order; adjust as priorities change.
 
 **GitHub Latest Release:** [0.4.11](https://github.com/QueryaHub/Querya-Desktop/releases/tag/0.4.11) (2026-07-27).  
+**Next patch:** **0.4.11-a** — security review (#395–#402) + Linux rpm/Flatpak/AUR (#386); tag pending.  
 **Next product release:** **0.5.0** — live Marketplace download and install — see below.
 
 ## Theme system
@@ -24,7 +25,8 @@ Living document for planned work. Not a commitment order; adjust as priorities c
 - **Shipped in 0.4.8:** Extension Manager UI (+ mock Marketplace) — [planned-0.4.8.md](planned-0.4.8.md).
 - **Shipped in 0.4.9:** PostgreSQL SSL & connection reliability — see [CHANGELOG.md](../CHANGELOG.md).
 - **Shipped in 0.4.10:** Sandboxed extension runtime (Block E), Plugin RPC bridge (Block C), SDUI form/tree builders, local `.zip`/`.qext` install, Registration/Activation for external database drivers (e.g. ClickHouse), in-app updater — see [CHANGELOG.md](../CHANGELOG.md).
-- **Shipped in 0.4.11 (Latest):** Universal UI / SDUI RPC expand, ExtensionTableView, universal export, MySQL/SQLite parity, shell UX (#339), Fluid QueryaMotion (#342) + perf follow-ups (#356), grid/pool/timeout fixes, dual-channel packaging (portable zip + AppImage / `.deb` / Windows setup) — [CHANGELOG.md](../CHANGELOG.md) `[0.4.11]`, [packaging.md](packaging.md), epic [#379](https://github.com/QueryaHub/Querya-Desktop/issues/379).
+- **Shipped in 0.4.11:** Universal UI / SDUI RPC expand, ExtensionTableView, universal export, MySQL/SQLite parity, shell UX (#339), Fluid QueryaMotion (#342) + perf follow-ups (#356), grid/pool/timeout fixes, dual-channel packaging (portable zip + AppImage / `.deb` / Windows setup) — [CHANGELOG.md](../CHANGELOG.md) `[0.4.11]`, [packaging.md](packaging.md), epic [#379](https://github.com/QueryaHub/Querya-Desktop/issues/379).
+- **Pending 0.4.11-a:** security hardening (#395–#402), Linux `.rpm` / Flatpak / AUR (#386) — [CHANGELOG.md](../CHANGELOG.md) `[0.4.11-a]`.
 - **Planned 0.5.0:** Marketplace Launch — live download, `sha256` validation, install themes (and later DB drivers) from the network.
 
 ## Query history and favorites

diff --git a/docs/security.md b/docs/security.md
@@ -21,3 +21,36 @@ On upgrade from older databases, existing plaintext secrets in SQLite are **migr
 ## Tests
 
 Automated tests use an **in-memory** secrets backend (see `test/flutter_test_config.dart`) so CI does not require a desktop keyring.
+
+
+## Archive install limits (extensions and updates)
+
+Marketplace downloads, local extension sideload (`.zip` / `.qext`), and in-app updater extraction use `SafeZipExtractor` (`lib/core/security/safe_zip_extractor.dart`) with shared default limits:
+
+| Limit | Default |
+|-------|---------|
+| Max compressed archive size | 100 MiB |
+| Max total uncompressed size | 500 MiB |
+| Max entries | 10 000 |
+| Max single entry uncompressed size | 100 MiB |
+| Max compression ratio (uncompressed ÷ compressed) | 100:1 |
+
+Archives exceeding these bounds fail closed before files are written to disk. Path traversal checks remain in `archive_path_guard.dart`.
+
+## Extension driver OS sandbox
+
+Process-sandbox database drivers launch inside OS-level isolation when available:
+
+| Platform | Wrapper | When unavailable |
+|----------|---------|------------------|
+| Linux | `bwrap` (bubblewrap) | User must confirm **Run without OS sandbox** |
+| macOS | `sandbox-exec` (Seatbelt) | N/A — always wrapped |
+| Windows | AppContainer (planned) | User must confirm until native helper ships |
+
+Querya refuses **silent** unsandboxed launch. `SandboxProcessRunner` throws `SandboxOsIsolationUnavailableException` until the user approves via the consent dialog registered from the main window.
+
+**Linux:** install `bubblewrap` and ensure unprivileged user namespaces are enabled if you want OS sandbox without manual confirmation.
+
+## Local extension sideload (`.zip` / `.qext`)
+
+Installing from a local file does **not** verify integrity unless you paste an optional **SHA-256 checksum** in the install dialog. Marketplace installs always require a manifest checksum (#396). Sideload is intended for trusted local packages and development builds.
diff --git a/docs/tags-and-releases.md b/docs/tags-and-releases.md
@@ -43,13 +43,17 @@
 |----------|--------|
 | `Querya-Desktop-X.Y.Z-linux.AppImage` | [`scripts/linux/build_appimage.sh`](../scripts/linux/build_appimage.sh) (`chmod +x` then run) |
 | `Querya-Desktop-X.Y.Z-linux.deb` | Debian/Ubuntu — [`scripts/linux/build_deb.sh`](../scripts/linux/build_deb.sh) |
+| `Querya-Desktop-X.Y.Z-linux.rpm` | Fedora/RHEL — [`scripts/linux/build_rpm.sh`](../scripts/linux/build_rpm.sh) |
+| `Querya-Desktop-X.Y.Z-linux.flatpak` | Distro-agnostic — [`scripts/linux/build_flatpak.sh`](../scripts/linux/build_flatpak.sh) |
 | `Querya-Desktop-X.Y.Z-windows-setup.exe` | Inno Setup (`packaging/windows/querya.iss`) |
 
 ```bash
 sudo apt install ./Querya-Desktop-X.Y.Z-linux.deb
+sudo dnf install ./Querya-Desktop-X.Y.Z-linux.rpm
+flatpak install --user ./Querya-Desktop-X.Y.Z-linux.flatpak
 ```
 
-RPM / Flatpak / AUR: [#386](https://github.com/QueryaHub/Querya-Desktop/issues/386) / epic [#379](https://github.com/QueryaHub/Querya-Desktop/issues/379).
+**Arch (AUR):** community PKGBUILD — [`packaging/linux/aur/`](../packaging/linux/aur/) (installs the Release portable zip under `/opt`).
 
 ## Changelog в GitHub Release
 

diff --git a/lib/core/extensions/extension_driver_session.dart b/lib/core/extensions/extension_driver_session.dart
@@ -11,6 +11,8 @@ import 'package:querya_desktop/core/extensions/models/extension_manifest.dart';
 import 'package:querya_desktop/core/extensions/models/extension_object_metadata.dart';
 import 'package:querya_desktop/core/extensions/models/extension_server_stats.dart';
 import 'package:querya_desktop/core/extensions/rpc/plugin_rpc_bridge.dart';
+import 'package:querya_desktop/core/extensions/sandbox/sandbox_os_isolation.dart';
+import 'package:querya_desktop/core/extensions/sandbox/unsandboxed_launch_consent_gate.dart';
 import 'package:querya_desktop/core/sdui/sdui_tree_schema.dart';
 import 'package:querya_desktop/core/storage/connection_secrets_store.dart';
 import 'package:querya_desktop/core/storage/local_db.dart';
@@ -124,18 +126,52 @@ class ExtensionDriverSession {
     }
 
     final bridge = bridgeFactory?.call() ?? PluginRpcBridge();
-    await bridge.start(
+    await _startBridgeWithConsent(
+      bridge: bridge,
       manifest: manifest,
       pluginExecutable: executable,
       extensionRoot: root,
-      handshakeParams: {
-        'queryaVersion': '2.0.0',
-        'pluginId': manifest.id,
-      },
     );
     return bridge;
   }
 
+  Future<void> _startBridgeWithConsent({
+    required PluginRpcBridge bridge,
+    required ExtensionManifest manifest,
+    required String pluginExecutable,
+    required String extensionRoot,
+  }) async {
+    const handshakeParams = {
+      'queryaVersion': '2.0.0',
+    };
+
+    try {
+      await bridge.start(
+        manifest: manifest,
+        pluginExecutable: pluginExecutable,
+        extensionRoot: extensionRoot,
+        handshakeParams: {
+          ...handshakeParams,
+          'pluginId': manifest.id,
+        },
+      );
+    } on SandboxOsIsolationUnavailableException catch (error) {
+      final approved =
+          await UnsandboxedLaunchConsentGate.instance.request(error);
+      if (!approved) rethrow;
+      await bridge.start(
+        manifest: manifest,
+        pluginExecutable: pluginExecutable,
+        extensionRoot: extensionRoot,
+        allowUnsandboxedLaunch: true,
+        handshakeParams: {
+          ...handshakeParams,
+          'pluginId': manifest.id,
+        },
+      );
+    }
+  }
+
   Future<Object?> _injectAndConnect(
     PluginRpcBridge bridge, {
     required int connectionId,

diff --git a/lib/core/extensions/local_extension_installer.dart b/lib/core/extensions/local_extension_installer.dart
@@ -10,6 +10,8 @@ import 'package:querya_desktop/core/extensions/local_extension_registry.dart';
 import 'package:querya_desktop/core/extensions/models/extension_manifest.dart';
 import 'package:querya_desktop/core/extensions/sandbox/sandbox_policy.dart';
 import 'package:querya_desktop/core/market/marketplace_repository.dart';
+import 'package:querya_desktop/core/security/archive_path_guard.dart';
+import 'package:querya_desktop/core/security/safe_zip_extractor.dart';
 
 /// Installs an extension package from a local `.zip` / `.qext` archive (issue #316).
 ///
@@ -42,7 +44,12 @@ class LocalExtensionInstaller {
     }
 
     onProgress?.call(0.1);
-    final bytes = await archiveFile.readAsBytes();
+    late final List<int> bytes;
+    try {
+      bytes = await SafeZipExtractor.readBoundedBytes(archiveFile);
+    } on SafeZipException catch (error) {
+      throw MarketplaceException(error.message);
+    }
 
     if (expectedSha256 != null && expectedSha256.trim().isNotEmpty) {
       final actual = sha256.convert(bytes).toString().toLowerCase();
@@ -56,7 +63,12 @@ class LocalExtensionInstaller {
     }
 
     onProgress?.call(0.25);
-    final archive = ZipDecoder().decodeBytes(bytes);
+    late final Archive archive;
+    try {
+      archive = SafeZipExtractor.decodeBytes(bytes);
+    } on SafeZipException catch (error) {
+      throw MarketplaceException(error.message);
+    }
     if (archive.isEmpty) {
       throw MarketplaceException('Extension archive is empty.');
     }
@@ -216,17 +228,15 @@ class LocalExtensionInstaller {
       }
       if (filename.isEmpty || filename == '/') continue;
 
-      if (filename.contains('..') ||
-          filename.startsWith('/') ||
-          filename.startsWith('\\')) {
+      if (!isArchiveEntryNameSafe(filename)) {
         throw MarketplaceException(
           'Security violation: Path traversal detected in archive entry '
           '"${file.name}"',
         );
       }
 
       final targetPath = p.normalize(p.join(destPath, filename));
-      if (!targetPath.startsWith(destPath)) {
+      if (!isArchiveExtractPathWithinRoot(destPath, targetPath)) {
         throw MarketplaceException(
           'Security violation: Extraction path out of bounds "${file.name}"',
         );

diff --git a/lib/core/extensions/rpc/plugin_rpc_bridge.dart b/lib/core/extensions/rpc/plugin_rpc_bridge.dart
@@ -62,6 +62,7 @@ class PluginRpcBridge {
     String? extensionRoot,
     Map<String, String>? environment,
     Map<String, Object?>? handshakeParams,
+    bool allowUnsandboxedLaunch = false,
   }) async {
     if (_started) {
       throw StateError('PluginRpcBridge already started');
@@ -77,6 +78,7 @@ class PluginRpcBridge {
       extensionRoot: extensionRoot ?? manifest.installPath,
       capabilities: capabilities,
       environment: environment,
+      allowUnsandboxedLaunch: allowUnsandboxedLaunch,
     );
 
     _handle = handle;