Classic confinement request for tempest-desktop

  • name: tempest-desktop
  • description: Tempest is a modern, cross-platform SSH & SFTP client and terminal emulator with AI-powered copilot assistance. It provides local shell access, SSH connectivity, SFTP file management, port forwarding, scheduled tasks, and push notifications. Built with Electron and a native Rust core (via NAPI-RS) for SSH protocol handling and job scheduling.
  • snapcraft: PRIVATE
  • upstream: PRIVATE
  • upstream-relation: I am the developer and publisher of Tempest.
  • supported-category: terminal-emulator
  • reasoning: Tempest is a terminal emulator and SSH client that needs classic confinement for the following technical reasons:
  1. Arbitrary shell and command execution: As a terminal emulator, Tempest must be able to spawn arbitrary shell processes (bash, zsh, fish, etc.) and execute any user-specified command. The existing interfaces under strict confinement do not allow launching arbitrary executables outside the snap’s own sandbox.

  2. PTY allocation: Tempest allocates pseudo-terminals (PTY) via the system’s PTY subsystem to provide interactive shell sessions. Strict confinement restricts access to /dev/ptmx and /dev/pts/*, which are essential for terminal emulation.

  3. Full filesystem access: Users expect a terminal emulator to navigate and manipulate files anywhere on the filesystem — home directories, mounted volumes, system paths, etc. The home and removable-media interfaces are insufficient as they do not cover paths like /etc, /var, /tmp, or custom mount points that users routinely access from a terminal. Additionally, SFTP file transfers require read/write access to arbitrary paths for downloading and uploading files.

  4. SSH and network access with host key/config files: Tempest includes a built-in SSH client (powered by a native Rust libssh2 binding). It needs to read ~/.ssh/config, ~/.ssh/known_hosts, private keys in arbitrary locations, and SSH agent sockets (SSH_AUTH_SOCK). Strict confinement’s ssh-keys interface only provides read access to ~/.ssh/ and does not cover agent socket forwarding or keys stored in non-standard paths.

  5. Environment variable and system integration: Terminal emulators must inherit and propagate the full user environment (PATH, LANG, custom variables, etc.) and integrate with system tooling (e.g., gpg-agent, ssh-agent, package managers). Strict confinement sanitizes the environment and restricts access to these system services.

  • I understand that strict confinement is generally preferred over classic.

  • I’ve tried the existing interfaces to make the snap work under strict confinement. The combination of home, ssh-keys, network, network-bind, process-control, and system-observe interfaces is insufficient for a terminal emulator that must spawn arbitrary processes, allocate PTYs, and provide unrestricted filesystem access — which are core, non-optional functionalities of any terminal emulator.

This request has been added to the queue for review by the @reviewers team.

Could someone help me? @review-team

Hey @altasexpress

Classic confinement is a sensitive matter that is reserved for mature, well-known application. Could you please provide evidences that point out in that direction? In addition, classic confinement requires of publisher vetting. Given that upstream repository is private, the only option to proceed with it is via Verified accounts

Thanks