Request auto-connection of personal-files (dot-aws) for totally-trustworthy-s3-browser

coopdigityinc · June 5, 2026, 10:02am

name: totally-trustworthy-s3-browser
description: Cross-platform desktop browser for AWS S3 buckets — lists profiles, browses buckets/keys, uploads/downloads objects using the user’s existing AWS CLI credentials.
snapcraft: No standalone snapcraft.yaml — built with electron-builder, which generates the snap metadata from the build.snap block in package.json: totally-trustworthy-s3-browser/package.json at main · coopdigity/totally-trustworthy-s3-browser · GitHub
upstream: GitHub - coopdigity/totally-trustworthy-s3-browser: A cross-platform, open-source, AI generated, S3 Browser. Batteries not Include. No warranties expressed or implied. etc. etc. · GitHub
upstream-relation: Publisher and upstream author (same person).
interfaces:
- dot-aws:
  - request-type: auto-connection
  - reasoning: The app is a desktop S3 file browser. It reads the user’s existing AWS CLI shared configuration under ~/.aws (the credentials and config files), read-only, to enumerate profiles, pick up each profile’s default region, and authenticate to S3 with the same credentials the official aws CLI uses. These are dotfiles in $HOME, so the home interface cannot reach them; a read-only personal-files plug scoped to $HOME/.aws is the minimal grant. No write access is requested. Auto-connection is requested so the app works on first launch without the user manually running snap connect.

Generated plug definition (from the snap metadata):

plugs:
  dot-aws:
    interface: personal-files
    read:
    - $HOME/.aws

Source is public at the upstream link for inspection. Thanks!

Note: dot-aws is the plug name “as defined in the snapcraft.yaml” they ask about — it’s what electron-builder generates from our config, so it’s the correct <interface-name> value.

store-requests-bot · June 5, 2026, 11:00am

This request has been added to the queue for review by the @reviewers team.

jslarraz · June 12, 2026, 2:23pm

Hey @coopdigityinc

The requested directory is clearly not owned by the snapped application. Additionally, the project is extremely fresh. Thus, I believe granting auto-connection is NOT reasonable in this case.

I was not sure about manual-connection either. However, thinking about it, I believe it is somehow similar to ssh-keys interface, which the user can always connect if they want. With this in mind, +1 from me for granting totally-trustworthy-s3-browser read access to ~/.aws via manually connected personal-files interface

coopdigityinc · June 12, 2026, 9:17pm

Thanks, I’ll update the request type.

yomonokio · June 23, 2026, 1:11pm

Hi @coopdigityinc!

As @jslarraz mentioned in his comment, changing the connection type to manual, might be a better idea! So +1 from my side also, for manually connecting the personal-files interface to your snap!

jslarraz · June 23, 2026, 2:25pm

+2 for, 0 against granting read access to ~/.aws via a manually-connected personal-files interface. This is now live. Next revision will pass automatic review