Merge pull request #18 from Project-Ro-ASD/codex/global-distro-cli-hardening

Codex/global distro cli hardening

Author: Sopwit

.clang-format

@@ -1,7 +1,8 @@
 ---
 # ro-Control clang-format configuration
-# CI bu dosyayı kullanır — değişiklik yapılırsa tüm kaynak dosyalar yeniden formatlanmalı.
-# Kullanım: find src/ -name "*.cpp" -o -name "*.h" | xargs clang-format -i
+# CI bu dosyayı kullanır; değişirse tüm C++ kaynakları yeniden formatlanmalıdır.
+# Kullanım:
+#   find src \( -name "*.cpp" -o -name "*.h" \) -print0 | xargs -0 clang-format -i
 
 BasedOnStyle: LLVM
 Language: Cpp

.github/ISSUE_TEMPLATE/bug_report.md

@@ -37,8 +37,11 @@ What actually happened.
 ## Logs
 
 ```
-# Paste relevant output from:
-# journalctl --user -u ro-control --no-pager -n 50
+# Paste any relevant output from one or more of these:
+# ro-control started from a terminal
+# coredumpctl info ro-control
+# journalctl --since "10 minutes ago" --no-pager
+# dnf history info
 ```
 
 ## Additional Context

.github/workflows/ci.yml

@@ -33,6 +33,7 @@ jobs:
             ninja-build \
             qt6-qtbase-devel \
             qt6-qtdeclarative-devel \
+            qt6-qttools-devel \
             qt6-qtwayland-devel \
             kf6-qqc2-desktop-style \
             polkit-devel \
@@ -44,7 +45,8 @@ jobs:
           cmake -B build \
             -GNinja \
             -DCMAKE_BUILD_TYPE=Release \
-            -DBUILD_TESTS=ON
+            -DBUILD_TESTS=ON \
+            -DREQUIRE_TRANSLATIONS=ON
 
       - name: Build
         run: cmake --build build --parallel
@@ -80,6 +82,7 @@ jobs:
             qt6-qtbase-devel \
             qt6-qtbase-private-devel \
             qt6-qtdeclarative-devel \
+            qt6-qttools-devel \
             qt6-qtwayland-devel \
             kf6-qqc2-desktop-style \
             polkit-devel
@@ -93,13 +96,13 @@ jobs:
           fi
           ARCHIVE_BASENAME="ro-control-${VERSION}"
           mkdir -p ~/rpmbuild/SOURCES ~/rpmbuild/SPECS
-          tar \
-            --exclude-vcs \
-            --exclude='./build' \
-            --exclude='./build-*' \
-            --transform="s,^,${ARCHIVE_BASENAME}/," \
-            -czf "${HOME}/rpmbuild/SOURCES/${ARCHIVE_BASENAME}.tar.gz" \
-            .
+          STAGE_DIR="$(mktemp -d)"
+          cp -a . "${STAGE_DIR}/${ARCHIVE_BASENAME}"
+          rm -rf "${STAGE_DIR}/${ARCHIVE_BASENAME}/.git" \
+                 "${STAGE_DIR}/${ARCHIVE_BASENAME}/build" \
+                 "${STAGE_DIR}/${ARCHIVE_BASENAME}/build-"*
+          tar -C "${STAGE_DIR}" -czf "${HOME}/rpmbuild/SOURCES/${ARCHIVE_BASENAME}.tar.gz" "${ARCHIVE_BASENAME}"
+          rm -rf "${STAGE_DIR}"
           cp packaging/rpm/ro-control.spec "${HOME}/rpmbuild/SPECS/ro-control.spec"
 
       - name: Build RPM

.github/workflows/release.yml

@@ -18,15 +18,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Derive release version
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
+
       - name: Create source archives
         run: |
-          git archive --format=tar.gz --output=ro-control-${GITHUB_REF_NAME}.tar.gz ${GITHUB_SHA}
-          git archive --format=zip --output=ro-control-${GITHUB_REF_NAME}.zip ${GITHUB_SHA}
+          PREFIX="ro-control-${VERSION}"
+          git archive --format=tar.gz --prefix="${PREFIX}/" --output="${PREFIX}.tar.gz" "${GITHUB_SHA}"
+          git archive --format=zip --prefix="${PREFIX}/" --output="${PREFIX}.zip" "${GITHUB_SHA}"
 
       - name: Publish release
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           files: |
-            ro-control-${{ github.ref_name }}.tar.gz
-            ro-control-${{ github.ref_name }}.zip
+            ro-control-${{ env.VERSION }}.tar.gz
+            ro-control-${{ env.VERSION }}.zip

.gitignore

@@ -38,7 +38,8 @@ ui_*.h
 CMakeLists.txt.user
 
 # VS Code
-.vscode/
+.vscode/*
+!.vscode/settings.json
 *.code-workspace
 
 # CLion / JetBrains
@@ -81,23 +82,3 @@ test_results/
 vgcore.*
 callgrind.out.*
 massif.out.*
-
-# Build
-build/
-
-# CMake
-CMakeFiles/
-CMakeCache.txt
-cmake_install.cmake
-Makefile
-
-# Qt
-*_autogen/
-moc_*
-qmltypes
-
-# Binary
-*.o
-*.so
-*.a
-.DS_Store

.vscode/settings.json

@@ -0,0 +1,9 @@
+{
+    "qt-qml.qmlls.enabled": true,
+    "qt-qml.qmlls.useQmlImportPathEnvVar": true,
+    "qt-qml.qmlls.additionalImportPaths": [
+        "${workspaceFolder}/src/qml",
+        "${workspaceFolder}/src/qml/pages",
+        "${workspaceFolder}/build/rocontrol"
+    ]
+}

CHANGELOG.md

@@ -16,18 +16,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Session-aware post-install and post-update handling for Wayland/X11
 - Real system monitors for CPU, GPU, and RAM with live QML bindings
 - Driver update check/apply flow and deep-clean operation support
-- Fedora build and test workflow with CMake + Qt6
+- Linux build and test workflow with CMake + Qt6
 
 ### Changed
 - Driver management UI is wired to backend operations instead of placeholders
 - Documentation updated for current architecture and build instructions
 - Test suite expanded to cover monitor metric ranges and detector reporting
+- Repository metadata and packaging references aligned with the active GitHub organization
+- Privileged command flow now uses a dedicated allowlisted helper instead of raw `pkexec` command dispatch
 
 ### Fixed
 - Command execution path preserves stdout reliably
-- RPM Fusion URL resolution and repository failure handling improved
+- RPM repository URL resolution and repository failure handling improved
 - Updater API/header alignment and monitor test compatibility issues resolved
 - Repository cleanup for stray macOS metadata files
+- PolicyKit metadata, helper install path, and packaged action identifiers are now consistent
 
 ---
 

CMakeLists.txt

@@ -7,6 +7,12 @@ project(ro-control
     LANGUAGES CXX
 )
 
+set(RO_CONTROL_POLICY_ID "io.github.ProjectRoASD.rocontrol.manage-drivers")
+set(RO_CONTROL_HELPER_NAME "ro-control-helper")
+set(RO_CONTROL_HELPER_BUILD_PATH
+    "${CMAKE_CURRENT_BINARY_DIR}/${RO_CONTROL_HELPER_NAME}"
+)
+
 # ─── C++ Standard ────────────────────────────────────────────────────────────
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
@@ -33,6 +39,18 @@ find_package(Qt6 REQUIRED COMPONENTS
 
 find_package(Qt6 QUIET COMPONENTS LinguistTools)
 
+option(REQUIRE_TRANSLATIONS
+    "Fail configuration when Qt Linguist tools are unavailable"
+    ON
+)
+
+if(REQUIRE_TRANSLATIONS AND NOT Qt6LinguistTools_FOUND)
+    message(FATAL_ERROR
+        "Qt6 LinguistTools were not found. Install the Qt tools development "
+        "package or configure with -DREQUIRE_TRANSLATIONS=OFF for local-only builds."
+    )
+endif()
+
 qt_standard_project_setup()
 
 if(COMMAND qt_policy)
@@ -56,6 +74,7 @@ set(BACKEND_SOURCES
 
 set(APP_SOURCES
     src/main.cpp
+    src/cli/cli.cpp
     ${BACKEND_SOURCES}
 )
 
@@ -93,15 +112,10 @@ if(Qt6LinguistTools_FOUND)
 
     qt_add_translations(ro-control
         TS_FILES ${TS_FILES}
+        RESOURCE_PREFIX "/i18n"
     )
 endif()
 
-# ─── Include Directories ──────────────────────────────────────────────────────
-target_include_directories(ro-control PRIVATE
-    ${CMAKE_CURRENT_SOURCE_DIR}/src
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/backend
-)
-
 # ─── Link Qt Libraries ────────────────────────────────────────────────────────
 target_link_libraries(ro-control PRIVATE
     Qt6::Core
@@ -123,30 +137,87 @@ target_compile_options(ro-control PRIVATE
 # ─── Install Targets ──────────────────────────────────────────────────────────
 include(GNUInstallDirs)
 
+set(RO_CONTROL_HELPER_INSTALL_PATH
+    "${CMAKE_INSTALL_FULL_LIBEXECDIR}/${RO_CONTROL_HELPER_NAME}"
+)
+set(RO_CONTROL_POLICY_BUILD_PATH
+    "${CMAKE_CURRENT_BINARY_DIR}/io.github.ProjectRoASD.rocontrol.policy"
+)
+
+# ─── Include Directories ──────────────────────────────────────────────────────
+target_include_directories(ro-control PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/src
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/backend
+)
+
+target_compile_definitions(ro-control PRIVATE
+    RO_CONTROL_POLICY_ID="${RO_CONTROL_POLICY_ID}"
+    RO_CONTROL_HELPER_BUILD_PATH="${RO_CONTROL_HELPER_BUILD_PATH}"
+    RO_CONTROL_HELPER_INSTALL_PATH="${RO_CONTROL_HELPER_INSTALL_PATH}"
+)
+
+configure_file(
+    data/helpers/ro-control-helper.sh.in
+    ${RO_CONTROL_HELPER_BUILD_PATH}
+    @ONLY
+    NEWLINE_STYLE UNIX
+)
+
+configure_file(
+    data/polkit/io.github.ProjectRoASD.rocontrol.policy.in
+    ${RO_CONTROL_POLICY_BUILD_PATH}
+    @ONLY
+    NEWLINE_STYLE UNIX
+)
+
 install(TARGETS ro-control
     RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 )
 
+install(PROGRAMS ${RO_CONTROL_HELPER_BUILD_PATH}
+    DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
+    RENAME ${RO_CONTROL_HELPER_NAME}
+)
+
 install(FILES data/icons/ro-control.desktop
     DESTINATION ${CMAKE_INSTALL_DATADIR}/applications
 )
 
-install(DIRECTORY data/icons/hicolor/
-    DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor
+install(FILES
+    data/icons/hicolor/scalable/apps/ro-control.svg
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor/scalable/apps
 )
 
-install(FILES data/icons/hicolor/256x256/apps/ro-control.png
+install(FILES
+    data/icons/hicolor/256x256/apps/ro-control.png
     DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor/256x256/apps
 )
 
 install(FILES data/icons/ro-control.metainfo.xml
     DESTINATION ${CMAKE_INSTALL_DATADIR}/metainfo
 )
 
-install(FILES data/polkit/com.github.AcikKaynakGelistirmeToplulugu.rocontrol.policy
+install(FILES ${RO_CONTROL_POLICY_BUILD_PATH}
     DESTINATION ${CMAKE_INSTALL_DATADIR}/polkit-1/actions
 )
 
+install(FILES docs/man/ro-control.1
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/man/man1
+)
+
+install(FILES data/completions/ro-control.bash
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/bash-completion/completions
+    RENAME ro-control
+)
+
+install(FILES data/completions/_ro-control
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/zsh/site-functions
+)
+
+install(FILES data/completions/ro-control.fish
+    DESTINATION ${CMAKE_INSTALL_DATADIR}/fish/vendor_completions.d
+)
+
 # ─── Tests ───────────────────────────────────────────────────────────────────
 option(BUILD_TESTS "Build unit tests" OFF)
 

CODE_OF_CONDUCT.md

@@ -21,10 +21,26 @@ We as members, contributors, and maintainers pledge to make participation in ro-
 
 ## Enforcement
 
-Instances of unacceptable behavior may be reported by opening a GitHub issue or contacting the maintainers directly. All complaints will be reviewed and investigated promptly.
+Instances of unacceptable behavior should not be reported through a public GitHub issue.
+Please contact the maintainers privately through GitHub's direct contact channels.
+All complaints will be reviewed and investigated promptly and handled with as much confidentiality as possible.
 
 Maintainers have the right to remove, edit, or reject comments, commits, issues, and other contributions that do not align with this Code of Conduct.
 
+## Scope
+
+This Code of Conduct applies within project spaces and in public spaces when an
+individual is officially representing the project or its community.
+
+## Enforcement Guidelines
+
+Project maintainers may apply any action they deem appropriate, including:
+
+- Warning contributors about unacceptable behavior
+- Removing or editing content
+- Temporarily restricting participation
+- Permanently banning contributors from project spaces
+
 ## Attribution
 
 This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.