[Plugin]: Kindle for Omarchy

[minholi]

Repository URL

https://github.com/minholi/omakindle

Category

Productivity

Tags

bar, media, quickshell

Suggest a missing tag

No response

Maintainer notes

Rust backend builds locally via scripts/backend.sh (crates locked in
backend/Cargo.lock). The one-click Amazon sign-in helper runs through uv with
playwright from PyPI and drives the user's default browser; cookies stay on
the user's machine. Requires a Rust toolchain to build the backend.

Submission checklist

• The repository is public and contains installation and removal instructions.
• I have documented the plugin license and any external dependencies.
• I confirm that I own or have permission to submit this plugin and its preview assets.
• The plugin does not overwrite user configuration without explicit consent.
• I understand that approval is for listing and is not a security review.

---

Re-validation requested at commit 8bb9598 (v1.2.1): sign-in helper dependencies pinned with scripts/authorize.py.lock and launched via uv run --locked; plugin renamed to OmaKindle.

[github-actions]

Marketplace validation

✅ Repository is public and reachable: minholi/omakindle
✅ Found 1 valid, uniquely identified plugin manifest
✅ Root README and license files detected
✅ Quattro compatibility passed at commit 8bb9598
✅ Optional root preview detected

• minholi.kindle — OmaKindle 1.2.1 (manifest.json)

Ready for listing review. Validation checks this commit’s structure and Quattro compatibility; it is not a security review.

[github-actions]

Automated security baseline

✅ Automated security baseline passed at commit 8bb9598….

No action is required.

This deterministic baseline detects only its documented patterns and is not designed to stop a motivated attacker.

This is not a security audit, certification, warranty, or endorsement.

[HANCORE-linux]

Security review at exact SHA 7b334330c31599bc7a5fec63d6b5c2f1d1f6b6ca found a blocking supply-chain issue in the credential-capture path. scripts/authorize.py:1-4 declares playwright>=1.55, and Service.qml:98-102 launches it with uv run; this resolves and executes a mutable future PyPI release at authorization time while the process can read the user's Amazon session cookies and device token. Pin every runtime-resolved Python package to immutable versions and integrity hashes in a committed lock/artifact, invoke uv in locked/frozen mode so resolution cannot drift, and submit a newly validated commit.

[minholi]

Thanks for the review. Fixed at 8bb9598:

• Added scripts/authorize.py.lock (uv lock) pinning every runtime dependency (playwright 1.63.0, greenlet 3.5.6, pyee 13.0.1, typing-extensions 4.16.0) with sha256 hashes for all wheels and sdists.
• Service.qml now launches the helper with uv run --locked, so resolution cannot drift from the lock file.
• README documents the lock file and the locked invocation.

Also in this update: the plugin is renamed to OmaKindle (v1.2.1) with an original e-reader mark — Amazon's Kindle wordmark/logo is trademarked, so the icon stays original — plus a panel UI polish pass and refreshed preview/screenshots.

The repo is ready for re-validation at commit 8bb9598.

[HANCORE-linux]

Blocking local credential-boundary issue at backend/src/socket.rs:48-60 and scripts/authorize.py:151-176: when XDG_RUNTIME_DIR is absent, both sides use the predictable path /tmp/omakindle/backend.sock. The backend creates or follows the parent without verifying its type, owner, permissions, or symlink status, and it ignores the chmod result. Another local user can pre-create and control that directory, replace the socket, and receive the Amazon cookies and device token sent by the authorization helper. The Python RPC also buffers an unbounded response line from this socket. Fail closed without a secure runtime directory, or atomically create and verify a user-owned mode-0700 fallback using no-follow operations; verify the socket before sending credentials; and enforce strict request/response line limits on both endpoints. Then submit and validate a new commit.