can qtscript plasmoids load C++ qtscript plugins

[Ian Monroe]

On Mon, Nov 9, 2009 at 2:49 PM, Aaron J. Seigo <aseigo at kde.org> wrote:
> On November 9, 2009, Ian Monroe wrote:
>> I suspect the answer to the subject is "no" since I haven't found a
>> mention of a method to do it.
>
> "no" is correct.
>
>> But I also haven't found comprehensive
>> QtScript API docs. :)
>
> kdebase/workspace/plasma/design/javascript has a growing body of information.
>
>> My situation is that I want to write a full chat solution in a
>> qtscript plasmoid using the QtScript Telepathy bindings I wrote. (I'm
>> guessing a dataengine or service for buddy presence and chatting would
>> be pretty crazy right?)
>
> a datanengine/service would make it really easy for any widget to access them,
> but i don't know how well Telepathy would map to that API?
>
>> It would take a 3 line function to add a "loadScriptPlugin". However
>> if you wanted to sandbox QtScript plugins then adding such a function
>> would undo that, since anyone with the qt bindings installed could
>> write files etc. I'm not sure if thats a security goal you have or
>> not.
>
> yes, it is a security goal, and yes, such a function would completely destroy
> any sandboxing.
>
> the current idea is to allow "sandbox erosion through trust and permission" so
> that such a method could be open to trusted / permitted widgets.
>
> this has not been implemented yet as the interest in working on these bindings
> is low. what is needed is a way for a widget to say "here's what i want access
> to" and then, if the script engine deems it appropriate, to add those pieces
> of API at runtime to the engine.

Ok from talking more in IRC, it sounds like the idea is to have GPG
signing of qtscript plasmoids, and then allow them to use the features
they ask for. Unlike with C++, it can really be enforced that they
only use the features they declare they need.

Amarok just added GPG signing for its scripts, I don't think its a big
deal to add this. Chani already has the .desktop feature declaration
in-place for the screensaver plasmoids. I'll checkout kdelibs etc and
research this more.

Ian