Grant network access so update checks can reach GitHub (#2413)

Add --share=network to the finish-args of both Flatpak manifests. Without it
the sandbox cannot resolve or reach GitHub, so update checks fail with
"Temporary failure in name resolution". The two manifests keep identical
finish-args.

Cargo.lock

@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "acadrust"
-version = "0.6.7"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "000d512cd910e55577d85ad2d09d743f6a16e033f1c57d7dfeda747ff013a2b3"
+checksum = "8923c99ea1f151cb7fc17ce2fc14f8b1e330fa22611e535602d985c0cc3c89a2"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -727,8 +727,8 @@ name = "cadcraft-fonts"
 version = "0.14.0"
 dependencies = [
  "cadcraft-geom",
- "harfrust 0.15.0",
- "skrifa 0.49.0",
+ "harfrust 0.14.0",
+ "skrifa 0.48.0",
  "unicode-bidi",
 ]
 
@@ -2117,15 +2117,14 @@ dependencies = [
 
 [[package]]
 name = "harfrust"
-version = "0.15.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "865dcc4105d51c323d8fedbb2d75b5e9c8ecddf5613f74c82f851d0afbc97114"
+checksum = "86aa776d6d32b072119e1f1650f4db843ff4382a4aaa6a2c9c4e35703cd377cb"
 dependencies = [
  "bitflags 2.13.2",
  "bytemuck",
- "read-fonts 0.46.0",
+ "read-fonts 0.45.1",
  "smallvec",
- "yoke",
 ]
 
 [[package]]
@@ -3870,15 +3869,14 @@ dependencies = [
 
 [[package]]
 name = "read-fonts"
-version = "0.46.0"
+version = "0.45.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdaa4fffe9ff3ca2c353fa9729792805b9b3e324695ff5a081f860612e81b330"
+checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
 dependencies = [
  "bytemuck",
  "foldhash 0.2.0",
  "font-types 0.12.7",
  "once_cell",
- "smallvec",
  "yoke",
 ]
 
@@ -4335,15 +4333,12 @@ dependencies = [
 
 [[package]]
 name = "skrifa"
-version = "0.49.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7459fb60888ad9a5f367dd293fa2fb9df142cb451aa6bfd6cd66a7d6a9b739d"
+checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
 dependencies = [
  "bytemuck",
- "once_cell",
- "read-fonts 0.46.0",
- "smallvec",
- "yoke",
+ "read-fonts 0.45.1",
 ]
 
 [[package]]

Cargo.toml

@@ -46,10 +46,10 @@ rayon = "1"
 # rendering / formats
 tiny-skia = { version = "0.12", default-features = false, features = ["std", "simd", "png-format"] }
 lyon_tessellation = "1.0.22"
-skrifa = "0.49"
+skrifa = "0.48"
 # Text shaping (OpenType GSUB/GPOS, HarfBuzz port on read-fonts; egui's epaint is still on 0.12,
 # so the graph has both) and the Unicode Bidirectional Algorithm for right-to-left drawing text.
-harfrust = "0.15"
+harfrust = "0.14"
 unicode-bidi = "0.3.18"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 encoding_rs = "0.8.35"

packaging/linux/flatpak/ai.storyteller.cadcraft.bundle.yml

@@ -24,15 +24,15 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu canvas (Vulkan, or GL as a fallback).
   - --device=dri
+  # Outbound network access (HTTPS).
+  - --share=network
   # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the
   # document portal, so picked files work anywhere without broad filesystem access. Documents
   # and Pictures are granted so drawings passed by path (the command line, Open Recent, xrefs
   # and images next to a DXF) work in the usual places.
   - --filesystem=xdg-documents
   - --filesystem=xdg-pictures
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.cadcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Deliberately not granted: home/host filesystem access.
 modules:
   - name: cadcraft
     buildsystem: simple

packaging/linux/flatpak/ai.storyteller.cadcraft.yml

@@ -25,15 +25,15 @@ finish-args:
   - --share=ipc
   # GPU access for the wgpu canvas (Vulkan, or GL as a fallback).
   - --device=dri
+  # Outbound network access (HTTPS).
+  - --share=network
   # Open/Save dialogs go through the file-chooser portal (rfd) and drag-and-drop through the
   # document portal, so picked files work anywhere without broad filesystem access. Documents
   # and Pictures are granted so drawings passed by path (the command line, Open Recent, xrefs
   # and images next to a DXF) work in the usual places.
   - --filesystem=xdg-documents
   - --filesystem=xdg-pictures
-  # Deliberately not granted: network (the optional --control server listens on 127.0.0.1 in
-  # the sandbox; `flatpak override --user --share=network ai.storyteller.cadcraft` exposes it to
-  # host agents) and home/host filesystem access.
+  # Deliberately not granted: home/host filesystem access.
 build-options:
   append-path: /usr/lib/sdk/rust-stable/bin
 modules: