[wangrong1069]

Add trust negotiation with deepin-security-loader via fd passing, switch VfsMonitor to D-Bus GetEventChannel relay, enable systemd notify and journal logging.

添加与deepin-security-loader的信任协商，通过fd传递实现；
VfsMonitor事件通道从Unix socket切换到D-Bus GetEventChannel 中继；启用systemd notify和journal日志重定向。

Log: 集成安全信任客户端与D-Bus事件中继
PMS: BUG-370779
Influence: 索引服务启动时需通过deepin-security-loader信任验证，事件接收改为D-Bus中继方式，安装路径迁移至libexec/deepin。

Summary by Sourcery

Integrate trusted D-Bus startup and event-relay support into the index service while aligning logging, packaging, and filesystem monitoring with the new runtime architecture.

New Features:

• Add startup trust negotiation with deepin-security-loader using file-descriptor-based requests and responses.
• Relay VfsMonitor filesystem events through the D-Bus GetEventChannel interface.
• Redirect index service logging to the systemd journal with stderr fallback.

Enhancements:

• Update filesystem event and mount handling for the D-Bus relay protocol, including lower-filesystem filtering.
• Install the index executable under libexec/deepin and update its service integration.

Build:

• Add GLib GIO and libsystemd dependencies and link the dispatcher and trust-client components.

Deployment:

• Adjust package installation and systemd service configuration for the relocated index executable.

Tests:

• Update index test dependencies for the event relay integration and remove Unix-socket-specific watcher tests.

[sourcery-ai]

Sorry @wangrong1069, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 10 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[github-actions]

Warning

[Debian检查]

• 检测到敏感词unset变动

详情

    {
    "unset": {
        "autotests/index/test_vfsmonitorfilesystemwatcher.cpp": {
            "a": [
                "        qunsetenv(\"DFM_VFSMONITOR_SOCKET_PATH\");",
                "    qunsetenv(\"DFM_VFSMONITOR_SOCKET_PATH\");",
                "    qunsetenv(\"DFM_VFSMONITOR_SOCKET_PATH\");",
                "    qunsetenv(\"DFM_VFSMONITOR_SOCKET_PATH\");",
                "        qunsetenv(\"DFM_VFSMONITOR_SOCKET_PATH\");",
                "        qunsetenv(\"DFM_VFSMONITOR_MAX_QUEUE\");"
            ]
        }
    }
}

[sourcery-ai]

Reviewer's Guide

The index service now performs optional fd-based D-Bus trust authorization during startup, receives filesystem events through the Anything D-Bus relay instead of a fixed Unix socket, applies device-aware mount filtering, and is packaged as a systemd/journal-integrated libexec service.

Sequence diagram for index startup trust negotiation

sequenceDiagram
    participant Loader as deepin-security-loader
    participant Index as deepin-anything-index
    participant Bus as SystemBus

    Loader->>Index: exec with --fd1 and --fd2
    Index->>Bus: g_bus_get_sync
    Bus-->>Index: unique bus name
    Index->>Loader: write_all trust request JSON
    Loader-->>Index: trust response JSON
    alt Result is true
        Index->>Index: registerIndexServices
    else Result is false or invalid
        Index-->>Loader: exit with failure
    end

Loading

Sequence diagram for D-Bus filesystem event relay

sequenceDiagram
    participant Monitor as VfsMonitorFileSystemWatcher
    participant Relay as org.deepin.Anything
    participant Reader as VfsSocketReader
    participant Index as Index event processor

    Monitor->>Relay: event_relay_receiver_get_fd
    Relay-->>Monitor: fd and protocol_id
    Monitor->>Monitor: dup fd and startReaderThread
    Relay-->>Reader: fs_event over SOCK_SEQPACKET
    Reader->>Reader: recv and resolveAndFilterFullPath
    Reader->>Index: flushPendingBatch
    alt mount event
        Reader->>Reader: initMountPoints
    end

Loading

File-Level Changes

Change	Details	Files
Adds startup trust negotiation with deepin-security-loader over inherited file descriptors.	Parses --fd1/--fd2 arguments and exchanges bounded JSON trust requests/responses. Obtains the system-bus unique name and requests authorization for the index D-Bus endpoint. Rejects startup when an explicitly supplied trust request fails, while retaining a non-loader compatibility path.	src/index/main.cpp src/index/utils/trustclient.cpp src/index/utils/trustclient.h src/index/CMakeLists.txt
Replaces the VFS monitor’s well-known Unix socket connection with a D-Bus event-channel relay.	Requests the relay fd through org.deepin.Anything.GetEventChannel and duplicates it for reader-thread ownership. Decodes the relay fs_event structure including action, cookie, device major/minor, and relative path fields. Preserves reconnect and batching behavior while removing socket-path injection and obsolete direct-socket test infrastructure.	src/index/fsmonitor/vfsmonitorwatcher.cpp src/index/fsmonitor/vfsmonitorwatcher.h src/index/fsmonitor/vfsmonitorwatcher_p.h autotests/index/test_vfsmonitorfilesystemwatcher.cpp autotests/index/CMakeLists.txt
Updates mount and path resolution for device-aware relay events and lower-filesystem filtering.	Tracks mount device IDs, child mount points, and overlay/fuse lower filesystem types. Resolves relative event paths using the event device and filters lower-filesystem events before root and exclusion checks. Reworks mount initialization and removes the previous inode-based root-alias reconstruction.	src/index/fsmonitor/vfsmonitorwatcher.cpp src/index/fsmonitor/vfsmonitorwatcher_p.h
Integrates systemd runtime support, journal logging, and the new installation layout.	Installs the index executable under libexec/deepin and links GLib/GIO plus libsystemd dependencies. Redirects Qt messages to the user journal with source-location and priority fields, falling back to stderr. Adjusts Debian packaging, service metadata, and test linkage for the new runtime dependencies.	src/index/main.cpp src/index/CMakeLists.txt src/index/deepin-anything-index.service debian/control debian/deepin-anything-index.install autotests/index/CMakeLists.txt

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lzwind, wangrong1069

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wangrong1069]

/forcemerge

[deepin-bot]

This pr force merged! (status: unstable)