The new Python script currently carries out the same checks as the old bash audit script (with a few minor enhancements, like checking for libhardened_malloc-light.so in a couple places), plus one additional check for MAC randomization. It is more modular and significantly faster: on my system with lots of flatpaks installed, the bash script typically takes about 20 seconds to run, while the Python script takes about 9 seconds.

Flatpak permission checks can be skipped by passing the --skip flatpak option. Note: the bash script seems to have only checked one version of each flatpak in cases where multiple versions are installed—I think this was an error, though in practice it typically just affects runtimes, which aren't visible in Flatseal anyway and are unlikely to fail the permission checks.

Implementation details: Each check is a generator (optionally asynchronous) that optionally accepts some state (an associative array that can be used to pass information between checks) and yields a sequence of reports (the lines that are shown under the "Audit" heading with a "success/warning/failure" status) and recommendations (printed at the end), which are handled by an audit runner. A decorator @audit is used to queue up generators to be run by the default audit runner. The file can also be imported as a Python module for use in other code—it doesn't run any audits automatically if imported.