meshbay.git/packaging/build/build-client.sh, branch 0.14

chore(client): build against the latest Electron, and stop defining the package twice

2026-09-03T09:25:45Z

Chromium CVEs are fixed in Electron releases, and a client built against an old one ships those holes to every user. That is a certain harm; a build that breaks on a new Electron is a repairable one. build-client.sh now bumps to the latest on every build, prints the comparison, and lets the build fail if it cannot cope — the failure is the signal to fix, not a reason to stay behind. It writes package.json and the lockfile on purpose: the new pin is meant to be committed. A registry it cannot reach is a warning, not a failure. Exercised by pinning back to 42.9.2 and building: "==> Electron 42.9.2 -> 44.1.1", exit 0, electron=44.1.1 in the packaged output. Note npm audit would have said nothing about any of this — Chromium CVEs fixed in Electron do not reliably reach the npm advisory database. Separately, package.json declared linux.target [deb, rpm] with its own deb/rpm depends, so `npm run dist` built a second package under the same name. The two had drifted: /opt/MeshBay/meshbay-client against /opt/meshbay-client/meshbay, and Depends: python3-meshbay-common naming none of the Electron runtime libraries the real DEBIAN/control lists — it would have installed cleanly and then refused to start. Nothing in the tree referenced `npm run dist`, which is why the drift was free to happen. That config is gone, "dist" delegates to build-client.sh, and test_desktop_shell.py refuses its return. `--dir` was re-run with no linux block at all: exit 0, same binary build-client.sh consumes. It needs appId, productName and files, nothing else. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss

build(client): say when a build has reset the local chrome-sandbox

2026-09-02T09:47:51Z

`build-client.sh` runs `npm ci`, which deletes node_modules wholesale, then re-extracts Electron's dist. A chrome-sandbox that had been made root-owned 4755 for local development comes back 755 and owned by whoever ran the build. Running the app straight from node_modules then aborts outright: FATAL: The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. Chromium refusing to start beats it quietly dropping the sandbox, and that refusal is baffling if the crash is not connected to a package build run minutes earlier — the two look unrelated, and the file's own mtime is 1980 either way, so nothing on it points at what happened. The build now says so, with the command to put it back. Said and not done: a build script has no business setting a setuid bit behind someone's back, and this one uses no sudo. The packaged app was never affected — packaging/deb/meshbay-client/DEBIAN/postinst does the chown+chmod at install time, which is where it belongs. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014UtzVrzM7e2tG9fSpkR9ML

feat(packaging): 4-package .deb/.rpm build system under /opt

2026-08-31T08:49:45Z

Shared venv architecture: meshbay-common owns the Python venv with all pip deps pre-installed; hub and node add only their code into it. Client is a standalone Electron app. No pip runs at install time. - Add build scripts (packaging/build/) for common, hub, node, client - Add orchestrator build-packages.sh with deb/rpm auto-detection - Add .deb control/postinst for all 4 packages - Add .rpm specs for all 4 packages (replaces python3-meshbay-common) - Add Gnome .desktop launcher and icon resizing - Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles - Update systemd units to use /opt/meshbay-common/venv/bin/ paths - TMDB token baked into node package at build time via QE/node.env - Fix package-lock.json sync for protobufjs override Co-Authored-By: Claude Opus 4.6