diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-02 11:47:51 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-02 11:47:51 +0200 |
| commit | bee5901f7a04d17c40e2c8d077437f10e59c8d81 (patch) | |
| tree | 1b62efed4792787d831c5b524cd3daa62df924ac /packaging | |
| parent | 19a7201d1d911c9f25bc112a3e0d2218eb6c14a2 (diff) | |
| download | meshbay-bee5901f7a04d17c40e2c8d077437f10e59c8d81.tar.gz | |
build(client): say when a build has reset the local chrome-sandbox
`build-client.sh` runs `npm ci`, which deletes node_modules wholesale, then
re-extracts Electron's dist. A chrome-sandbox that had been made root-owned
4755 for local development comes back 755 and owned by whoever ran the build.
Running the app straight from node_modules then aborts outright:
FATAL: The SUID sandbox helper binary was found, but is not configured
correctly. Rather than run without sandboxing I'm aborting now.
Chromium refusing to start beats it quietly dropping the sandbox, and that
refusal is baffling if the crash is not connected to a package build run
minutes earlier — the two look unrelated, and the file's own mtime is 1980
either way, so nothing on it points at what happened.
The build now says so, with the command to put it back. Said and not done: a
build script has no business setting a setuid bit behind someone's back, and
this one uses no sudo. The packaged app was never affected —
packaging/deb/meshbay-client/DEBIAN/postinst does the chown+chmod at install
time, which is where it belongs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014UtzVrzM7e2tG9fSpkR9ML
Diffstat (limited to 'packaging')
| -rwxr-xr-x | packaging/build/build-client.sh | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/packaging/build/build-client.sh b/packaging/build/build-client.sh index fbdf51e..d42000a 100755 --- a/packaging/build/build-client.sh +++ b/packaging/build/build-client.sh @@ -114,3 +114,23 @@ cp "$REPO/packaging/firewall/firewalld/meshbay-cast.xml" \ "$ROOT/usr/lib/firewalld/services/" echo "==> meshbay-client staging ready at $ROOT ($DEB_ARCH)" + +# `npm ci` above deletes node_modules wholesale and install.js re-extracts +# Electron's dist, so a chrome-sandbox that had been made root-owned 4755 for +# local development comes back 755, owned by whoever ran this build. Running +# the app straight from node_modules then aborts outright — Chromium refuses +# to run without its SUID helper rather than quietly dropping the sandbox, +# which is the right call and a baffling one if you have not connected the +# crash to a package build you ran minutes earlier. +# +# Said, not done: this script does not use sudo, and a build is not where a +# setuid bit should be set behind someone's back. The *packaged* app is +# unaffected — packaging/deb/meshbay-client/DEBIAN/postinst does it at +# install time, which is where it belongs. +SANDBOX="$CLIENT/node_modules/electron/dist/chrome-sandbox" +if [ -e "$SANDBOX" ] && [ ! -u "$SANDBOX" ]; then + echo + echo " NOTE: this build reset $SANDBOX to $(stat -c '%a %U:%G' "$SANDBOX")." + echo " Running Electron from node_modules needs it back:" + echo " sudo chown root:root '$SANDBOX' && sudo chmod 4755 '$SANDBOX'" +fi |