diff options
Diffstat (limited to 'packaging')
| -rwxr-xr-x | packaging/build/build-client.sh | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/packaging/build/build-client.sh b/packaging/build/build-client.sh index d42000a..7bac10c 100755 --- a/packaging/build/build-client.sh +++ b/packaging/build/build-client.sh @@ -46,6 +46,49 @@ mkdir -p "$ROOT" # --- Build the Electron app ----------------------------------------------- cd "$CLIENT" +# --- Electron: always build against the latest release -------------------- +# +# Chromium CVEs are fixed in Electron releases, and a client built against an +# old one ships those holes to every user. That is a certain harm; a build that +# breaks on a new Electron is a repairable one. So this bumps to the latest on +# every build and lets the build fail if it cannot cope — the failure is the +# signal to fix, not a reason to stay behind. +# +# It writes package.json and package-lock.json, so the build leaves the repo +# dirty on purpose: the new pin is meant to be committed. `npm audit` will not +# tell you any of this — Chromium CVEs fixed in Electron do not reliably reach +# the npm advisory database, which is why this check exists at all. +echo " checking for a newer Electron" +PINNED=$(node -p "require('./package-lock.json').packages['node_modules/electron'].version" 2>/dev/null || echo "unknown") +LATEST=$(npm view electron version 2>/dev/null || echo "") + +if [ -z "$LATEST" ]; then + echo " !! could not reach the npm registry — building against the pinned Electron $PINNED" >&2 +elif [ "$LATEST" = "$PINNED" ]; then + echo " Electron $PINNED is the latest" +else + echo "" + echo " ==> Electron $PINNED -> $LATEST" + echo "" + npm install --save-dev --ignore-scripts "electron@$LATEST" 2>&1 | tail -2 + # allowScripts pins an exact version; leave it matching so npm does not + # start refusing a script a future Electron reintroduces. + node -e " + const fs = require('node:fs'); + const p = JSON.parse(fs.readFileSync('package.json', 'utf8')); + if (p.allowScripts) { + for (const k of Object.keys(p.allowScripts)) { + if (k.startsWith('electron@')) { + delete p.allowScripts[k]; + p.allowScripts['electron@$LATEST'] = true; + } + } + fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n'); + } + " + echo " package.json and package-lock.json updated — commit them" +fi + echo " npm ci" npm ci --ignore-scripts 2>&1 | tail -3 |