diff options
Diffstat (limited to 'packaging')
| -rwxr-xr-x | packaging/build/build-client.sh | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/packaging/build/build-client.sh b/packaging/build/build-client.sh index fbdf51e..d42000a 100755 --- a/packaging/build/build-client.sh +++ b/packaging/build/build-client.sh @@ -114,3 +114,23 @@ cp "$REPO/packaging/firewall/firewalld/meshbay-cast.xml" \ "$ROOT/usr/lib/firewalld/services/" echo "==> meshbay-client staging ready at $ROOT ($DEB_ARCH)" + +# `npm ci` above deletes node_modules wholesale and install.js re-extracts +# Electron's dist, so a chrome-sandbox that had been made root-owned 4755 for +# local development comes back 755, owned by whoever ran this build. Running +# the app straight from node_modules then aborts outright — Chromium refuses +# to run without its SUID helper rather than quietly dropping the sandbox, +# which is the right call and a baffling one if you have not connected the +# crash to a package build you ran minutes earlier. +# +# Said, not done: this script does not use sudo, and a build is not where a +# setuid bit should be set behind someone's back. The *packaged* app is +# unaffected — packaging/deb/meshbay-client/DEBIAN/postinst does it at +# install time, which is where it belongs. +SANDBOX="$CLIENT/node_modules/electron/dist/chrome-sandbox" +if [ -e "$SANDBOX" ] && [ ! -u "$SANDBOX" ]; then + echo + echo " NOTE: this build reset $SANDBOX to $(stat -c '%a %U:%G' "$SANDBOX")." + echo " Running Electron from node_modules needs it back:" + echo " sudo chown root:root '$SANDBOX' && sudo chmod 4755 '$SANDBOX'" +fi |