From 75669dcc4f060733f0fcf3b6de574b8f4630d4a1 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Thu, 3 Sep 2026 11:25:45 +0200
Subject: chore(client): build against the latest Electron, and stop defining
 the package twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Chromium CVEs are fixed in Electron releases, and a client built against
an old one ships those holes to every user. That is a certain harm; a
build that breaks on a new Electron is a repairable one. build-client.sh
now bumps to the latest on every build, prints the comparison, and lets
the build fail if it cannot cope — the failure is the signal to fix, not
a reason to stay behind. It writes package.json and the lockfile on
purpose: the new pin is meant to be committed. A registry it cannot reach
is a warning, not a failure.

Exercised by pinning back to 42.9.2 and building: "==> Electron 42.9.2 ->
44.1.1", exit 0, electron=44.1.1 in the packaged output. Note npm audit
would have said nothing about any of this — Chromium CVEs fixed in
Electron do not reliably reach the npm advisory database.

Separately, package.json declared linux.target [deb, rpm] with its own
deb/rpm depends, so `npm run dist` built a second package under the same
name. The two had drifted: /opt/MeshBay/meshbay-client against
/opt/meshbay-client/meshbay, and Depends: python3-meshbay-common naming
none of the Electron runtime libraries the real DEBIAN/control lists — it
would have installed cleanly and then refused to start. Nothing in the
tree referenced `npm run dist`, which is why the drift was free to
happen. That config is gone, "dist" delegates to build-client.sh, and
test_desktop_shell.py refuses its return.

`--dir` was re-run with no linux block at all: exit 0, same binary
build-client.sh consumes. It needs appId, productName and files, nothing
else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AbwJDbNTkiRUh7HTWEoyss
---
 packages/meshbay-client/package.json | 26 ++++----------------------
 1 file changed, 4 insertions(+), 22 deletions(-)

(limited to 'packages/meshbay-client/package.json')

diff --git a/packages/meshbay-client/package.json b/packages/meshbay-client/package.json
index 7d88f5b..42af9c5 100644
--- a/packages/meshbay-client/package.json
+++ b/packages/meshbay-client/package.json
@@ -10,10 +10,10 @@
   "scripts": {
     "start": "electron .",
     "sync-ui": "node scripts/sync-ui.js",
-    "dist": "npm run sync-ui && electron-builder --linux deb rpm"
+    "dist": "bash ../../packaging/build/build-client.sh"
   },
   "devDependencies": {
-    "electron": "^42.11.1",
+    "electron": "^44.1.1",
     "electron-builder": "^26.15.3"
   },
   "build": {
@@ -22,25 +22,7 @@
     "files": [
       "src/**",
       "ui/**"
-    ],
-    "linux": {
-      "target": [
-        "deb",
-        "rpm"
-      ],
-      "category": "Network",
-      "synopsis": "Peer-to-peer file sharing, streaming and group chat"
-    },
-    "deb": {
-      "depends": [
-        "python3-meshbay-common"
-      ]
-    },
-    "rpm": {
-      "depends": [
-        "python3-meshbay-common"
-      ]
-    }
+    ]
   },
   "dependencies": {
     "bonjour-service": "^1.4.4",
@@ -50,6 +32,6 @@
     "protobufjs": "^7.6.5"
   },
   "allowScripts": {
-    "electron@42.11.1": true
+    "electron@44.1.1": true
   }
 }
-- 
cgit v1.2.3