mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:35:22 +08:00
Update electron-builder to 26.6.0 (#63232)
* Update electron-builder to 26.6.0 * Add special entitlements for ad-hoc signed builds * Add special entitlements for main app too * Add commit hashes to Linux scripts * Check Linux scripts with shellcheck --------- Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
This commit is contained in:
ravicious
co-authored by
Grzegorz Zdunek
Grzegorz Zdunek
parent
fa5de89141
commit
e0dfe3000b
Generated
+355
-467
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,13 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<!-- https://github.com/electron/electron-notarize#prerequisites -->
|
||||
<key>com.apple.security.cs.allow-jit</key>
|
||||
<true/>
|
||||
<!-- Needed for an ad-hoc signed build to work with hardened runtime.
|
||||
https://github.com/electron-userland/electron-builder/issues/5850#issuecomment-2887254139 -->
|
||||
<key>com.apple.security.cs.disable-library-validation</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</plist>
|
||||
+10
-3
@@ -2,15 +2,18 @@
|
||||
set -eu
|
||||
|
||||
###
|
||||
# Default after-install.tpl copied from electron-builder.
|
||||
# https://github.com/electron-userland/electron-builder/blob/v24.4.0/packages/app-builder-lib/templates/linux/after-install.tpl
|
||||
# Based on the default after-install.tpl copied from electron-builder.
|
||||
# https://github.com/electron-userland/electron-builder/blob/e394e0c48be965bd8a02c593ecda7e57b84b4f15/packages/app-builder-lib/templates/linux/after-install.tpl
|
||||
# Our copy has all the changes from upstream up to commit e1ea62b0029c4adca20196ef060948777caeac37.
|
||||
###
|
||||
|
||||
# Check if user namespaces are supported by the kernel and working with a quick test:
|
||||
if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
|
||||
# Use SUID chrome-sandbox only on systems without user namespaces:
|
||||
# shellcheck disable=SC2016 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
chmod 4755 '/opt/${sanitizedProductName}/chrome-sandbox' || true
|
||||
else
|
||||
# shellcheck disable=SC2016 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
chmod 0755 '/opt/${sanitizedProductName}/chrome-sandbox' || true
|
||||
fi
|
||||
|
||||
@@ -35,7 +38,9 @@ fi
|
||||
# Unfortunately, at the moment AppArmor doesn't have a good story for backwards compatibility.
|
||||
# https://askubuntu.com/questions/1517272/writing-a-backwards-compatible-apparmor-profile
|
||||
if apparmor_status --enabled > /dev/null 2>&1; then
|
||||
# shellcheck disable=SC2016 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
APPARMOR_PROFILE_SOURCE='/opt/${sanitizedProductName}/resources/apparmor-profile'
|
||||
# shellcheck disable=SC2016 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
APPARMOR_PROFILE_TARGET='/etc/apparmor.d/${executable}'
|
||||
if apparmor_parser --skip-kernel-load --debug "$APPARMOR_PROFILE_SOURCE" > /dev/null 2>&1; then
|
||||
cp -f "$APPARMOR_PROFILE_SOURCE" "$APPARMOR_PROFILE_TARGET"
|
||||
@@ -58,6 +63,7 @@ fi
|
||||
# Custom after-install.tpl script.
|
||||
###
|
||||
|
||||
# shellcheck disable=SC2154 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
APP="/opt/${sanitizedProductName}"
|
||||
BIN=/usr/local/bin
|
||||
TSH_SYMLINK_SOURCE=$APP/resources/bin/tsh
|
||||
@@ -69,7 +75,8 @@ TSH_SYMLINK_TARGET=$BIN/tsh
|
||||
# Link to the Electron app binary.
|
||||
if type update-alternatives 2>/dev/null >&1; then
|
||||
# Remove previous link if it doesn't use update-alternatives
|
||||
if [ -L "$BIN/${executable}" -a -e "$BIN/${executable}" -a "`readlink "$BIN/${executable}"`" != "/etc/alternatives/${executable}" ]; then
|
||||
# shellcheck disable=SC2154 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
if [ -L "$BIN/${executable}" ] && [ -e "$BIN/${executable}" ] && [ "$(readlink "$BIN/${executable}")" != "/etc/alternatives/${executable}" ]; then
|
||||
rm -f "$BIN/${executable}"
|
||||
fi
|
||||
update-alternatives --install "$BIN/${executable}" "${executable}" "$APP/${executable}" 100 || ln -sf "$APP/${executable}" "$BIN/${executable}"
|
||||
+9
@@ -1,6 +1,12 @@
|
||||
#!/bin/bash
|
||||
set -eu
|
||||
|
||||
###
|
||||
# Based on the default after-remove.tpl copied from electron-builder.
|
||||
# https://github.com/electron-userland/electron-builder/blob/e394e0c48be965bd8a02c593ecda7e57b84b4f15/packages/app-builder-lib/templates/linux/after-remove.tpl
|
||||
# Our copy has all the changes from upstream up to commit 88cc0b06dba22139721fd1e04f6a1cf2d447edbd.
|
||||
###
|
||||
|
||||
# Do not touch symlinks if the package is being upgraded.
|
||||
#
|
||||
# Why?
|
||||
@@ -23,10 +29,12 @@ set -eu
|
||||
#
|
||||
# Is the first argument "upgrade" or "1"?
|
||||
if [ "$1" = "upgrade" ] || [ "$1" = "1" ]; then
|
||||
# shellcheck disable=SC2154 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
echo "${executable}: Upgrade detected, skipping symlink operations"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2154 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
APP="/opt/${sanitizedProductName}"
|
||||
BIN=/usr/local/bin
|
||||
TSH_SYMLINK_TARGET=$BIN/tsh
|
||||
@@ -46,6 +54,7 @@ if [ -L "$TSH_SYMLINK_TARGET" ] && [ ! -e "$TSH_SYMLINK_TARGET" ]; then
|
||||
rm -f "$TSH_SYMLINK_TARGET"
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2016 # This is custom electron-builder macro expansion, not Bash templating.
|
||||
APPARMOR_PROFILE_DEST='/etc/apparmor.d/${executable}'
|
||||
|
||||
# Remove apparmor profile.
|
||||
@@ -53,6 +53,18 @@ if (process.env.TEAMID) {
|
||||
process.env.APPLE_TEAM_ID = process.env.TEAMID;
|
||||
}
|
||||
|
||||
/**
|
||||
* Describes whether there will be an attempt by electron-builder to sign the app on macOS.
|
||||
*/
|
||||
const shouldBeSignedOnMacOS =
|
||||
process.env.APPLE_ID ||
|
||||
process.env.APPLE_APP_SPECIFIC_PASSWORD ||
|
||||
process.env.APPLE_TEAM_ID;
|
||||
|
||||
const entitlementsMacOS = shouldBeSignedOnMacOS
|
||||
? 'build_resources/entitlements.mac.plist'
|
||||
: 'build_resources/entitlements.mac.adhoc-signed.plist';
|
||||
|
||||
/**
|
||||
* @type { import('electron-builder').Configuration }
|
||||
*/
|
||||
@@ -116,9 +128,10 @@ module.exports = {
|
||||
notarize: true,
|
||||
hardenedRuntime: true,
|
||||
gatekeeperAssess: false,
|
||||
entitlements: entitlementsMacOS,
|
||||
// Use the same entitlements for Electron subprocesses (e.g., renderer, GPU)
|
||||
// as those defined for the main app.
|
||||
entitlementsInherit: 'build_resources/entitlements.mac.plist',
|
||||
entitlementsInherit: entitlementsMacOS,
|
||||
// If CONNECT_TSH_APP_PATH is provided, we assume that tsh.app is already signed.
|
||||
signIgnore: env.CONNECT_TSH_APP_PATH && ['tsh.app'],
|
||||
icon: 'build_resources/icon-mac.png',
|
||||
@@ -223,8 +236,8 @@ module.exports = {
|
||||
},
|
||||
rpm: {
|
||||
artifactName: '${name}-${version}.${arch}.${ext}',
|
||||
afterInstall: 'build_resources/linux/after-install.tpl',
|
||||
afterRemove: 'build_resources/linux/after-remove.tpl',
|
||||
afterInstall: 'build_resources/linux/after-install.sh.tmpl',
|
||||
afterRemove: 'build_resources/linux/after-remove.sh.tmpl',
|
||||
// --rpm-rpmbuild-define "_build_id_links none" fixes the problem with not being able to install
|
||||
// Connect's rpm next to other Electron apps.
|
||||
// https://github.com/gravitational/teleport/issues/18859
|
||||
@@ -232,8 +245,8 @@ module.exports = {
|
||||
},
|
||||
deb: {
|
||||
artifactName: '${name}_${version}_${arch}.${ext}',
|
||||
afterInstall: 'build_resources/linux/after-install.tpl',
|
||||
afterRemove: 'build_resources/linux/after-remove.tpl',
|
||||
afterInstall: 'build_resources/linux/after-install.sh.tmpl',
|
||||
afterRemove: 'build_resources/linux/after-remove.sh.tmpl',
|
||||
},
|
||||
linux: {
|
||||
target: ['tar.gz', 'rpm', 'deb'],
|
||||
|
||||
@@ -45,7 +45,7 @@
|
||||
"@xterm/addon-fit": "^0.11.0",
|
||||
"@xterm/xterm": "^6.0.0",
|
||||
"electron": "39.2.2",
|
||||
"electron-builder": "^26.0.12",
|
||||
"electron-builder": "^26.6.0",
|
||||
"electron-updater": "^6.7.0",
|
||||
"electron-vite": "^4.0.1",
|
||||
"events": "3.3.0",
|
||||
|
||||
Reference in New Issue
Block a user