Keep the sandbox up on hardened kernels, and stop deleting what we have not read

Three fixes from a review of the previous commit.

Chromium's sandbox helper ships setuid, the way Arch's own electron and chromium packages ship theirs. Dropping --no-sandbox was right, but it left the app relying on unprivileged user namespaces alone: on linux-hardened, or anywhere else they are denied, Electron falls back to the helper and aborts because it is not root-owned 4755.

The AppImage's usr/ tree is now read before it is removed. Deleting it wholesale is correct for what upstream ships today, and the version bumps arrive unattended, so a release that starts putting something needed in there would have had it dropped on the way past without anyone seeing it. Anything that is not a known icon or a known compatibility library stops the build instead.

The upstream hook checks that the feed still names the asset the PKGBUILD builds. It hashes whatever the feed points at, so a rename — or an arm64 build reaching the Linux feed first — would have pinned that file's checksum to a URL nobody fetches, and the failure would have surfaced a build later as a checksum mismatch.

🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh.

Co-Authored-By: Codex XHigh <codex@openai.com>

pkgbuilds/t3code-bin/.omarchy/upstream.sh

@@ -23,6 +23,15 @@ if [[ -n "$current" ]] && [[ "$(vercmp "$version" "$current")" -le 0 ]]; then
   exit 0
 fi
 
+# The PKGBUILD builds one fixed asset name, so a feed naming anything else --
+# a rename, or an arm64 build reaching the Linux feed first -- has to stop the
+# sync rather than pin that file's checksum to a URL nobody will fetch.
+expected="T3-Code-${version}-x86_64.AppImage"
+if [[ "$asset" != "$expected" ]]; then
+  echo "Upstream feed names $asset, but the PKGBUILD builds $expected" >&2
+  exit 1
+fi
+
 sha256=$(curl -fsSL "$RELEASE_URL/v${version}/${asset}" | sha256sum | cut -d' ' -f1)
 
 jq -n --arg pkgver "$version" --arg sha256 "$sha256" \

pkgbuilds/t3code-bin/PKGBUILD

@@ -73,6 +73,17 @@ package() {
 
   # The AppImage's usr/ tree is compatibility libraries for distributions that
   # lack them, and Arch is not one; its icons are the only part worth keeping.
+  # A release that starts shipping something else there stops the build rather
+  # than having it deleted quietly on the way past.
+  local unexpected
+  unexpected=$(find usr \( -type f -o -type l \) | grep -vE \
+    '^usr/share/icons/hicolor/[0-9]+x[0-9]+/apps/t3code\.png$|^usr/lib/lib(Xss\.so\.1|Xtst\.so\.6|appindicator\.so\.1|gconf-2\.so\.4|indicator\.so\.7|notify\.so\.4)$' || true)
+  if [[ -n "${unexpected}" ]]; then
+    echo "Unexpected files in the AppImage's usr/ tree:" >&2
+    echo "${unexpected}" >&2
+    return 1
+  fi
+
   local icon size
   for icon in usr/share/icons/hicolor/*/apps/t3code.png; do
     size="${icon#usr/share/icons/hicolor/}"
@@ -91,6 +102,11 @@ package() {
   cp -a . "${pkgdir}/usr/lib/t3code/"
   chmod -R a+rX "${pkgdir}/usr/lib/t3code"
 
+  # Arch ships Chromium's and Electron's own sandbox helper setuid, which is
+  # what keeps the sandbox up on a kernel that denies unprivileged user
+  # namespaces -- linux-hardened, mainly -- instead of aborting the app.
+  chmod 4755 "${pkgdir}/usr/lib/t3code/chrome-sandbox"
+
   install -Dm755 "${srcdir}/t3code-launcher.sh" "${pkgdir}/usr/bin/t3code"
   install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }