From 7ee0003106e3ea63b14344e82586b816e089dabf Mon Sep 17 00:00:00 2001 From: Omabot Date: Wed, 19 Aug 2026 02:56:22 -0700 Subject: [PATCH] Keep the sandbox up on hardened kernels, and stop deleting what we have not read MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three fixes from a review of the previous commit. Chromium's sandbox helper ships setuid, the way Arch's own electron and chromium packages ship theirs. Dropping --no-sandbox was right, but it left the app relying on unprivileged user namespaces alone: on linux-hardened, or anywhere else they are denied, Electron falls back to the helper and aborts because it is not root-owned 4755. The AppImage's usr/ tree is now read before it is removed. Deleting it wholesale is correct for what upstream ships today, and the version bumps arrive unattended, so a release that starts putting something needed in there would have had it dropped on the way past without anyone seeing it. Anything that is not a known icon or a known compatibility library stops the build instead. The upstream hook checks that the feed still names the asset the PKGBUILD builds. It hashes whatever the feed points at, so a rename — or an arm64 build reaching the Linux feed first — would have pinned that file's checksum to a URL nobody fetches, and the failure would have surfaced a build later as a checksum mismatch. 🤖 Generated by Opus 5 in Claude Code. Reviewed by Codex XHigh. Co-Authored-By: Codex XHigh --- pkgbuilds/t3code-bin/.omarchy/upstream.sh | 9 +++++++++ pkgbuilds/t3code-bin/PKGBUILD | 16 ++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/pkgbuilds/t3code-bin/.omarchy/upstream.sh b/pkgbuilds/t3code-bin/.omarchy/upstream.sh index c146c18a..6bc010c9 100755 --- a/pkgbuilds/t3code-bin/.omarchy/upstream.sh +++ b/pkgbuilds/t3code-bin/.omarchy/upstream.sh @@ -23,6 +23,15 @@ if [[ -n "$current" ]] && [[ "$(vercmp "$version" "$current")" -le 0 ]]; then exit 0 fi +# The PKGBUILD builds one fixed asset name, so a feed naming anything else -- +# a rename, or an arm64 build reaching the Linux feed first -- has to stop the +# sync rather than pin that file's checksum to a URL nobody will fetch. +expected="T3-Code-${version}-x86_64.AppImage" +if [[ "$asset" != "$expected" ]]; then + echo "Upstream feed names $asset, but the PKGBUILD builds $expected" >&2 + exit 1 +fi + sha256=$(curl -fsSL "$RELEASE_URL/v${version}/${asset}" | sha256sum | cut -d' ' -f1) jq -n --arg pkgver "$version" --arg sha256 "$sha256" \ diff --git a/pkgbuilds/t3code-bin/PKGBUILD b/pkgbuilds/t3code-bin/PKGBUILD index 3bc0d4cd..dbcc9034 100644 --- a/pkgbuilds/t3code-bin/PKGBUILD +++ b/pkgbuilds/t3code-bin/PKGBUILD @@ -73,6 +73,17 @@ package() { # The AppImage's usr/ tree is compatibility libraries for distributions that # lack them, and Arch is not one; its icons are the only part worth keeping. + # A release that starts shipping something else there stops the build rather + # than having it deleted quietly on the way past. + local unexpected + unexpected=$(find usr \( -type f -o -type l \) | grep -vE \ + '^usr/share/icons/hicolor/[0-9]+x[0-9]+/apps/t3code\.png$|^usr/lib/lib(Xss\.so\.1|Xtst\.so\.6|appindicator\.so\.1|gconf-2\.so\.4|indicator\.so\.7|notify\.so\.4)$' || true) + if [[ -n "${unexpected}" ]]; then + echo "Unexpected files in the AppImage's usr/ tree:" >&2 + echo "${unexpected}" >&2 + return 1 + fi + local icon size for icon in usr/share/icons/hicolor/*/apps/t3code.png; do size="${icon#usr/share/icons/hicolor/}" @@ -91,6 +102,11 @@ package() { cp -a . "${pkgdir}/usr/lib/t3code/" chmod -R a+rX "${pkgdir}/usr/lib/t3code" + # Arch ships Chromium's and Electron's own sandbox helper setuid, which is + # what keeps the sandbox up on a kernel that denies unprivileged user + # namespaces -- linux-hardened, mainly -- instead of aborting the app. + chmod 4755 "${pkgdir}/usr/lib/t3code/chrome-sandbox" + install -Dm755 "${srcdir}/t3code-launcher.sh" "${pkgdir}/usr/bin/t3code" install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" }