super-productivity/electron-builder.yaml
Johannes Millan 297aeb30ab fix(electron): harden Snap+Wayland argv wrapper after multi-review
Address findings from code-reviewer + debugger-assistant +
refactor-specialist multi-review on 8e1c47ebc2:

- afterPack: read wrapper source before rename; on writeFile failure,
  roll the rename back so a broken intermediate state can't ship a
  package with no launcher. Strengthen idempotency check to require a
  shebang at binPath (both files alone no longer counts as "installed").
- wrapper: gate the X11 injection on \$SNAP_NAME = "superproductivity",
  not just \$SNAP set. An xdg-open from a sibling snap (e.g. Firefox)
  leaks \$SNAP into the child env, which previously would have silently
  forced XWayland on .deb/.rpm users. Derive BIN_DIR from \$SNAP
  directly when we are our snap, avoiding fragile \$0 resolution
  through snapd's wrapper chain. Stop argv scanning at -- so positional
  args that resemble --ozone-platform aren't misread as a user override.
- app-control: point app.relaunch() execPath at the sibling shell
  wrapper instead of the default process.execPath (which is the renamed
  ELF and would bypass the flag injection on a relaunched Snap+Wayland
  instance).
- Move build/snap-wrapper.sh -> build/linux/snap-wrapper.sh to match
  the existing build/linux/ layout convention.
- Update research doc §18 to reflect the tightened predicate and the
  relaunch fix.
2026-04-21 15:03:42 +02:00

172 lines
5 KiB
YAML

appId: superProductivity
productName: Super Productivity
artifactName: ${name}-${arch}.${ext}
files:
- electron/**/*
- '!electron/**/*.ts'
- '!electron/**/*.js.map'
- .tmp/angular-dist/**/*
- 'embedded.provisionprofile'
# Exclude Nx binaries - they're build tools, not runtime dependencies
- '!**/@nx/nx-darwin-*/**'
- '!**/@nx/nx-linux-*/**'
- '!**/@nx/nx-win32-*/**'
#afterSign: ./tools/notarizeMacApp.js
directories:
output: './.tmp/app-builds'
# Post-pack hook that installs a shell wrapper for Linux builds to force
# --ozone-platform=x11 in Snap+Wayland sessions.
# See tools/afterPack.js + build/linux/snap-wrapper.sh and
# docs/research/snap-wayland-gpu-fix-research.md §18.
afterPack: ./tools/afterPack.js
win:
target:
- target: nsis
arch:
- arm64
- x64
- target: portable
arch:
- arm64
- x64
publish:
- github
nsis:
# Hardcoded to avoid spaces (SignPath converts spaces to dots). Also referenced in build.yml.
artifactName: Super-Productivity-Setup-${arch}.${ext}
# allow to install to custom location
oneClick: false
allowToChangeInstallationDirectory: true
portable:
artifactName: ${name}-${arch}.${ext}
appx:
applicationId: SuperProductivity
displayName: Super Productivity
publisherDisplayName: johannesjo
publisher: CN=___-___
identityName: ___johannesjo.SuperProductivity
linux:
# Fix for issue #5259: Set executable name without spaces for snap compatibility
executableName: superproductivity
category: Office;ProjectManagement
mimeTypes:
- x-scheme-handler/superproductivity
desktop:
entry:
StartupWMClass: superproductivity
target:
- AppImage
- deb
- snap
- rpm
publish:
- github
rpm:
# Fix for issue #5368: Prevent /usr/lib/.build-id/ collisions with other Electron apps
fpm: ['--rpm-rpmbuild-define=_build_id_links none']
# leads to Error: Please specify executable name as linux.executableName instead of linux.desktop.Exec
# desktop:
# Name: Super Productivity
# Comment: A todo list and time tracking app
# Exec: superProductivity
# Terminal: false
# Type: Application
# Icon: build/icon.png
# GenericName: ToDo List and Time Tracker
snap:
grade: stable
allowNativeWayland: true
autoStart: true
base: core22
confinement: strict
environment:
# Fix for issue #4920: Isolate fontconfig cache to prevent GTK dialog rendering issues
# https://github.com/super-productivity/super-productivity/issues/4920
FC_CACHEDIR: $SNAP_USER_DATA/.cache/fontconfig
plugs:
- default # Includes: home, desktop, desktop-legacy, x11, wayland, etc.
- password-manager-service
- system-observe
- login-session-observe
# Fix for issue #6031: Add filesystem access for local file sync
# https://github.com/super-productivity/super-productivity/issues/6031
- removable-media # Allows sync to external drives/USB storage
# Override electron-builder's hardcoded gnome-3-28-1804 content snap (core20 era)
# with gnome-42-2204 (core22 era) for up-to-date Mesa drivers and GSettings schemas.
# The plug name must match the template key to replace it rather than duplicate it.
# The explicit `content` attribute tells snapd to match the gnome-42-2204 slot.
# Pattern from Tidal HiFi: https://github.com/Mastermindzh/tidal-hifi
# gnome-42-2204 has global auto-connect (granted June 2022).
# Ref: electron-builder#9452, electron-builder#8548 (closed, not planned)
- gnome-3-28-1804:
interface: content
content: gnome-42-2204
target: $SNAP/gnome-platform
default-provider: gnome-42-2204
flatpak:
runtimeVersion: '25.08'
finishArgs:
- --share=network
- --share=ipc
- --socket=x11
- --socket=wayland
- --socket=fallback-x11
- --socket=pulseaudio
- --device=dri
- --filesystem=home
- --talk-name=org.freedesktop.Notifications
- --talk-name=org.kde.StatusNotifierWatcher
- --talk-name=org.gnome.Mutter.IdleMonitor
- --talk-name=org.freedesktop.secrets
- --system-talk-name=org.freedesktop.login1
- --env=XCURSOR_PATH=/run/host/user-share/icons:/run/host/share/icons
- --env=ELECTRON_TRASH=gio
mac:
appId: com.super-productivity.app
type: distribution
category: public.app-category.productivity
entitlements: build/entitlements.mac.plist
entitlementsInherit: build/entitlements.mac.plist
hardenedRuntime: true
gatekeeperAssess: false
provisioningProfile: embedded.provisionprofile
darkModeSupport: true
notarize: true
extendInfo:
ITSAppUsesNonExemptEncryption: false
publish:
- github
target:
# - zip
- target: dmg
arch:
- arm64
- x64
- universal
dmg:
sign: true
publish:
- github
pkg:
publish: never
# HERE: electron-builder.mas.yaml
#mas:
# type: distribution
# category: public.app-category.productivity
# entitlements: build/entitlements.mas.plist
# entitlementsInherit: build/entitlements.mas.inherit.plist
# provisioningProfile: prod.provisionprofile
# icon: build/icon.icns
# hardenedRuntime: true
# publish: never