From 32b6c1bd57d65db7a51b7f0fd544e3b028533158 Mon Sep 17 00:00:00 2001 From: David Weber Date: Sun, 12 Jul 2026 07:24:05 +0200 Subject: [PATCH 1/2] build: update prerequisites for current Electron Check for the 7z executable that the extraction step actually invokes, while retaining the existing distro package mappings. Raise the Node.js minimum to 22.12 and bootstrap Node 22.23.1. Electron 42.6.1 requires Node >=22.12, and the previous Node 20 bootstrap fails while installing Electron's platform binary. --- README.md | 2 +- build.sh | 20 +++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index dbf0e7d..4d3a904 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ This covers the normal font picker and the **Installed by you** flow. If you alr #### Prerequisites -- **Node.js 20+** (or the script installs it locally) +- **Node.js 22.12+** (or the script installs it locally) - **p7zip** — for extracting the Windows installer - **ImageMagick** — for icon conversion - **wget** — for downloading the installer diff --git a/build.sh b/build.sh index b87a6e0..2c95073 100755 --- a/build.sh +++ b/build.sh @@ -143,7 +143,7 @@ check_system_requirements() { # Check for NVM and source it if found if [[ -d $original_home/.nvm ]]; then - echo "Found NVM installation for user $original_user, checking for Node.js 20+..." + echo "Found NVM installation for user $original_user, checking for Node.js 22.12+..." export NVM_DIR="$original_home/.nvm" if [[ -s $NVM_DIR/nvm.sh ]]; then # shellcheck disable=SC1091 @@ -244,7 +244,7 @@ parse_arguments() { check_dependencies() { echo 'Checking dependencies...' local deps_to_install='' - local common_deps='p7zip wget convert' + local common_deps='7z wget convert' local all_deps="$common_deps" # Add format-specific dependencies @@ -255,12 +255,12 @@ check_dependencies() { # Command-to-package mappings per distro family declare -A debian_pkgs=( - [p7zip]='p7zip-full' [wget]='wget' + [7z]='p7zip-full' [wget]='wget' [convert]='imagemagick' [dpkg-deb]='dpkg-dev' [rpmbuild]='rpm' ) declare -A rpm_pkgs=( - [p7zip]='p7zip p7zip-plugins' [wget]='wget' + [7z]='p7zip p7zip-plugins' [wget]='wget' [convert]='ImageMagick' [dpkg-deb]='dpkg' [rpmbuild]='rpm-build' ) @@ -339,16 +339,18 @@ setup_nodejs() { local node_version_ok=false if command -v node &> /dev/null; then - local node_version node_major + local node_version node_major node_minor node_version=$(node --version | cut -d'v' -f2) node_major="${node_version%%.*}" + node_minor="${node_version#*.}" + node_minor="${node_minor%%.*}" echo "System Node.js version: v$node_version" - if (( node_major >= 20 )); then + if (( node_major > 22 || (node_major == 22 && node_minor >= 12) )); then echo "System Node.js version is adequate (v$node_version)" node_version_ok=true else - echo "System Node.js version is too old (v$node_version). Need v20+" + echo "System Node.js version is too old (v$node_version). Need v22.12+" fi else echo 'Node.js not found in system' @@ -360,10 +362,10 @@ setup_nodejs() { fi # Node.js version inadequate - install locally - echo 'Installing Node.js v20 locally in build directory...' + echo 'Installing Node.js v22 locally in build directory...' local node_arch='x64' - local node_version_to_install='20.18.1' + local node_version_to_install='22.23.1' local node_tarball="node-v${node_version_to_install}-linux-${node_arch}.tar.xz" local node_url="https://nodejs.org/dist/v${node_version_to_install}/${node_tarball}" local node_install_dir="$work_dir/node" From 004b89f2c7cd5d2374e2876378e227b691ff90f4 Mon Sep 17 00:00:00 2001 From: David Weber Date: Sun, 12 Jul 2026 07:24:12 +0200 Subject: [PATCH 2/2] appimage: use a pinned static Type-2 runtime Replace the obsolete AppImageKit continuous build with appimagetool 1.9.1 and the 20251108 Type-2 runtime. Verify both artifacts against their upstream SHA-256 digests and reuse only verified cache entries. Map Debian architecture names to AppImage names, pass the runtime explicitly with --runtime-file, and run appimagetool in extract-and-run mode. Generated AppImages are static PIE executables and no longer require the host's legacy libfuse.so.2. --- scripts/build-appimage.sh | 91 +++++++++++++++++++++++---------------- 1 file changed, 54 insertions(+), 37 deletions(-) diff --git a/scripts/build-appimage.sh b/scripts/build-appimage.sh index a5c3ad5..c01a7ec 100755 --- a/scripts/build-appimage.sh +++ b/scripts/build-appimage.sh @@ -246,56 +246,73 @@ cat > "$metadata_dir/${component_id}.appdata.xml" << EOF EOF echo "AppStream metadata created" -# --- Get appimagetool --- -appimagetool_path='' +# --- Get appimagetool and Type-2 runtime --- +# Pin and verify both artifacts. The maintained appimagetool otherwise downloads +# a moving, unverified runtime during each build. +readonly appimagetool_version='1.9.1' +readonly runtime_version='20251108' + +case "$architecture" in + amd64) + tool_arch='x86_64' + appimagetool_sha256='ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0' + runtime_sha256='2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d' + ;; + arm64) + tool_arch='aarch64' + appimagetool_sha256='f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158' + runtime_sha256='00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444' + ;; + *) + echo "Unsupported architecture for appimagetool: $architecture" >&2 + exit 1 + ;; +esac -if command -v appimagetool &> /dev/null; then - appimagetool_path=$(command -v appimagetool) - echo "Found appimagetool in PATH: $appimagetool_path" -fi +download_verified() { + local url="$1" + local output="$2" + local expected_sha256="$3" -for arch in x86_64 aarch64; do - [[ -n $appimagetool_path ]] && break - local_path="$work_dir/appimagetool-${arch}.AppImage" - if [[ -f $local_path ]]; then - appimagetool_path="$local_path" - echo "Found downloaded ${arch} appimagetool: $appimagetool_path" + if [[ -f $output ]] && printf '%s %s\n' "$expected_sha256" "$output" | sha256sum --check --status; then + echo "Using verified cached artifact: $output" + return fi -done - -if [[ -z $appimagetool_path ]]; then - echo 'Downloading appimagetool...' - case "$architecture" in - amd64) tool_arch='x86_64' ;; - arm64) tool_arch='aarch64' ;; - *) - echo "Unsupported architecture for appimagetool: $architecture" >&2 - exit 1 - ;; - esac - - appimagetool_url="https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-${tool_arch}.AppImage" - appimagetool_path="$work_dir/appimagetool-${tool_arch}.AppImage" - - if wget -q -O "$appimagetool_path" "$appimagetool_url"; then - chmod +x "$appimagetool_path" || exit 1 - echo "Downloaded appimagetool to $appimagetool_path" - else - echo "Failed to download appimagetool from $appimagetool_url" >&2 - rm -f "$appimagetool_path" + + echo "Downloading $url" + rm -f "$output" + if ! wget -q -O "$output" "$url"; then + echo "Failed to download $url" >&2 + rm -f "$output" exit 1 fi -fi + if ! printf '%s %s\n' "$expected_sha256" "$output" | sha256sum --check --status; then + echo "Checksum verification failed for $output" >&2 + rm -f "$output" + exit 1 + fi +} + +appimagetool_path="$work_dir/appimagetool-${appimagetool_version}-${tool_arch}.AppImage" +runtime_path="$work_dir/runtime-${runtime_version}-${tool_arch}" +download_verified \ + "https://github.com/AppImage/appimagetool/releases/download/${appimagetool_version}/appimagetool-${tool_arch}.AppImage" \ + "$appimagetool_path" "$appimagetool_sha256" +download_verified \ + "https://github.com/AppImage/type2-runtime/releases/download/${runtime_version}/runtime-${tool_arch}" \ + "$runtime_path" "$runtime_sha256" +chmod +x "$appimagetool_path" || exit 1 # --- Build AppImage --- echo 'Building AppImage...' output_filename="${package_name}-${version}-${architecture}.AppImage" output_path="$work_dir/$output_filename" -export ARCH="$architecture" +export ARCH="$tool_arch" echo "Using ARCH=$ARCH" echo 'Building AppImage without update information' -if ! "$appimagetool_path" "$appdir_path" "$output_path"; then +if ! APPIMAGE_EXTRACT_AND_RUN=1 "$appimagetool_path" \ + --runtime-file "$runtime_path" "$appdir_path" "$output_path"; then echo "Failed to build AppImage using $appimagetool_path" >&2 exit 1 fi