fix: bundle theia native dependencies with stricter permissions

The Arduino company is no longer soliciting monetary donations. Community members who wish to contribute to the project
still have opportunities to do so via the other options listed here.

.github/workflows/build.yml

@@ -16,7 +16,7 @@ on:
       - 'static/**'
       - '*.md'
     tags:
-      - '[0-9]+.[0-9]+.[0-9]+*'   
+      - '[0-9]+.[0-9]+.[0-9]+*'
   workflow_dispatch:
     inputs:
       paid-runners:
@@ -133,22 +133,11 @@ env:
           name: macOS_arm64_dmg
         - path: '*macOS_arm64.zip'
           name: macOS_arm64_zip
-    - config:
-        name: ARM Ubuntu 22.04
-        runs-on: ubuntu-22.04-arm
-        container: |
-          null
-        job-transfer-artifact-suffix: ARM_64bit
-        mergeable-channel-file: 'true'
-      artifacts:
-        - path: '*Linux_arm64.zip'
-          name: Linux_arm64_zip
-        - path: '*Linux_arm64.AppImage'
-          name: Linux_arm64_app_image
   PAID_RUNNER_BUILD_DATA: |
     # This system was implemented to allow selective use of paid GitHub-hosted runners, due to the Apple Silicon runner
     # incurring a charge at that time. Free Apple Silicon runners are now available so the configuration was moved to
     # `BASE_BUILD_DATA`, but the system was left in place for future use.
+
 jobs:
   run-determination:
     runs-on: ubuntu-latest
@@ -171,7 +160,9 @@ jobs:
             # There is no need to run the other jobs.
             RESULT="false"
           fi
+
           echo "result=$RESULT" >> $GITHUB_OUTPUT
+
   build-type-determination:
     needs: run-determination
     if: needs.run-determination.outputs.result == 'true'
@@ -208,11 +199,13 @@ jobs:
             is_nightly="false"
             channel_name="nightly"
           fi
+
           echo "is-release=$is_release" >> $GITHUB_OUTPUT
           echo "is-nightly=$is_nightly" >> $GITHUB_OUTPUT
           echo "channel-name=$channel_name" >> $GITHUB_OUTPUT
           # Only attempt upload to Amazon S3 if the credentials are available.
           echo "publish-to-s3=${{ secrets.AWS_ROLE_ARN != '' }}" >> $GITHUB_OUTPUT
+
   select-targets:
     needs: build-type-determination
     runs-on: ubuntu-latest
@@ -239,6 +232,7 @@ jobs:
                 --output-format json \
                 '[.[].config]'
             )"
+
             artifact_matrix="$(
               (
                 echo "${{ env.BASE_BUILD_DATA }}";
@@ -248,9 +242,11 @@ jobs:
                 --output-format json \
                 'map(.artifacts[] + (.config | pick(["job-transfer-artifact-suffix"])))'
             )"
+
             # The build matrix produces two macOS jobs (x86 and ARM) so the "channel update info files"
             # generated by each must be merged.
             merge_channel_files="true"
+
           else
             build_matrix="$(
               echo "${{ env.BASE_BUILD_DATA }}" | \
@@ -258,25 +254,31 @@ jobs:
                 --output-format json \
                 '[.[].config]'
             )"
+
             artifact_matrix="$(
               echo "${{ env.BASE_BUILD_DATA }}" | \
               yq \
                 --output-format json \
                 'map(.artifacts[] + (.config | pick(["job-transfer-artifact-suffix"])))'
             )"
+
             merge_channel_files="false"
           fi
+
           # Set workflow step outputs.
           # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
           delimiter="$RANDOM"
           echo "build-matrix<<$delimiter" >> $GITHUB_OUTPUT
           echo "$build_matrix" >> $GITHUB_OUTPUT
           echo "$delimiter" >> $GITHUB_OUTPUT
+
           delimiter="$RANDOM"
           echo "artifact-matrix<<$delimiter" >> $GITHUB_OUTPUT
           echo "$artifact_matrix" >> $GITHUB_OUTPUT
           echo "$delimiter" >> $GITHUB_OUTPUT
+
           echo "merge-channel-files=$merge_channel_files" >> $GITHUB_OUTPUT
+
   build:
     name: build (${{ matrix.config.name }})
     needs:
@@ -288,7 +290,7 @@ jobs:
       # to skip passing signing credentials to electron-builder
       IS_WINDOWS_CONFIG: ${{ matrix.config.name == 'Windows' }}
       INSTALLER_CERT_WINDOWS_CER: "/tmp/cert.cer"
-      # We are hardcoding the path for signtool because it is not present on the Windows PATH env var by default.
+      # We are hardcoding the path for signtool because is not present on the windows PATH env var by default.
       # Keep in mind that this path could change when upgrading to a new runner version
       SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/x86/signtool.exe"
       WIN_CERT_PASSWORD: ${{ secrets[matrix.config.certificate-password-secret] }}
@@ -308,17 +310,15 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - name: Install Chromium (ARM only)
-        if: matrix.config.name == 'ARM Ubuntu 22.04'
-        run: sudo apt-get update && sudo apt-get install -y chromium-browser
-
       - name: Symlink custom working directory
         shell: cmd
         if: runner.os == 'Windows' && matrix.config.working-directory
         run: |
           if not exist "${{ matrix.config.working-directory }}" mklink /d "${{ matrix.config.working-directory }}" "C:\actions-runner\_work\arduino-ide\arduino-ide"
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+
 
       - name: Install Node.js
         if: runner.name != 'WINDOWS-SIGN-PC'
@@ -337,6 +337,7 @@ jobs:
             install \
               --global \
               "yarn@${{ env.YARN_VERSION }}"
+
       - name: Install Python 3.x
         if: fromJSON(matrix.config.container) == null && runner.name != 'WINDOWS-SIGN-PC'
         uses: actions/setup-python@v5
@@ -376,12 +377,15 @@ jobs:
             export CSC_KEY_PASSWORD="${{ secrets[matrix.config.certificate-password-secret] }}"
             export CSC_FOR_PULL_REQUEST=true
           fi
+
           npx node-gyp install
           yarn install
+
           yarn --cwd arduino-ide-extension build
           yarn --cwd electron-app rebuild
           yarn --cwd electron-app build
           yarn --cwd electron-app package
+
       # Both macOS jobs generate a "channel update info file" with same path and name. The second job to complete would
       # overwrite the file generated by the first in the workflow artifact.
       - name: Stage channel file for merge
@@ -395,9 +399,11 @@ jobs:
           mv \
             "${{ env.BUILD_ARTIFACTS_PATH }}/${{ needs.build-type-determination.outputs.channel-name }}-mac.yml" \
             "${staged_channel_files_path}/${{ needs.build-type-determination.outputs.channel-name }}-mac-${{ runner.arch }}.yml"
+
           # Set workflow environment variable for use in other steps.
           # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
           echo "STAGED_CHANNEL_FILES_PATH=$staged_channel_files_path" >> "$GITHUB_ENV"
+
       - name: Upload staged-for-merge channel file artifact
         uses: actions/upload-artifact@v4
         if: >
@@ -419,6 +425,7 @@ jobs:
         shell: cmd
         run: |
           rmdir /s /q "${{ matrix.config.working-directory }}\${{ env.BUILD_ARTIFACTS_PATH }}"
+
   merge-channel-files:
     needs:
       - build-type-determination
@@ -432,11 +439,12 @@ jobs:
         run: |
           # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
           echo "CHANNEL_FILES_PATH=${{ runner.temp }}/channel-files" >> "$GITHUB_ENV"
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download staged-for-merge channel file artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           merge-multiple: true
           path: ${{ env.CHANNEL_FILES_PATH }}
@@ -470,6 +478,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y libx11-dev libxkbfile-dev libsecret-1-dev
+
       - name: Install dependencies
         run: yarn
 
@@ -479,6 +488,7 @@ jobs:
             ./scripts/merge-channel-files.js \
               --channel "${{ needs.build-type-determination.outputs.channel-name }}" \
               --input "${{ env.CHANNEL_FILES_PATH }}"
+
       - name: Upload merged channel files job transfer artifact
         uses: actions/upload-artifact@v4
         with:
@@ -503,7 +513,7 @@ jobs:
 
     steps:
       - name: Download job transfer artifact that contains ${{ matrix.artifact.name }} tester build
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: ${{ env.JOB_TRANSFER_ARTIFACT_PREFIX }}${{ matrix.artifact.job-transfer-artifact-suffix }}
           path: ${{ env.BUILD_ARTIFACTS_FOLDER }}
@@ -523,7 +533,7 @@ jobs:
       BODY: ${{ steps.changelog.outputs.BODY }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # To fetch all history for all branches and tags.
 
@@ -545,13 +555,16 @@ jobs:
             fi
           fi
           echo -e "$BODY"
+
           # Set workflow step output
           # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
           DELIMITER="$RANDOM"
           echo "BODY<<$DELIMITER" >> $GITHUB_OUTPUT
           echo "$BODY" >> $GITHUB_OUTPUT
           echo "$DELIMITER" >> $GITHUB_OUTPUT
+
           echo "$BODY" > CHANGELOG.txt
+
       - name: Upload changelog job transfer artifact
         if: needs.build-type-determination.outputs.is-nightly == 'true'
         uses: actions/upload-artifact@v4
@@ -587,7 +600,7 @@ jobs:
 
     steps:
       - name: Download all job transfer artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           merge-multiple: true
           path: ${{ env.ARTIFACTS_FOLDER }}
@@ -602,6 +615,7 @@ jobs:
       - name: Publish Nightly [S3]
         run: |
           aws s3 sync ${{ env.ARTIFACTS_FOLDER }} s3://${{ secrets.DOWNLOADS_BUCKET }}/arduino-ide/nightly
+
   release:
     needs:
       - build-type-determination
@@ -629,7 +643,7 @@ jobs:
 
     steps:
       - name: Download all job transfer artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           merge-multiple: true
           path: ${{ env.ARTIFACTS_FOLDER }}
@@ -639,6 +653,7 @@ jobs:
         id: tag_name
         run: |
           echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
       - name: Publish Release [GitHub]
         uses: svenstaro/upload-release-action@2.9.0
         with:
@@ -660,6 +675,7 @@ jobs:
         if: needs.build-type-determination.outputs.publish-to-s3 == 'true'
         run: |
           aws s3 sync ${{ env.ARTIFACTS_FOLDER }} s3://${{ secrets.DOWNLOADS_BUCKET }}/arduino-ide
+
   clean:
     # This job must run after all jobs that use the transfer artifact.
     needs:

.github/workflows/check-containers.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build and push to local registry
         uses: docker/build-push-action@v6

.github/workflows/check-i18n-task.yml

@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
         uses: actions/setup-node@v4

.github/workflows/check-javascript.yml

@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
         uses: actions/setup-node@v4

.github/workflows/check-yarn.yml

@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
         uses: actions/setup-node@v4

.github/workflows/compose-full-changelog.yml

@@ -21,7 +21,7 @@ jobs:
       
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Node.js
         uses: actions/setup-node@v4

.github/workflows/i18n-nightly-push.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
         uses: actions/setup-node@v4

.github/workflows/i18n-weekly-pull.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
         uses: actions/setup-node@v4

.github/workflows/push-container-images.yml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Log in to the Container registry
         uses: docker/login-action@v3

.github/workflows/sync-labels.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download JSON schema for labels configuration file
         id: download-schema
@@ -106,10 +106,10 @@ jobs:
           echo "flag=--dry-run" >> $GITHUB_OUTPUT
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download configuration file artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           merge-multiple: true
           pattern: ${{ env.CONFIGURATIONS_ARTIFACT_PREFIX }}*

.github/workflows/test-javascript.yml

@@ -79,11 +79,10 @@ jobs:
           - macos-latest
           - ubuntu-latest
           - windows-latest
-          - ubuntu-22.04-arm
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
         uses: actions/setup-node@v4

.github/workflows/themes-weekly-pull.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Node.js
         uses: actions/setup-node@v4

README.md

@@ -46,9 +46,9 @@ See [**the contributor guide**](docs/CONTRIBUTING.md#contributor-guide) for more
 
 See the [**development guide**](docs/development.md) for a technical overview of the application and instructions for building the code.
 
-## Donations
+### Support the project
 
-This open source code was written by the Arduino team and is maintained on a daily basis with the help of the community. We invest a considerable amount of time in development, testing and optimization. Please consider [donating](https://www.arduino.cc/en/donate/) or [sponsoring](https://github.com/sponsors/arduino) to support our work, as well as [buying original Arduino boards](https://store.arduino.cc/) which is the best way to make sure our effort can continue in the long term.
+This open source code was written by the Arduino team and is maintained on a daily basis with the help of the community. We invest a considerable amount of time in development, testing and optimization. Please consider [buying original Arduino boards](https://store.arduino.cc/) to support our work on the project.
 
 ## License
 

docs/CONTRIBUTING.md

@@ -6,22 +6,20 @@ Thanks for your interest in contributing to this project!
 
 There are several ways you can get involved:
 
-| Type of contribution                      | Contribution method                                                              |
-| ----------------------------------------- | -------------------------------------------------------------------------------- |
-| - Support<br/>- Question<br/>- Discussion | Post on the [**Arduino Forum**][forum]                                           |
-| - Bug report<br/>- Feature request        | Issue report (see the guide [**here**][issues])                                  |
-| Testing                                   | Beta testing, PR review (see the guide [**here**][beta-testing])                 |
-| Translation                               | See the guide [**here**][translate]                                              |
-| - Bug fix<br/>- Enhancement               | Pull request (see the guide [**here**][prs])                                     |
-| Monetary                                  | - [Donate][donate]<br/>- [Sponsor][sponsor]<br/>- [Buy official products][store] |
+| Type of contribution                      | Contribution method                                              |
+| ----------------------------------------- | ---------------------------------------------------------------- |
+| - Support<br/>- Question<br/>- Discussion | Post on the [**Arduino Forum**][forum]                           |
+| - Bug report<br/>- Feature request        | Issue report (see the guide [**here**][issues])                  |
+| Testing                                   | Beta testing, PR review (see the guide [**here**][beta-testing]) |
+| Translation                               | See the guide [**here**][translate]                              |
+| - Bug fix<br/>- Enhancement               | Pull request (see the guide [**here**][prs])                     |
+| Monetary                                  | [Buy official products][store]                                   |
 
 [forum]: https://forum.arduino.cc
 [issues]: contributor-guide/issues.md#issue-report-guide
 [beta-testing]: contributor-guide/beta-testing.md#beta-testing-guide
 [translate]: contributor-guide/translation.md#translator-guide
 [prs]: contributor-guide/pull-requests.md#pull-request-guide
-[donate]: https://www.arduino.cc/en/donate/
-[sponsor]: https://github.com/sponsors/arduino
 [store]: https://store.arduino.cc
 
 ## Resources

docs/contributor-guide/translation.md

@@ -1,13 +1,41 @@
 # Translator Guide
 
-The text of the Arduino IDE interface is translated into several languages. The language can be selected in the dialog opened via **File > Preferences** in the Arduino IDE menus (**Arduino IDE > Preferences** for macOS users).
+The text of the Arduino IDE user interface is translated into several languages. The language can be selected in the dialog opened via **File > Preferences** in the Arduino IDE menus (**Arduino IDE > Preferences** for macOS users).
 
 Translating text and improving on existing translations is a valuable contribution to the project, helping make Arduino accessible to everyone.
 
-The translations for the text found in the Arduino IDE come from several sources:
+The translations for the text found in Arduino IDE come from several sources:
 
 ## Arduino IDE Text
 
+The text of the Arduino IDE application can be translated to the following languages:
+
+- čeština (Czech)
+- Deutsch (German)
+- Dutch
+- español (Spanish)
+- français (French)
+- italiano (Italian)
+- magyar (Hungarian)
+- polski (Polish)
+- português (Portuguese)
+- Türkçe (Turkish)
+- български (Bulgarian)
+- русский (Russian)
+- українська (Ukrainian)
+- 한국어 (Korean)
+- 中文(简体) (Chinese Simplified)
+- 中文(繁體) (Chinese Traditional)
+- 日本語 (Japanese)
+
+---
+
+⚠ Unfortunately the 3rd party localization system used by the Arduino IDE application imposes a technical limitation to that set of languages. For this reason, we are unable to add support to Arduino IDE for additional languages (see [`arduino/arduino-ide#1447`](https://github.com/arduino/arduino-ide/issues/1447) for details).
+
+There is no technical limitation on the set of languages to which **Arduino CLI** can be translated. If you would like to contribute translations for a language not on the above list, you are welcome to [contribute to the **Arduino CLI** project](#arduino-cli-text).
+
+---
+
 Translations of Arduino IDE's text is done in the "**Arduino IDE 2.0**" project on the **Transifex** localization platform:
 
 https://explore.transifex.com/arduino-1/ide2/

electron-app/resources/entitlements.mac.plist

@@ -8,7 +8,5 @@
     <true/>
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
-    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
-    <true/>
 </dict>
 </plist>

electron-app/webpack.config.js

@@ -1,5 +1,7 @@
 const path = require('node:path');
+const fs = require('fs');
 const webpack = require('webpack');
+const TheiaNativeWebpackPlugin = require('@theia/native-webpack-plugin');
 const frontend = require('./gen-webpack.config');
 const backend = require('./gen-webpack.node.config');
 const {
@@ -39,6 +41,27 @@ backend.config.entry['parcel-watcher'] = {
   },
 };
 
+// Override Theia native dependency bundler to assign stricter file permissions (chmod 755)
+// https://github.com/eclipse-theia/theia/blob/9a52544fb4c1ea1d3d0d6bcbe106b97184279030/dev-packages/native-webpack-plugin/src/native-webpack-plugin.ts#L149
+class NativeWebpackPlugin extends TheiaNativeWebpackPlugin {
+  // Override the method that writes/copies files
+  async copyExecutable(source, target) {
+    const targetDirectory = path.dirname(target);
+    await fs.promises.mkdir(targetDirectory, { recursive: true });
+    await fs.promises.copyFile(source, target);
+    await fs.promises.chmod(target, 0o755);
+  }
+}
+backend.config.plugins.push(new NativeWebpackPlugin({
+  out: 'native',
+  trash: true,
+  ripgrep: true,
+  pty: true,
+  nativeBindings: {
+    drivelist: 'drivelist/build/Release/drivelist.node',
+  },
+}));
+
 // Use a customized backend main that can enable the file logger in bundled mode.
 backend.config.entry['main'] = require.resolve('./arduino-ide-backend-main.js');