Wrapper script for linux to add --no-sandbox when running as root

Change-type: patch

.resinci.json

@@ -17,6 +17,7 @@
       "copyright": "Copyright 2016-2019 Balena Ltd",
       "productName": "balenaEtcher",
       "nodeGypRebuild": true,
+      "afterPack": "./afterPack.js",
       "files": [
         "generated",
         "lib/shared/catalina-sudo/sudo-askpass.osascript.js",

afterPack.js

@@ -0,0 +1,27 @@
+'use strict'
+
+const cp = require('child_process')
+const fs = require('fs')
+const outdent = require('outdent')
+const path = require('path')
+
+exports.default = function(context) {
+  if (context.packager.platform.name !== 'linux') {
+    return
+  }
+  const scriptPath = path.join(context.appOutDir, context.packager.executableName)
+  const binPath = scriptPath + '.bin'
+  cp.execFileSync('mv', [scriptPath, binPath])
+  fs.writeFileSync(
+    scriptPath,
+    outdent`
+      #!/bin/bash
+      if [[ $EUID -ne 0 ]]; then
+        "\${BASH_SOURCE%/*}"/${context.packager.executableName}.bin "$@"
+      else
+        "\${BASH_SOURCE%/*}"/${context.packager.executableName}.bin "$@" --no-sandbox
+      fi
+    `
+  )
+  cp.execFileSync('chmod', ['+x', scriptPath])
+}

electron-builder.yml

@@ -4,6 +4,7 @@ productName: balenaEtcher
 npmRebuild: true
 nodeGypRebuild: true
 publish: null
+afterPack: "./afterPack.js"
 files:
   - generated
   - lib/shared/catalina-sudo/sudo-askpass.osascript.js