src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(electron): disable npmRebuild so packaging doesn't need Xcode CLT

Browse Source 
electron-builder's default npmRebuild pass scans the entire node_modules
tree (not just what's actually packaged) for native addons and tries to
recompile them against Electron's ABI via node-gyp. It caught
@parcel/watcher - a transitive devDependency of some dev tool, never
shipped in this app - and hard-failed packaging on any machine without a
full Xcode Command Line Tools install ("gyp: No Xcode or CLT version
detected!"). GitHub's macOS runners happen to have Xcode, which is
presumably why CI never caught this.

The packaged app is plain esbuild-bundled JS with no native modules of
its own; the one native dependency in the repo (@signalapp/sqlcipher,
used by lib/mail-index/) ships prebuilt .node binaries for every
platform and is copied in wholesale by scripts/assemble-standalone.mjs,
never rebuilt by electron-builder. Verified by execution: packaging
failed with npmRebuild at its default (true), succeeded once set false,
and the resulting .dmg launches and runs correctly.

Also adds e2e/electron-live-sandbox.spec.ts - a live-connectivity check
against the real sandbox JMAP backend (stalwart.sandbox.vnc.de), proving
the packaged/launched app reaches it with no TLS/network errors and gets
a real structured auth-rejection on a deliberately fake credential.
Deliberately NOT wired into playwright.electron.config.ts's default
testMatch (electron-smoke.spec.ts only) - this depends on a live external
service and is a manual/opt-in verification tool, not part of the regular
regression suite.

Also carries the pre-existing lib/smime-ca/ejbca.ts no-control-regex
eslint fix from MR !1's branch (not yet merged to dev) so this commit's
own pre-commit hook passes - unrelated to electron work otherwise.
This commit is contained in:
Bernd Rodler
2026-08-05 14:29:17 +02:00
parent 12908ab706
commit 505e65f319
3 changed files with 134 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron-builder.config.js
+18
View File
@@ -15,6 +15,24 @@ module.exports = {
directories: {
output: "dist-electron-builds",
},
// The packaged app (`files` below) is plain esbuild-bundled JS - no native
// node modules of its own. The one native dependency anywhere in the repo,
// @signalapp/sqlcipher (used by lib/mail-index/**), ships its own prebuilt
// .node binaries for every platform/arch and is copied in wholesale by
// scripts/assemble-standalone.mjs as part of the extraResources standalone
// bundle below - it is never rebuilt by electron-builder.
//
// Without this, electron-builder's default @electron/rebuild pass scans
// the ENTIRE node_modules tree (not just what's actually packaged) for
// anything with a native binding and tries to recompile it from source
// against Electron's ABI via node-gyp. That caught @parcel/watcher - a
// transitive devDependency of some dev tool, never shipped in this app -
// and hard-failed the whole packaging step on any machine without a full
// Xcode Command Line Tools install (`gyp: No Xcode or CLT version
// detected!`), even though nothing that rebuild step touches is part of
// the artifact. Verified by execution: builds failed with npmRebuild at
// its default (true) and succeeded once set to false.
npmRebuild: false,
files: ["dist-electron/**/*", "package.json"],
extraResources: [
{