The post-install userns probe runs as root under dpkg/rpm, and root can
create a user namespace even when unprivileged userns is restricted (e.g.
Ubuntu 23.10+ with apparmor_restrict_unprivileged_userns=1). The probe
therefore always passes at install time and leaves chrome-sandbox at 0755,
so on machines where the app itself cannot use the userns sandbox Chromium
aborts: 'The SUID sandbox helper binary was found, but is not configured
correctly ... must be owned by root and have mode 4755'.
Set 4755 unconditionally (the historical electron/chrome default) so the
SUID sandbox works as a fallback whenever the userns + AppArmor path fails.
Refs: binaricat/Netcatty#2607
Root cause: FPM-generated .pacman packages copy icons directly to
/usr/share/icons/hicolor/*/apps/netcatty.png, bypassing Arch's alpm
hooks that normally run gtk-update-icon-cache. Without a refreshed
cache, KDE Plasma cannot resolve Icon=netcatty and falls back to a
generic document icon in the app menu.
Fix:
- Copy electron-builder's default after-install template to
scripts/linux/after-install.tpl, append gtk-update-icon-cache call
- Create scripts/linux/after-remove.tpl with the same cache refresh
- Wire into pacman.afterInstall/pacman.afterRemove
(NOT linux.afterInstall — the schema places these under target-level
options like PacmanOptions/DebOptions, not LinuxConfiguration)
- Add test in electron-builder-config.test.cjs
The command is idempotent on systems without gtk-update-icon-cache
(hash guard) and uses || true to never break package installation.
bincxz