Bug: mergeASARs is changing file permissions in macOS MAS

[ollm]

@electron/universal doesn't maintain all file permissions when merging app-x64.asar.unpacked and app-arm64.asar.unpacked to app.asar.unpacked (In my case used via electron-builder)

Related: electron-userland/electron-builder#8943

Test case repo: https://github.com/ollm/electron-builder-permissions-bug

mergeASARs: true

npm run build-mac-store
> electron-builder-permissions-bug@1.0.0 build-mac-store
> electron-builder --universal --mac mas && npm run postbuild
  • electron-builder  version=26.0.14 os=23.5.0
  • loaded configuration  file=package.json ("build" field)
  • description is missed in the package.json  appPackageFile=/Users/llopart/Documents/github/electron-builder-permissions-bug/package.json
  • writing effective config  file=dist/builder-effective-config.yaml
  • executing @electron/rebuild  electronVersion=36.1.0 arch=x64 buildFromSource=false appDir=./
  • installing native dependencies  arch=x64
  • completed installing native dependencies
  • packaging       platform=mas arch=x64 electron=36.1.0 appOutDir=dist/mas-universal-x64-temp
  • default Electron icon is used  reason=application icon is not set
  • executing @electron/rebuild  electronVersion=36.1.0 arch=arm64 buildFromSource=false appDir=./
  • installing native dependencies  arch=arm64
  • completed installing native dependencies
  • packaging       platform=mas arch=arm64 electron=36.1.0 appOutDir=dist/mas-universal-arm64-temp
  • packaging       platform=mas arch=universal electron=36.1.0 appOutDir=dist/mas-universal
  • signing         file=dist/mas-universal/electron-builder-permissions-bug.app platform=darwin type=distribution identityName=Developer ID Application: Oleguer Llopart (XXXXXXXXX) identityHash=XXXXXXXXXXXXXXXXXXXXXXXXXXX provisioningProfile=none
  • skipped macOS notarization  reason=`notarize` options were unable to be generated
  • signing         file=dist/mas-universal/electron-builder-permissions-bug.app platform=mas type=distribution identityName=Apple Distribution: Oleguer Llopart (XXXXXXXXX) identityHash=XXXXXXXXXXXXXXXXXXXXXXXXXXX provisioningProfile=none
> electron-builder-permissions-bug@1.0.0 postbuild
> node scripts/test-postbuild.js
Original x64                               | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Original arm64                             | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Darwin Mas x64 (app.asar.unpacked)         | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Darwin Mas arm64 (app.asar.unpacked)       | F:OK | R:OK | W:OK | X:-- | Exists:OK | -rw-r--r--
Darwin Mas x64 (app-x64.asar.unpacked)     | F:-- | R:-- | W:-- | X:-- | Exists:-- | 
Darwin Mas arm64 (app-arm64.asar.unpacked) | F:-- | R:-- | W:-- | X:-- | Exists:-- | 

mergeASARs: false

npm run build-mac-store
> electron-builder-permissions-bug@1.0.0 build-mac-store
> electron-builder --universal --mac mas && npm run postbuild
  • electron-builder  version=26.0.14 os=23.5.0
  • loaded configuration  file=package.json ("build" field)
  • description is missed in the package.json  appPackageFile=/Users/llopart/Documents/github/electron-builder-permissions-bug/package.json
  • writing effective config  file=dist/builder-effective-config.yaml
  • executing @electron/rebuild  electronVersion=36.1.0 arch=x64 buildFromSource=false appDir=./
  • installing native dependencies  arch=x64
  • completed installing native dependencies
  • packaging       platform=mas arch=x64 electron=36.1.0 appOutDir=dist/mas-universal-x64-temp
  • default Electron icon is used  reason=application icon is not set
  • executing @electron/rebuild  electronVersion=36.1.0 arch=arm64 buildFromSource=false appDir=./
  • installing native dependencies  arch=arm64
  • completed installing native dependencies
  • packaging       platform=mas arch=arm64 electron=36.1.0 appOutDir=dist/mas-universal-arm64-temp
  • packaging       platform=mas arch=universal electron=36.1.0 appOutDir=dist/mas-universal
  • signing         file=dist/mas-universal/electron-builder-permissions-bug.app platform=darwin type=distribution identityName=Developer ID Application: Oleguer Llopart (XXXXXXXXX) identityHash=XXXXXXXXXXXXXXXXXXXXXXXXXXX provisioningProfile=none
  • skipped macOS notarization  reason=`notarize` options were unable to be generated
  • signing         file=dist/mas-universal/electron-builder-permissions-bug.app platform=mas type=distribution identityName=Apple Distribution: Oleguer Llopart (XXXXXXXXX) identityHash=XXXXXXXXXXXXXXXXXXXXXXXXXXX provisioningProfile=none
> electron-builder-permissions-bug@1.0.0 postbuild
> node scripts/test-postbuild.js
Original x64                               | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Original arm64                             | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Darwin Mas x64 (app.asar.unpacked)         | F:-- | R:-- | W:-- | X:-- | Exists:-- | 
Darwin Mas arm64 (app.asar.unpacked)       | F:-- | R:-- | W:-- | X:-- | Exists:-- | 
Darwin Mas x64 (app-x64.asar.unpacked)     | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x
Darwin Mas arm64 (app-arm64.asar.unpacked) | F:OK | R:OK | W:OK | X:OK | Exists:OK | -rwxr-xr-x

[mmaietta]

universal/src/index.ts

Line 119 in 64be29d

await spawn('cp', ['-R', opts.x64AppPath, tmpApp]);

Should this just be -a instead of -R to preserve attributes?

[ollm]

Should this just be -a instead of -R to preserve attributes?

I have tried it and it does not solve the issue.

I've been doing some tests and I think I know what the cause the issue, when using mergeASARs: true @electron/universal extracts the unpacked files from the app.asar.

universal/src/index.ts

Lines 275 to 280 in 64be29d

	await mergeASARs({
	x64AsarPath: path.resolve(tmpApp, 'Contents', 'Resources', 'app.asar'),
	arm64AsarPath: path.resolve(opts.arm64AppPath, 'Contents', 'Resources', 'app.asar'),
	outputAsarPath: output,
	singleArchFiles: opts.singleArchFiles,
	});

universal/src/asar-utils.ts

Lines 176 to 180 in 64be29d

	d(`extracting ${x64AsarPath} to ${x64Dir}`);
	asar.extractAll(x64AsarPath, x64Dir);
	d(`extracting ${arm64AsarPath} to ${arm64Dir}`);
	asar.extractAll(arm64AsarPath, arm64Dir);

While when set to mergeASARs: false it copies them directly from the folder.

universal/src/index.ts

Lines 311 to 316 in 64be29d

	if (await fs.pathExists(arm64Unpacked)) {
	await fs.copy(
	arm64Unpacked,
	path.resolve(tmpApp, 'Contents', 'Resources', 'app-arm64.asar.unpacked'),
	);
	}

When generating app.asar, executable permissions are checked and maintained, but not in unpacked files.

https://github.com/electron/asar/blob/0ebe18808ee7096485e86a4a4f795f5040f287a0/src/filesystem.ts#L120-L125
https://github.com/electron/asar/blob/0ebe18808ee7096485e86a4a4f795f5040f287a0/src/filesystem.ts#L153-L155
https://github.com/electron/asar/blob/0ebe18808ee7096485e86a4a4f795f5040f287a0/src/asar.ts#L268-L278

Possible solutions

• Do the same as when setting mergeASARs: false, copy the unpacked files from the folder.
• When generating app.asar, also maintain the execution permissions on the unpacked files.