add a way to disable sandbox if we cannot use it without crashing

.prettierignore

@@ -56,3 +56,4 @@ stylesheets/_intlTelInput.scss
 coverage/**
 .nyc_output/**
 session-file-server/**
+release/**

build/afterPackHook.js

@@ -0,0 +1,43 @@
+const path = require('path');
+const fs = require('fs');
+const util = require('util');
+
+const renameAsync = util.promisify(fs.rename);
+const unlinkAsync = util.promisify(fs.unlink);
+
+module.exports = async function (context) {
+  // Replace the app launcher on linux only.
+  if (process.platform !== 'linux') {
+    return;
+  }
+  const isAppImage = context.targets.find(target => target.name === 'appImage')
+  if (!isAppImage) {
+    return
+  }
+  // eslint-disable-next-line no-console
+  console.log('afterPack hook triggered', context);
+
+  const executableName = context.packager.executableName;
+  const sourceExecutable = path.join(context.appOutDir, executableName);
+  const targetExecutable = path.join(
+    context.appOutDir,
+    `${executableName}-bin`
+  );
+  const launcherScript = path.join(
+    context.appOutDir,
+    'resources',
+    'launcher-script.sh'
+  );
+  const chromeSandbox = path.join(context.appOutDir, 'chrome-sandbox');
+
+  return Promise.all([
+    // rename session-desktop to session-desktop-bin
+    renameAsync(sourceExecutable, targetExecutable),
+
+    // rename launcher script to session-desktop
+    renameAsync(launcherScript, sourceExecutable),
+
+    // remove the chrome-sandbox file since we explicitly disable it
+    unlinkAsync(chromeSandbox),
+  ]);
+};

build/launcher-script.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -ex
+
+UNPRIVILEGED_USERNS_ENABLED=$(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null)
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+exec "$SCRIPT_DIR/session-desktop-bin" "$([[ $UNPRIVILEGED_USERNS_ENABLED == 0 ]] && echo '--no-sandbox')" "$@"

package.json

@@ -224,6 +224,10 @@
     "appId": "com.loki-project.messenger-desktop",
     "afterSign": "build/notarize.js",
     "artifactName": "${name}-${os}-${arch}-${version}.${ext}",
+    "extraResources": {
+      "from": "./build/launcher-script.sh",
+      "to": "./launcher-script.sh"
+    },
     "mac": {
       "category": "public.app-category.social-networking",
       "icon": "build/icons/mac/icon.icns",
@@ -334,7 +338,8 @@
       "!node_modules/@journeyapps/sqlcipher/lib/binding/node-*",
       "!build/*.js",
       "!dev-app-update.yml"
-    ]
+    ],
+    "afterPack": "./build/afterPackHook.js"
   },
   "husky": {
     "hooks": {
@@ -346,4 +351,4 @@
     "*/**/*.{css,js,json,scss,ts,tsx}": "prettier --write",
     "*.js": "eslint --cache --fix"
   }
-}
+}