Add permissions check in CI; expand scope of permissions fix (#1571)

* Add permissions check in CI; expand scope of permissions fix in snapcraft.yml and flathub.yml

* make permissions changes at end

Author: catilac

.github/workflows/build.yml

@@ -77,6 +77,14 @@ jobs:
       - name: Package Processing with Gradle
         run: ./gradlew packageDistributionForCurrentOS
 
+      - name: Verify binary permissions in .deb
+        if: matrix.os_prefix == 'linux'
+        run: |
+          DEB=$(ls app/build/compose/binaries/main/deb/processing*.deb)
+          dpkg-deb -x "$DEB" /tmp/debcheck
+          test -x /tmp/debcheck/opt/processing/lib/app/resources/jdk/bin/java
+          test -x /tmp/debcheck/opt/processing/lib/app/resources/modes/java/application/launch4j/bin/windres
+
       - name: Add artifact
         uses: actions/upload-artifact@v4
         if: ${{ github.event_name != 'pull_request' }}

app/build.gradle.kts

@@ -667,6 +667,37 @@ tasks.register("setExecutablePermissions") {
     }
 }
 
+tasks.register("fixDebPermissions") {
+    description = "Rebuilds the .deb so binaries under opt/processing/lib/app/resources keep their executable bit " +
+        "(jpackage's own deb assembly does not reliably preserve it for arbitrary resource files)"
+    group = "compose desktop"
+    onlyIf { OperatingSystem.current().isLinux }
+
+    val execOps = objects.newInstance<ExecOps>().execOps
+
+    doLast {
+        val debDir = layout.buildDirectory.dir("compose/binaries/main/deb").get().asFile
+        val deb = debDir.listFiles { f -> f.name.startsWith("processing") && f.name.endsWith(".deb") }
+            ?.singleOrNull()
+            ?: throw GradleException("Expected exactly one processing*.deb in $debDir")
+
+        val extractDir = debDir.resolve("${deb.nameWithoutExtension}-fixperms")
+        extractDir.deleteRecursively()
+
+        execOps.exec {
+            commandLine(
+                "fakeroot", "bash", "-c",
+                "dpkg-deb -R '${deb.absolutePath}' '${extractDir.absolutePath}' && " +
+                    "find '${extractDir.absolutePath}/opt/processing/lib/app/resources' " +
+                    "-path '*/bin/*' -type f -exec chmod +x {} + && " +
+                    "dpkg-deb -b '${extractDir.absolutePath}' '${deb.absolutePath}'"
+            )
+        }
+
+        extractDir.deleteRecursively()
+    }
+}
+
 afterEvaluate {
     tasks.named("prepareAppResources").configure {
         dependsOn("includeProcessingResources")
@@ -675,4 +706,15 @@ afterEvaluate {
         dependsOn("includeJdk")
         finalizedBy("setExecutablePermissions")
     }
+    // finalizedBy above only guarantees setExecutablePermissions runs after
+    // createDistributable, not before packageDeb, which merely depends on
+    // createDistributable transitively - without this, jpackage can read the
+    // app image before permissions are restored on it.
+    tasks.named("packageDeb").configure {
+        dependsOn("setExecutablePermissions")
+        // jpackage's own --type deb assembly doesn't reliably preserve the
+        // executable bit on arbitrary resource binaries (java, windres, ...);
+        // rebuild the .deb afterward via dpkg-deb to force it back on.
+        finalizedBy("fixDebPermissions")
+    }
 }

app/linux/flathub.yml

@@ -19,7 +19,7 @@ modules:
         - ar x processing.deb
         - tar --zstd -xf data.tar.zst
         - mv opt/processing/* /app/
-        - find /app/lib/app/resources/jdk/bin -type f -exec chmod +x {} +
+        - find /app/lib/app/resources -path "*/bin/*" -type f -exec chmod +x {} +
 
         # Install the desktop file and icon
         - install -D /app/lib/processing-Processing.desktop /app/share/applications/$identifier.desktop

app/linux/snapcraft.yml

@@ -39,4 +39,4 @@ parts:
     override-prime: |
       snapcraftctl prime
       rm -vf usr/lib/jvm/java-17-openjdk-*/lib/security/cacerts
-      chmod -R +x opt/processing/lib/app/resources/jdk
+      find opt/processing/lib/app/resources -path "*/bin/*" -type f -exec chmod +x {} +