From d4a14acad37e000c553e1c36a72a28b37fb00a4e Mon Sep 17 00:00:00 2001 From: Sandeep Singh Date: Fri, 30 Oct 2026 20:46:53 -0700 Subject: [PATCH] fix(updater): skip apt's _apt sandbox notice in the Linux .deb install command (#35643) The copied .deb install command now passes -o Binary::file::APT::Sandbox::User=root to apt. The _apt sandbox user can't read the package in the user's private ~/.cache, so apt already fell back to root and printed an "unsandboxed as root" notice; presetting that fallback for the file: method removes the notice without changing effective privilege, and network methods stay sandboxed. Fixes #35641 Co-authored-by: Neil --- docs/site/content/docs/install.mdx | 2 +- src/main/linux-package-install-command.test.ts | 5 +++-- src/main/linux-package-install-command.ts | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/site/content/docs/install.mdx b/docs/site/content/docs/install.mdx index b07d7af7fb0..71e60e3a610 100644 --- a/docs/site/content/docs/install.mdx +++ b/docs/site/content/docs/install.mdx @@ -108,7 +108,7 @@ The AppImage has a stable download link per architecture — [`orca-linux.AppIma **The `.deb` and `.rpm` do not self-update.** Orca still notices the new version and downloads the package, then gives you a **Copy Install Command** button. Copy it rather than retyping it: Orca resolves every program to an absolute path in a trusted system directory and single-quotes the package path, so what you paste looks like this: ``` -/usr/bin/sudo /usr/bin/apt install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb' +/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb' ``` Which package manager appears depends on what your system actually has: `apt`, else `dpkg -i`, for a `.deb`; `zypper`, `dnf`, `yum`, then `rpm -Uvh` for an `.rpm`. The download directory follows `XDG_CACHE_HOME` when that is set and falls back to `~/.cache` when it is not. diff --git a/src/main/linux-package-install-command.test.ts b/src/main/linux-package-install-command.test.ts index 196db14b4c7..31787531745 100644 --- a/src/main/linux-package-install-command.test.ts +++ b/src/main/linux-package-install-command.test.ts @@ -168,7 +168,8 @@ describe('buildLinuxPackageInstallCommand', () => { const { buildLinuxPackageInstallCommand } = await loadCommandModule() expect(buildLinuxPackageInstallCommand('deb', '/tmp/orca.deb')).toEqual({ ok: true, - command: "/usr/bin/sudo /usr/bin/apt install -- '/tmp/orca.deb'" + command: + "/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/orca.deb'" }) }) @@ -246,7 +247,7 @@ describe('buildLinuxPackageInstallCommand', () => { const { buildLinuxPackageInstallCommand } = await loadCommandModule() expect(buildLinuxPackageInstallCommand('deb', "/tmp/a b'; id #.deb")).toEqual({ ok: true, - command: `/usr/bin/sudo /usr/bin/apt install -- '/tmp/a b'"'"'; id #.deb'` + command: `/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/a b'"'"'; id #.deb'` }) }) }) diff --git a/src/main/linux-package-install-command.ts b/src/main/linux-package-install-command.ts index 1f7b2056790..ad9238c62f6 100644 --- a/src/main/linux-package-install-command.ts +++ b/src/main/linux-package-install-command.ts @@ -7,7 +7,8 @@ import type { LinuxRootPackageType } from '../shared/update-status-types' const TRUSTED_EXECUTABLE_DIRECTORIES = ['/usr/bin', '/bin', '/usr/sbin', '/sbin'] const DEB_PACKAGE_MANAGERS: { name: string; args: string[] }[] = [ - { name: 'apt', args: ['install', '--'] }, + // Preset apt's own root fallback for file: reads (_apt can't read ~/.cache); network methods stay sandboxed. + { name: 'apt', args: ['-o', 'Binary::file::APT::Sandbox::User=root', 'install', '--'] }, { name: 'dpkg', args: ['-i', '--'] } ]