Add permissions check in CI; expand scope of permissions fix in snapcraft.yml and flathub.yml

Author: catilac

.github/workflows/build.yml

@@ -77,6 +77,14 @@ jobs:
       - name: Package Processing with Gradle
         run: ./gradlew packageDistributionForCurrentOS
 
+      - name: Verify binary permissions in .deb
+        if: matrix.os_prefix == 'linux'
+        run: |
+          DEB=$(ls app/build/compose/binaries/main/deb/processing*.deb)
+          dpkg-deb -x "$DEB" /tmp/debcheck
+          test -x /tmp/debcheck/opt/processing/lib/app/resources/jdk/bin/java
+          test -x /tmp/debcheck/opt/processing/lib/app/resources/modes/java/application/launch4j/bin/windres
+
       - name: Add artifact
         uses: actions/upload-artifact@v4
         if: ${{ github.event_name != 'pull_request' }}

app/build.gradle.kts

@@ -675,4 +675,11 @@ afterEvaluate {
         dependsOn("includeJdk")
         finalizedBy("setExecutablePermissions")
     }
+    // finalizedBy above only guarantees setExecutablePermissions runs after
+    // createDistributable, not before packageDeb, which merely depends on
+    // createDistributable transitively - without this, jpackage can read the
+    // app image before permissions are restored on it.
+    tasks.named("packageDeb").configure {
+        dependsOn("setExecutablePermissions")
+    }
 }

app/linux/flathub.yml

@@ -19,7 +19,7 @@ modules:
         - ar x processing.deb
         - tar --zstd -xf data.tar.zst
         - mv opt/processing/* /app/
-        - find /app/lib/app/resources/jdk/bin -type f -exec chmod +x {} +
+        - find /app/lib/app/resources -path "*/bin/*" -type f -exec chmod +x {} +
 
         # Install the desktop file and icon
         - install -D /app/lib/processing-Processing.desktop /app/share/applications/$identifier.desktop

app/linux/snapcraft.yml

@@ -39,4 +39,4 @@ parts:
     override-prime: |
       snapcraftctl prime
       rm -vf usr/lib/jvm/java-17-openjdk-*/lib/security/cacerts
-      chmod -R +x opt/processing/lib/app/resources/jdk
+      find opt/processing/lib/app/resources -path "*/bin/*" -type f -exec chmod +x {} +