From dc695732bf9c7c6f9d387ec4937ba57a36928295 Mon Sep 17 00:00:00 2001
From: Fedor Indutny <79877362+indutny-signal@users.noreply.github.com>
Date: Fri, 7 May 2021 11:04:38 -0700
Subject: [PATCH] Use fuses to disable ELECTRON_RUN_AS_NODE

---
 package.json             |  6 ++++--
 scripts/fuse-electron.js | 13 +++++++++++++
 yarn.lock                |  7 +++++++
 3 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 scripts/fuse-electron.js

diff --git a/package.json b/package.json
index 71af9f5ef17..f446fe6b0a4 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   },
   "main": "main.js",
   "scripts": {
-    "postinstall": "yarn build:acknowledgments && snyk protect && patch-package && electron-builder install-app-deps && rimraf node_modules/dtrace-provider",
+    "postinstall": "yarn build:acknowledgments && yarn build:fuses && snyk protect && patch-package && electron-builder install-app-deps && rimraf node_modules/dtrace-provider",
     "postuninstall": "yarn build:acknowledgments",
     "start": "electron .",
     "grunt": "grunt",
@@ -47,7 +47,7 @@
     "dev:typed-scss": "yarn build:typed-scss -w",
     "dev:storybook": "cross-env SIGNAL_ENV=storybook start-storybook -p 6006 -s ./",
     "storybook:axe": "build-storybook && axe-storybook",
-    "build": "run-s --print-label build:grunt build:typed-scss build:webpack build:release build:zip",
+    "build": "run-s --print-label build:grunt build:typed-scss build:webpack build:fuses build:release build:zip",
     "build:acknowledgments": "node scripts/generate-acknowledgments.js",
     "build:dev": "run-s --print-label build:grunt build:typed-scss build:webpack",
     "build:grunt": "yarn grunt",
@@ -58,6 +58,7 @@
     "build:webpack:sql-worker": "cross-env NODE_ENV=production webpack -c webpack-sql-worker.config.ts",
     "build:electron": "electron-builder --config.extraMetadata.environment=$SIGNAL_ENV",
     "build:release": "cross-env SIGNAL_ENV=production yarn build:electron -- --config.directories.output=release",
+    "build:fuses": "node scripts/fuse-electron.js",
     "build:zip": "node scripts/zip-macos-release.js",
     "preverify:ts": "yarn build:typed-scss",
     "verify": "run-p --print-label verify:*",
@@ -171,6 +172,7 @@
     "@babel/preset-react": "7.7.4",
     "@babel/preset-typescript": "7.7.7",
     "@chanzuckerberg/axe-storybook-testing": "3.0.2",
+    "@electron/fuses": "1.0.1",
     "@storybook/addon-actions": "5.1.11",
     "@storybook/addon-knobs": "5.1.11",
     "@storybook/addons": "5.1.11",
diff --git a/scripts/fuse-electron.js b/scripts/fuse-electron.js
new file mode 100644
index 00000000000..e0339866f79
--- /dev/null
+++ b/scripts/fuse-electron.js
@@ -0,0 +1,13 @@
+// Copyright 2021 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+/* eslint-disable no-console */
+
+const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses');
+
+flipFuses(require('electron'), {
+  version: FuseVersion.V1,
+  [FuseV1Options.RunAsNode]: false, // Disables ELECTRON_RUN_AS_NODE
+}).catch(error => {
+  console.error(error.stack);
+  process.exit(1);
+});
diff --git a/yarn.lock b/yarn.lock
index c728838a67b..aafb5858a45 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1185,6 +1185,13 @@
   resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.2.tgz#8f03a22a04de437254e8ce8cc84ba39689288752"
   integrity sha512-HyYEUDeIj5rRQU2Hk5HTB2uHsbRQpF70nvMhVzi+VJR0X+xNEhjPui4/kBf3VeH/wqD28PT4sVOm8qqLjBrSZg==
 
+"@electron/fuses@1.0.1":
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/@electron/fuses/-/fuses-1.0.1.tgz#b8115682aca2a81e3cbdc95121f5abb1b35f2bb5"
+  integrity sha512-UNfNOhNRzoxwrfV+4oUify8ajDgGMymzgjvyFnPIMv4ItLPi1O8aTG/VbBJVopIt3l4fjl0TeP63BBP3+u/ZOw==
+  dependencies:
+    fs-extra "^9.0.1"
+
 "@electron/get@^1.0.1":
   version "1.7.6"
   resolved "https://registry.yarnpkg.com/@electron/get/-/get-1.7.6.tgz#f1c8e87cbef0bce78644159b72340821d52066b3"