v1.11.76

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.eslintrc-test.js

@@ -2,11 +2,11 @@ module.exports = {
     plugins: ["matrix-org"],
     extends: [".eslintrc.js"],
     parserOptions: {
-        project: ["test/tsconfig.json"],
+        project: ["playwright/tsconfig.json"],
     },
     overrides: [
         {
-            files: ["test/**/*.ts"],
+            files: ["playwright/**/*.ts"],
             extends: ["plugin:matrix-org/typescript"],
             rules: {
                 // Things we do that break the ideal style

.github/CODEOWNERS

@@ -1,4 +1,5 @@
-*                         @vector-im/element-web
-/.github/workflows/**     @vector-im/element-web-app-team
-/package.json             @vector-im/element-web-app-team
-/yarn.lock                @vector-im/element-web-app-team
+*                         @element-hq/element-web-reviewers
+/.github/workflows/**     @element-hq/element-web-team
+/package.json             @element-hq/element-web-team
+/yarn.lock                @element-hq/element-web-team
+/src/i18n/strings

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,12 +2,7 @@
 
 ## Checklist
 
--   [ ] Ensure your code works with manual testing
--   [ ] Linter and other CI checks pass
--   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/vector-im/element-desktop/blob/develop/CONTRIBUTING.md))
-
-<!--
-If you would like to specify text for the changelog entry other than your PR title, add the following:
-
-Notes: Add super cool feature
--->
+-   [ ] Ensure your code works with manual testing.
+-   [ ] New or updated `public`/`exported` symbols have accurate [TSDoc](https://tsdoc.org/) documentation.
+-   [ ] Linter and other CI checks pass.
+-   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/vector-im/element-web/blob/develop/CONTRIBUTING.md)).

.github/labels.yml

@@ -0,0 +1,31 @@
+- name: "A-Install"
+  color: "72A447"
+- name: "A-Seshat"
+  color: "8262BE"
+- name: "A-Update"
+  color: "17BE67"
+- name: "Story"
+  description: "A change to the product that generates user value on its own. Unit of delivery."
+  color: "0BAC47"
+- name: "X-Breaking-Change"
+  color: "ff7979"
+- name: "Z-Arch"
+  color: "D601BE"
+- name: "Z-ARM"
+  color: "5DEC5B"
+- name: "Z-Flatpak"
+  color: "0CA856"
+- name: "Z-Linux"
+  color: "7B4A9C"
+- name: "Z-macOS"
+  color: "500605"
+- name: "Z-Official"
+  color: "1D2B20"
+- name: "Z-Snap"
+  color: "29CD95"
+- name: "Z-Suse"
+  color: "79D07B"
+- name: "Z-Wayland"
+  color: "94C519"
+- name: "Z-Windows"
+  color: "0632DE"

.github/release-drafter.yml

@@ -0,0 +1 @@
+_extends: element-hq/element-web

.github/workflows/build_and_deploy.yaml

@@ -48,6 +48,7 @@ jobs:
             config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
             version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
             nightly: ${{ inputs.mode != 'release' && github.event_name != 'release' }}
+            deploy: ${{ inputs.deploy || (github.event_name != 'workflow_dispatch' && github.event.release.prerelease != true) }}
         secrets:
             CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
             CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}
@@ -58,12 +59,11 @@ jobs:
         name: Windows ${{ matrix.arch }}
         strategy:
             matrix:
-                arch: [x86, x64]
+                arch: [ia32, x64]
         uses: ./.github/workflows/build_windows.yaml
         secrets: inherit
         with:
             sign: true
-            deploy-mode: true
             arch: ${{ matrix.arch }}
             version: ${{ needs.prepare.outputs.nightly-version }}
 
@@ -75,66 +75,127 @@ jobs:
         secrets: inherit
         with:
             sign: true
-            deploy-mode: true
             base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
             version: ${{ needs.prepare.outputs.nightly-version }}
 
-    # We do not put these calls into deploy-mode as we do not want it to add to the packages.element.io artifact
-    # We ship this build via reprepro only
     linux:
         if: github.event_name != 'workflow_dispatch' || inputs.linux
         needs: prepare
-        name: Linux ${{ matrix.arch }} (sqlcipher system)
+        name: Linux ${{ matrix.arch }} (sqlcipher ${{ matrix.sqlcipher }})
         strategy:
             matrix:
                 arch: [amd64, arm64]
+                sqlcipher: [static]
         uses: ./.github/workflows/build_linux.yaml
         with:
             arch: ${{ matrix.arch }}
             config: ${{ needs.prepare.outputs.config }}
-            sqlcipher: system
+            sqlcipher: ${{ matrix.sqlcipher }}
             version: ${{ needs.prepare.outputs.nightly-version }}
 
-    # We ship the static build via static tarball only
-    linux_static:
-        if: github.event_name != 'workflow_dispatch' || inputs.linux
-        needs: prepare
-        name: Linux (sqlcipher static)
-        uses: ./.github/workflows/build_linux.yaml
-        with:
-            arch: amd64
-            deploy-mode: true
-            config: ${{ needs.prepare.outputs.config }}
-            sqlcipher: static
-            version: ${{ needs.prepare.outputs.nightly-version }}
-
-    # This deploy job only handles Windows, macOS & linux_static as those are stateless and static.
-    # Linux will be deployed via reprepro after it, but we list it as a dependency to abort if it fails.
     deploy:
         needs:
             - prepare
             - macos
             - linux
-            - linux_static
             - windows
         runs-on: ubuntu-latest
-        name: Deploy
-        if: |
-            always() && !failure() && !cancelled() && ((
-                github.event_name != 'workflow_dispatch' &&
-                github.event.release.prerelease != true
-            ) || (
-                inputs.deploy && (inputs.macos || inputs.windows || inputs.linux)
-            ))
-        environment: packages.element.io
+        name: ${{ needs.prepare.outputs.deploy == 'true' && 'Deploy' || 'Deploy (dry-run)' }}
+        if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
+        environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
         steps:
             - name: Download artifacts
-              uses: actions/download-artifact@v3
+              uses: actions/download-artifact@v4
+
+            - name: Prepare artifacts for deployment
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          mkdir -p packages.element.io/{install,update}/win32/$arch
+                          mv win-$arch/squirrel-windows*/*.exe "packages.element.io/install/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/*.nupkg "packages.element.io/update/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/RELEASES "packages.element.io/update/win32/$arch/"
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      mkdir -p packages.element.io/{install,update}/macos
+                      mv macos/*.dmg packages.element.io/install/macos/
+                      mv macos/*-mac.zip packages.element.io/update/macos/
+                      mv macos/*.json packages.element.io/update/macos/
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-x86-64
+                      mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-aarch64
+                      mv linux-arm64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-aarch64
+                  fi
+
+            # We don't wish to store the installer for every nightly ever, so we only keep the latest
+            - name: "[Nightly] Strip version from installer file"
+              if: needs.prepare.outputs.nightly-version != ''
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      [ -d "win-$arch" ] && mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe
+                  done
+
+                  # macOS
+                  [ -d macos ] && mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg
+
+                  # Linux
+                  [ -d linux-amd64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz
+                  [ -d linux-arm64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-aarch64/{*,element-desktop-nightly}.tar.gz
+
+            - name: "[Release] Prepare release latest symlink"
+              if: needs.prepare.outputs.nightly-version == ''
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          pushd packages.element.io/install/win32/$arch
+                          ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
+                          popd
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      pushd packages.element.io/install/macos
+                      ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
+                      popd
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-x86-64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+                  if [ -d linux-arm64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-aarch64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+
+            - name: Stash packages.element.io
+              if: needs.prepare.outputs.deploy == 'false'
+              uses: actions/upload-artifact@v4
               with:
                   name: packages.element.io
                   path: packages.element.io
 
             - name: Deploy artifacts
+              if: needs.prepare.outputs.deploy == 'true'
               run: |
                   aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
               env:
@@ -144,29 +205,80 @@ jobs:
                   DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
 
             - name: Notify packages.element.io of new files
-              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
+              if: needs.prepare.outputs.deploy == 'true'
+              uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
               with:
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  repository: vector-im/packages.element.io
+                  repository: element-hq/packages.element.io
                   event-type: packages-index
 
-    reprepro:
-        needs:
-            - linux
-            # We queue this after the other deploy stage as we want to abort if that fails
-            - deploy
-        name: Run reprepro ${{ matrix.arch }}
-        strategy:
-            matrix:
-                arch: [amd64, arm64]
-        if: |
-            always() && !failure() && !cancelled() && ((
-                github.event_name != 'workflow_dispatch' &&
-                github.event.release.prerelease != true
-            ) || (
-                inputs.deploy && inputs.linux
-            ))
-        uses: ./.github/workflows/reprepro.yaml
-        secrets: inherit
-        with:
-            artifact-name: linux-${{ matrix.arch }}-sqlcipher-system
+            - name: Find debs
+              id: deb
+              if: needs.linux.result == 'success'
+              run: |
+                  for arch in amd64 arm64
+                  do
+                      echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
+                  done
+
+            - name: Stash debs
+              if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
+              uses: actions/upload-artifact@v4
+              with:
+                  name: debs
+                  path: |
+                      ${{ steps.deb.outputs.amd64 }}
+                      ${{ steps.deb.outputs.arm64 }}
+
+            - name: Publish amd64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.amd64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+            - name: Publish arm64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master
+              if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.arm64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+    deploy-ess:
+        needs: deploy
+        runs-on: ubuntu-latest
+        name: Deploy builds to ESS
+        if: needs.prepare.outputs.deploy == 'true' && github.event_name == 'release'
+        env:
+            BUCKET_NAME: "element-desktop-msi.onprem.element.io"
+            AWS_REGION: "eu-central-1"
+        permissions:
+            id-token: write # This is required for requesting the JWT
+        steps:
+            - name: Configure AWS credentials
+              uses: aws-actions/configure-aws-credentials@v4
+              with:
+                  role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
+                  role-session-name: githubaction-run-${{ github.run_id }}
+                  aws-region: ${{ env.AWS_REGION }}
+
+            - name: Download artifacts
+              uses: actions/download-artifact@v4
+              with:
+                  pattern: win-*
+
+            - name: Copy files to S3
+              run: |
+                  PREFIX="${VERSION%.*}"
+                  for file in win-*/*.msi; do
+                      filename=$(basename "$file")
+                      aws s3 cp "$file" "s3://${{ env.BUCKET_NAME }}/$PREFIX/$filename"
+                  done
+              env:
+                  VERSION: ${{ github.event.release.tag_name }}

.github/workflows/build_and_test.yaml

@@ -19,75 +19,21 @@ jobs:
         uses: ./.github/workflows/build_windows.yaml
         strategy:
             matrix:
-                arch: [x64, x86]
+                arch: [x64, ia32]
         with:
             arch: ${{ matrix.arch }}
 
-    # This allows core contributors to test changes to the dockerbuild image within a pull request
-    linux_docker:
-        name: Linux docker
-        runs-on: ubuntu-latest
-        if: github.event_name == 'pull_request'
-        outputs:
-            docker-image: ${{ steps.docker.outputs.image }}
-        permissions:
-            contents: read
-            packages: write
-        env:
-            REGISTRY: ghcr.io
-            IMAGE_NAME: ${{ github.repository }}-dockerbuild-pr
-        steps:
-            - uses: actions/checkout@v3
-
-            - name: "Get modified files"
-              id: changed_files
-              uses: tj-actions/changed-files@95690f9ece77c1740f4a55b7f1de9023ed6b1f87 # v39
-              with:
-                  files: |
-                      dockerbuild/*
-            - name: Log in to the Container registry
-              if: steps.changed_files.outputs.any_modified == 'true'
-              uses: docker/login-action@b4bedf8053341df3b5a9f9e0f2cf4e79e27360c6
-              with:
-                  registry: ${{ env.REGISTRY }}
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
-            - id: docker
-              if: steps.changed_files.outputs.any_modified == 'true'
-              run: |
-                  echo "image=$IMAGE:$PR" >> $GITHUB_OUTPUT
-              env:
-                  IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-                  PR: ${{ github.event.pull_request.number }}
-
-            - name: Build and push Docker image
-              if: steps.changed_files.outputs.any_modified == 'true'
-              uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
-              with:
-                  context: dockerbuild
-                  push: true
-                  tags: ${{ steps.docker.outputs.image }}
-
     linux:
-        needs:
-            - fetch
-            - linux_docker
+        needs: fetch
         name: "Linux (${{ matrix.arch }}) (sqlcipher: ${{ matrix.sqlcipher }})"
         uses: ./.github/workflows/build_linux.yaml
         strategy:
             matrix:
                 sqlcipher: [system, static]
                 arch: [amd64, arm64]
-                exclude:
-                    # FIXME: This combination yields a broken Seshat at this time
-                    # Errors at launch with `undefined symbol: PKCS5_PBKDF2_HMAC
-                    - arch: arm64
-                      sqlcipher: static
         with:
             config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
             sqlcipher: ${{ matrix.sqlcipher }}
-            docker-image: ${{ needs.linux_docker.outputs.docker-image }}
             arch: ${{ matrix.arch }}
 
     macos:
@@ -104,41 +50,70 @@ jobs:
             matrix:
                 include:
                     - name: macOS Universal
-                      os: macos
+                      os: macos-latest
                       artifact: macos
-                      executable: "/Volumes/Element/Element.app/Contents/MacOS/Element"
-                      prepare_cmd: "hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element"
+                      executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
+                      # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+                      # read-only and thus would not allow us to override the fuses as is required for Playwright.
+                      prepare_cmd: |
+                          hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
+                          rsync -a /Volumes/Element/Element.app ~/Applications/ &&
+                          hdiutil detach /Volumes/Element
                     - name: "Linux (amd64) (sqlcipher: system)"
-                      os: ubuntu
+                      os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-system
-                      executable: "element-desktop"
-                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
                     - name: "Linux (amd64) (sqlcipher: static)"
-                      os: ubuntu
+                      os: ubuntu-latest
                       artifact: linux-amd64-sqlcipher-static
-                      executable: "element-desktop"
-                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: system)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-system
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
+                    - name: "Linux (arm64) (sqlcipher: static)"
+                      os: dind-l-arm64
+                      artifact: linux-arm64-sqlcipher-static
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt-get -qq update && sudo apt install -y ./dist/*.deb"
                     - name: Windows (x86)
-                      os: windows
-                      artifact: win-x86
+                      os: windows-latest
+                      artifact: win-ia32
                       executable: "./dist/win-ia32-unpacked/Element.exe"
                     - name: Windows (x64)
-                      os: windows
+                      os: windows-latest
                       artifact: win-x64
                       executable: "./dist/win-unpacked/Element.exe"
         name: Test ${{ matrix.name }}
-        runs-on: ${{ matrix.os }}-latest
+        runs-on: ${{ matrix.os }}
         steps:
-            - uses: actions/checkout@v3
+            # Workaround for self-hosted runners lacking yarn
+            - name: Install Yarn
+              if: runner.environment == 'self-hosted'
+              run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1
 
-            - uses: actions/setup-node@v3
+                  sudo apt-get -qq update
+                  sudo apt-get install -y curl
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
-            - uses: actions/download-artifact@v3
+            - uses: actions/download-artifact@v4
               with:
                   name: ${{ matrix.artifact }}
                   path: dist
@@ -147,18 +122,33 @@ jobs:
               run: ${{ matrix.prepare_cmd }}
               if: matrix.prepare_cmd
 
+            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
+            # it to be enabled to test Electron apps, so turn it back on.
+            - name: Set EnableNodeCliInspectArguments fuse enabled
+              run: $RUN_AS npx @electron/fuses write --app ${{ matrix.executable }} EnableNodeCliInspectArguments=on
+              shell: bash
+              env:
+                  # We need sudo on Linux as it is installed in /opt/
+                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
+
+            - name: Workaround macOS GHA permission issues
+              if: matrix.os == 'macos-latest'
+              run: |
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/usr/local/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+                  sqlite3 $HOME/Library/Application\ Support/com.apple.TCC/TCC.db "INSERT OR IGNORE INTO access VALUES ('kTCCServiceMicrophone','/opt/off/opt/runner/provisioner/provisioner',1,2,4,1,NULL,NULL,0,'UNUSED',NULL,0,1687786159,NULL,NULL,'UNUSED',1687786159);"
+
             - name: Run tests
-              uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
+              uses: coactions/setup-xvfb@6b00cf1889f4e1d5a48635647013c0508128ee1a
               timeout-minutes: 5
               with:
-                  run: "yarn test"
+                  run: "yarn test ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }}"
               env:
                   ELEMENT_DESKTOP_EXECUTABLE: ${{ matrix.executable }}
 
-            - name: Upload Artifacts
-              uses: actions/upload-artifact@v3
+            - name: Upload HTML report
               if: always()
+              uses: actions/upload-artifact@v4
               with:
-                  name: ${{ matrix.artifact }}
-                  path: test_artifacts
-                  retention-days: 1
+                  name: ${{ matrix.artifact }}-test
+                  path: playwright/html-report
+                  retention-days: 14

.github/workflows/build_linux.yaml

@@ -20,24 +20,45 @@ on:
                 type: string
                 required: true
                 description: "How to link sqlcipher, one of 'system' | 'static'"
-            deploy-mode:
-                type: boolean
-                required: false
-                description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
-            docker-image:
-                type: string
-                required: false
-                description: "The docker image to use for the build, defaults to ghcr.io/vector-im/element-desktop-dockerbuild"
+env:
+    SQLCIPHER_BUNDLED: ${{ inputs.sqlcipher == 'static' && '1' || '' }}
 jobs:
-    build:
-        runs-on: ubuntu-latest
-        container:
-            image: ${{ inputs.docker-image || format('ghcr.io/vector-im/element-desktop-dockerbuild:{0}', github.ref_name == 'master' && 'master' || 'develop') }}
-        defaults:
-            run:
-                shell: bash
+    # We build the hak files on native infrastructure as matrix-seshat fails to cross-compile properly
+    # https://github.com/matrix-org/seshat/issues/135
+    hak:
+        runs-on: ${{ inputs.arch == 'arm64' && 'dind-l-arm64' || 'ubuntu-latest' }}
+        env:
+            HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-desktop-dockerbuild
+        outputs:
+            cache-key: ${{ steps.cache-key.outputs.key }}
+            arch: ${{ steps.config.outputs.arch }}
+            build-args: ${{ steps.config.outputs.build-args }}
         steps:
-            - uses: kanga333/variable-mapper@master
+            # Workaround for self-hosted runners lacking tools
+            - name: Install missing tools
+              if: runner.environment == 'self-hosted'
+              run: |
+                  # Sanity check that the arch is arm64 as we expect
+                  [[ $(uname -p) == "aarch64" ]] || exit 1
+
+                  sudo apt-get -qq update
+                  # curl for yarn download, git for tj-actions/changed-files, zstd for actions/cache
+                  sudo apt-get install -y curl git zstd
+                  curl -fsSL --create-dirs -o $HOME/bin/yarn https://github.com/yarnpkg/yarn/releases/download/v1.22.19/yarn-1.22.19.js
+                  chmod +x $HOME/bin/yarn
+                  echo "$HOME/bin" >> $GITHUB_PATH
+
+            - name: Resolve docker image tag for push
+              if: github.event_name == 'push'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:$GITHUB_REF_NAME" >> $GITHUB_ENV
+            - name: Resolve docker image tag for release
+              if: github.event_name == 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:staging" >> $GITHUB_ENV
+            - name: Resolve docker image tag for other triggers
+              if: github.event_name != 'push' && github.event_name != 'release'
+              run: echo "HAK_DOCKER_IMAGE=$HAK_DOCKER_IMAGE:develop" >> $GITHUB_ENV
+
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
               id: config
               with:
                   key: "${{ inputs.arch }}"
@@ -55,22 +76,30 @@ jobs:
                         }
                       }
 
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/download-artifact@v3
+            - uses: actions/download-artifact@v4
               with:
                   name: webapp
 
+            - name: Calculate cache key
+              id: cache-key
+              run: |
+                  echo "key=$CACHE_KEY" >> $GITHUB_OUTPUT
+              env:
+                  CACHE_KEY: ${{ runner.os }}-${{ github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion', 'dockerbuild/*') }}
+
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
-                  key: ${{ runner.os }}-${{ inputs.docker-image || github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  key: ${{ steps.cache-key.outputs.key }}
                   path: |
                       ./.hak
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
               env:
                   # Workaround for https://github.com/actions/setup-node/issues/317
@@ -80,50 +109,87 @@ jobs:
             - name: Install Deps
               run: "yarn install --frozen-lockfile"
 
-            - name: Prepare for static sqlcipher build
-              if: inputs.sqlcipher == 'static'
-              run: |
-                  echo "SQLCIPHER_BUNDLED=1" >> $GITHUB_ENV
+            - name: "Get modified files"
+              id: changed_files
+              if: steps.cache.outputs.cache-hit != 'true' && github.event_name == 'pull_request'
+              uses: tj-actions/changed-files@6b2903bdce6310cfbddd87c418f253cf29b2dec9 # v44
+              with:
+                  files: |
+                      dockerbuild/**
 
-            # Ideally the docker image would be ready for cross-compilation but libsqlcipher-dev is not Multi-Arch compatible
-            # https://unix.stackexchange.com/a/349359
-            - name: Prepare for cross compilation
-              if: steps.cache.outputs.cache-hit != 'true' && inputs.arch == 'arm64'
-              run: |
-                  set -x
-                  sed -i 's/deb http/deb [arch=amd64] http/g' /etc/apt/sources.list
-                  echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ bionic main multiverse restricted universe" | tee -a /etc/apt/sources.list
-                  echo "deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main multiverse restricted universe" | tee -a /etc/apt/sources.list
-                  dpkg --add-architecture arm64
-                  apt-get -qq update
-                  apt-get -qq install --no-install-recommends crossbuild-essential-arm64 libsqlcipher-dev:arm64 libssl-dev:arm64 libsecret-1-dev:arm64 libgnome-keyring-dev:arm64
-                  rustup target add aarch64-unknown-linux-gnu
-                  mv dockerbuild/aarch64/.cargo .
-                  cat dockerbuild/aarch64/.env >> $GITHUB_ENV
+            # This allows contributors to test changes to the dockerbuild image within a pull request
+            - name: Build docker image
+              uses: docker/build-push-action@5176d81f87c23d6fc96624dfdbcd9f3830bbe445 # v6
+              if: steps.changed_files.outputs.any_modified == 'true'
+              with:
+                  context: dockerbuild
+                  load: true
+                  platforms: linux/${{ inputs.arch }}
+                  tags: ${{ env.HAK_DOCKER_IMAGE }}
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
-              run: "yarn build:native --target ${{ steps.config.outputs.target }}"
+              run: |
+                  docker run \
+                    -v ${{ github.workspace }}:/work -w /work \
+                    -e SQLCIPHER_BUNDLED \
+                    $HAK_DOCKER_IMAGE \
+                    yarn build:native
+
+            - name: Check native libraries
+              run: |
+                  shopt -s globstar
+
+                  for filename in ./.hak/hakModules/**/*.node; do
+                      ./scripts/glibc-check.sh $filename
+                  done
+              env:
+                  MAX_VER: 2.28 # buster-era glibc
+
+    build:
+        needs: hak
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Load .hak
+              id: cache
+              uses: actions/cache/restore@v4
+              with:
+                  key: ${{ needs.hak.outputs.cache-key }}
+                  fail-on-cache-miss: true
+                  path: |
+                      ./.hak
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
 
             - name: "[Nightly] Resolve version"
-              id: nightly
               if: inputs.version != ''
               run: |
-                  echo "config-args=--nightly '${{ inputs.version }}'" >> $GITHUB_OUTPUT
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
 
             - name: Generate debian files and arguments
-              id: debian
               run: |
                   if [ -f changelog.Debian ]; then
-                      echo "config-args=--deb-changelog changelog.Debian" >> $GITHUB_OUTPUT
+                      echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
                   fi
 
             - name: Build App
-              run: |
-                  npx ts-node scripts/generate-builder-config.ts \
-                      ${{ steps.nightly.outputs.config-args }} \
-                      ${{ steps.debian.outputs.config-args }}
-                  yarn build --publish never -l --config electron-builder.json ${{ steps.config.outputs.build-args }}
+              run: yarn build --publish never -l ${{ needs.hak.outputs.build-args }}
 
             - name: Check native libraries
               run: |
@@ -148,42 +214,16 @@ jobs:
                   else
                       assert_contains_string "$LIBS" "libsqlcipher.so.0"
                   fi
+
+                  ./scripts/glibc-check.sh dist/linux-*unpacked/element-desktop*
               env:
-                  ARCH: ${{ steps.config.outputs.arch }}
-
-            - name: Stash deb package
-              if: inputs.deploy-mode
-              uses: actions/upload-artifact@v3
-              with:
-                  name: linux-sqlcipher-${{ inputs.sqlcipher }}-deb
-                  path: dist/*.deb
-                  retention-days: 1
-
-            - name: Prepare artifacts for deployment
-              if: inputs.deploy-mode
-              run: |
-                  mv dist _dist
-                  mkdir -p "dist/install/linux/glibc-x86-64/"
-                  mv _dist/*.tar.gz "dist/install/linux/glibc-x86-64"
-
-            # We don't wish to store the tarball for every nightly ever, so we only keep the latest
-            - name: "[Nightly] Strip version from tarball"
-              if: inputs.deploy-mode && inputs.version != ''
-              run: |
-                  mv dist/install/linux/glibc-x86-64/*.tar.gz "dist/install/linux/glibc-x86-64/element-desktop-nightly.tar.gz"
-
-            - name: "[Release] Prepare release latest symlink"
-              if: inputs.deploy-mode && inputs.version == ''
-              shell: bash
-              run: |
-                  ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
-              working-directory: "dist/install/linux/glibc-x86-64"
+                  ARCH: ${{ needs.hak.outputs.arch }}
 
             # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
             - name: Upload Artifacts
-              uses: actions/upload-artifact@v3
+              uses: actions/upload-artifact@v4
               with:
-                  name: ${{ inputs.deploy-mode && 'packages.element.io' || format('linux-{0}-sqlcipher-{1}', inputs.arch, inputs.sqlcipher) }}
+                  name: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
                   path: |
                       dist
                       !dist/*-unpacked/**

.github/workflows/build_macos.yaml

@@ -23,28 +23,24 @@ on:
                 type: string
                 required: false
                 description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
-            deploy-mode:
-                type: boolean
-                required: false
-                description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
             base-url:
                 type: string
                 required: false
-                description: "The URL to which the output will be deployed, required if deploy-mode is enabled."
+                description: "The URL to which the output will be deployed."
 jobs:
     build:
-        runs-on: macos-latest
+        runs-on: macos-14 # M1
         environment: ${{ inputs.sign && 'packages.element.io' || '' }}
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/download-artifact@v3
+            - uses: actions/download-artifact@v4
               with:
                   name: webapp
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
                   key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
@@ -56,9 +52,16 @@ jobs:
                   rustup toolchain install stable --profile minimal --no-self-update
                   rustup default stable
                   rustup target add aarch64-apple-darwin
+                  rustup target add x86_64-apple-darwin
 
-            - uses: actions/setup-node@v3
+            # M1 macos-14 comes without Python preinstalled
+            - uses: actions/setup-python@v5
               with:
+                  python-version: "3.12"
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             # Does not need branch matching as only analyses this layer
@@ -67,21 +70,23 @@ jobs:
 
             - name: Build Natives
               if: steps.cache.outputs.cache-hit != 'true'
-              run: "yarn build:native:universal"
+              run: |
+                  # Python 3.12 drops distutils which keytar relies on
+                  pip3 install setuptools
+                  yarn build:native:universal
 
             - name: "[Nightly] Resolve version"
-              id: nightly
               if: inputs.version != ''
               run: |
-                  echo "config-args=--nightly '${{ inputs.version }}'" >> $GITHUB_OUTPUT
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
 
             # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
             - name: "[Signed] Build App"
               if: inputs.sign != ''
               run: |
-                  scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }} --notarytool-team-id='${{ secrets.APPLE_TEAM_ID }}'
-                  yarn build:universal --publish never --config electron-builder.json
+                  yarn build:universal --publish never
               env:
+                  ED_NOTARYTOOL_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
                   APPLE_ID: ${{ secrets.APPLE_ID }}
                   APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                   CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
@@ -90,27 +95,21 @@ jobs:
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
               run: |
-                  hdiutil attach dist/*.dmg
-                  codesign -dv --verbose=4 /Volumes/Element*/*.app
-                  spctl -a -vvv -t install /Volumes/Element*/*.app
-                  hdiutil detach /Volumes/Element*
+                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
+                  codesign -dv --verbose=4 /Volumes/Element/*.app
+                  spctl -a -vvv -t install /Volumes/Element/*.app
+                  hdiutil detach /Volumes/Element
 
             - name: "[Unsigned] Build App"
               if: inputs.sign == ''
               run: |
-                  scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }}
-                  yarn build:universal --publish never --config electron-builder.json
+                  yarn build:universal --publish never
               env:
                   CSC_IDENTITY_AUTO_DISCOVERY: false
 
-            - name: Prepare artifacts for deployment
-              if: inputs.deploy-mode
+            - name: Generate releases.json
+              if: inputs.base-url
               run: |
-                  mv dist _dist
-                  mkdir -p dist/install/macos dist/update/macos
-                  mv _dist/*-mac.zip dist/update/macos/
-                  mv _dist/*.dmg dist/install/macos/
-
                   PKG_JSON_VERSION=$(cat package.json | jq -r .version)
                   LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
                   # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
@@ -127,30 +126,18 @@ jobs:
                         },
                       }],
                     }
-                  ' > dist/update/macos/releases.json
+                  ' > dist/releases.json
                   jq -n --arg url "$URL" '
                     { url: $url }
-                  ' > dist/update/macos/releases-legacy.json
+                  ' > dist/releases-legacy.json
               env:
                   VERSION: ${{ inputs.version }}
 
-            # We don't wish to store the installer for every nightly ever, so we only keep the latest
-            - name: "[Nightly] Strip version from installer file"
-              if: inputs.deploy-mode && inputs.version != ''
-              run: |
-                  mv dist/install/macos/*.dmg "dist/install/macos/Element Nightly.dmg"
-
-            - name: "[Release] Prepare release latest symlink"
-              if: inputs.deploy-mode && inputs.version == ''
-              run: |
-                  ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
-              working-directory: "dist/install/macos"
-
-            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contain it
+            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
             - name: Upload Artifacts
-              uses: actions/upload-artifact@v3
+              uses: actions/upload-artifact@v4
               with:
-                  name: ${{ inputs.deploy-mode && 'packages.element.io' || 'macos' }}
+                  name: macos
                   path: |
                       dist
                       !dist/mac-universal/**

.github/workflows/build_prepare.yaml

@@ -15,6 +15,11 @@ on:
                 required: false
                 default: false
                 description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
+            deploy:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build should be deployed to production"
         secrets:
             # Required if `nightly` is set
             CF_R2_ACCESS_KEY_ID:
@@ -29,10 +34,13 @@ on:
             packages-dir:
                 description: "The directory non-deb packages for this run should live in within packages.element.io"
                 value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
-            # This is just a simple pass-through of the input to simplify reuse of complex inline conditions
+            # These are just simple pass-throughs of the input to simplify reuse of complex inline conditions
             config:
                 description: "The relative path to the config file for this run"
                 value: ${{ inputs.config }}
+            deploy:
+                description: "The relative path to the config file for this run"
+                value: ${{ inputs.deploy }}
 jobs:
     prepare:
         name: Prepare
@@ -41,10 +49,11 @@ jobs:
         outputs:
             nightly-version: ${{ steps.versions.outputs.nightly }}
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps
@@ -74,6 +83,7 @@ jobs:
 
                   # Pick the greatest one
                   VERSION=$(cat VERSIONS | sort -uf | tail -n1)
+                  echo "Found latest nightly version $VERSION"
                   # Increment it
                   echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
               env:
@@ -124,11 +134,11 @@ jobs:
                   echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
                   echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
                   echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
-                  echo "| Element Web | [$WEB_VERSION](https://github.com/vector-im/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
                   echo "| React SDK   | [$REACT_VERSION](https://github.com/matrix-org/matrix-react-sdk/commit/$REACT_VERSION) |" >> $GITHUB_STEP_SUMMARY
                   echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
 
-            - uses: actions/upload-artifact@v3
+            - uses: actions/upload-artifact@v4
               with:
                   name: webapp
                   retention-days: 1

.github/workflows/build_windows.yaml

@@ -1,6 +1,11 @@
 # This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
 # Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
 # the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+
+# window-latest by default uses the pwsh shell which breaks codeSigningCert in the workflow
+defaults:
+    run:
+        shell: powershell
 on:
     workflow_call:
         secrets:
@@ -14,7 +19,7 @@ on:
             arch:
                 type: string
                 required: true
-                description: "The architecture to build for, one of 'x64' | 'x86' | 'arm64'"
+                description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
             version:
                 type: string
                 required: false
@@ -23,10 +28,6 @@ on:
                 type: string
                 required: false
                 description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
-            deploy-mode:
-                type: boolean
-                required: false
-                description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
 jobs:
     build:
         runs-on: windows-latest
@@ -34,7 +35,7 @@ jobs:
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe"
         steps:
-            - uses: kanga333/variable-mapper@3681b75f5c6c00162721168fb91ab74925eaebcb
+            - uses: nbucic/variable-mapper@0673f6891a0619ba7c002ecfed0f9f4f39017b6f
               id: config
               with:
                   key: "${{ inputs.arch }}"
@@ -42,38 +43,36 @@ jobs:
                   map: |
                       {
                         "x64": {
-                          "target": "x86_64-pc-windows-msvc",
-                          "dir": "x64"
+                          "target": "x86_64-pc-windows-msvc"
                         },
                         "arm64": {
                           "target": "aarch64-pc-windows-msvc",
                           "build-args": "--arm64",
-                          "arch": "amd64_arm64",
-                          "dir": "arm64"
+                          "arch": "amd64_arm64"
                         },
-                        "x86": {
+                        "ia32": {
                           "target": "i686-pc-windows-msvc",
                           "build-args": "--ia32",
-                          "dir": "ia32"
+                          "arch": "x86"
                         }
                       }
 
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/download-artifact@v3
+            - uses: actions/download-artifact@v4
               with:
                   name: webapp
 
             - name: Cache .hak
               id: cache
-              uses: actions/cache@v3
+              uses: actions/cache@v4
               with:
                   key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
                   path: |
                       ./.hak
 
             - name: Set up build tools
-              uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
               with:
                   arch: ${{ steps.config.outputs.arch || inputs.arch }}
 
@@ -100,8 +99,9 @@ jobs:
                   rustup default stable
                   rustup target add ${{ steps.config.outputs.target }}
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             # Does not need branch matching as only analyses this layer
@@ -115,13 +115,14 @@ jobs:
                   yarn build:native --target ${{ steps.config.outputs.target }}
 
             - name: Install and configure eSigner CKA
-              id: esigner
               if: inputs.sign
               run: |
                   Set-StrictMode -Version 'Latest'
 
-                  # Download
-                  Invoke-WebRequest -OutFile eSigner_CKA.exe "https://packages.element.io/tools/SSL.COM%20eSigner%20CKA_1.0.4-build-20230221_signed.exe"
+                  # Download, extract, and rename
+                  Invoke-WebRequest -OutFile eSigner_CKA.zip "$env:ESIGNER_URL"
+                  Expand-Archive -Path eSigner_CKA.zip -DestinationPath .
+                  Get-ChildItem -Path * -Include "*_build_*.exe" | Rename-Item -NewName eSigner_CKA.exe
 
                   # Install
                   New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
@@ -144,61 +145,37 @@ jobs:
                   # Extract thumbprint and subject name
                   $Thumbprint = $CodeSigningCert.Thumbprint
                   $SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
-                  echo "config-args=--signtool-thumbprint '$Thumbprint' --signtool-subject-name '$SubjectName'" >> $env:GITHUB_OUTPUT
+
+                  echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
+                  echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
               env:
+                  ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
                   INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                   MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
 
             - name: "[Nightly] Resolve version"
-              id: nightly
               if: inputs.version != ''
               shell: bash
               run: |
-                  echo "config-args=--nightly '${{ inputs.version }}'" >> $GITHUB_OUTPUT
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+
+            # XXX: For whatever reason if we use `yarn build ...` it freezes, but splitting it into parts it is fine
+            - run: yarn run build:ts
+            - run: yarn run build:res
 
             - name: Build App
               run: |
-                  yarn ts-node scripts/generate-builder-config.ts ${{ steps.nightly.outputs.config-args }} ${{ steps.esigner.outputs.config-args }}
-                  yarn build --publish never -w --config electron-builder.json ${{ steps.config.outputs.build-args }}
+                  yarn electron-builder --publish never -w ${{ steps.config.outputs.build-args }}
 
             - name: Check app was signed successfully
               if: inputs.sign != ''
               run: |
                   . "$env:SIGNTOOL_PATH" verify /pa (get-item ./dist/squirrel-windows*/*.exe)
 
-            - name: Prepare artifacts for deployment
-              if: inputs.deploy-mode
-              shell: bash
-              run: |
-                  mv dist _dist
-                  mkdir -p "dist/install/win32/$DIR/msi" "dist/update/win32/$DIR"
-                  mv _dist/squirrel-windows*/*.exe "dist/install/win32/$DIR"
-                  mv _dist/squirrel-windows*/*.nupkg "dist/update/win32/$DIR/"
-                  mv _dist/squirrel-windows*/RELEASES "dist/update/win32/$DIR/"
-                  # mv _dist/*.msi "dist/install/win32/$DIR/msi/"
-              env:
-                  DIR: ${{ steps.config.outputs.dir }}
-
-            # We don't wish to store the installer for every nightly ever, so we only keep the latest
-            - name: "[Nightly] Strip version from installer file"
-              if: inputs.deploy-mode && inputs.version != ''
-              shell: bash
-              run: |
-                  mv dist/install/win32/$DIR/*.exe "dist/install/win32/$DIR/Element Nightly Setup.exe"
-                  # mv dist/install/win32/$DIR/msi/*.msi "dist/install/win32/$DIR/msi/Element Nightly Setup.msi"
-              env:
-                  DIR: ${{ steps.config.outputs.dir }}
-
-            - name: "[Release] Prepare release latest symlink"
-              if: inputs.deploy-mode && inputs.version == ''
-              shell: bash
-              run: |
-                  ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
-              working-directory: "dist/install/win32/${{ steps.config.outputs.dir }}"
-
             - name: Upload Artifacts
-              uses: actions/upload-artifact@v3
+              uses: actions/upload-artifact@v4
               with:
-                  name: ${{ inputs.deploy-mode && 'packages.element.io' || format('win-{0}', inputs.arch) }}
-                  path: dist
+                  name: win-${{ inputs.arch }}
+                  path: |
+                      dist
                   retention-days: 1

.github/workflows/dockerbuild.yaml

@@ -2,7 +2,7 @@ name: Dockerbuild
 on:
     workflow_dispatch: {}
     push:
-        branches: [master, develop]
+        branches: [master, staging, develop]
         paths:
             - "dockerbuild/**"
 concurrency: ${{ github.workflow }}-${{ github.ref_name }}
@@ -17,10 +17,18 @@ jobs:
             contents: read
             packages: write
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@aa33708b10e362ff993539393ff100fa93ed6a27 # v3
+              with:
+                  install: true
 
             - name: Log in to the Container registry
-              uses: docker/login-action@b4bedf8053341df3b5a9f9e0f2cf4e79e27360c6
+              uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
               with:
                   registry: ${{ env.REGISTRY }}
                   username: ${{ github.actor }}
@@ -28,16 +36,17 @@ jobs:
 
             - name: Extract metadata for Docker
               id: meta
-              uses: docker/metadata-action@879dcbb708d40f8b8679d4f7941b938a086e23a7
+              uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
               with:
                   images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
                   tags: |
                       type=ref,event=branch
 
             - name: Build and push Docker image
-              uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
+              uses: docker/build-push-action@5176d81f87c23d6fc96624dfdbcd9f3830bbe445 # v6
               with:
                   context: dockerbuild
                   push: true
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}
+                  platforms: linux/amd64,linux/arm64

.github/workflows/localazy_download.yaml

@@ -1,6 +1,8 @@
 name: Localazy Download
 on:
     workflow_dispatch: {}
+    schedule:
+        - cron: "0 6 * * 1,3,5" # Every Monday, Wednesday and Friday at 6am UTC
 jobs:
     download:
         uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main

.github/workflows/release-drafter.yml

@@ -0,0 +1,11 @@
+name: Release Drafter
+on:
+    push:
+        branches: [staging]
+    workflow_dispatch: {}
+concurrency: ${{ github.workflow }}
+jobs:
+    draft:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        with:
+            include-changes: element-hq/element-web~$VERSION

.github/workflows/release-gitflow.yml

@@ -0,0 +1,11 @@
+# Gitflow merge-back master->develop
+name: Merge master -> develop
+on:
+    push:
+        branches: [master]
+concurrency: ${{ github.repository }}-${{ github.workflow }}
+jobs:
+    merge:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+name: Release Process
+on:
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of release
+                required: true
+                default: rc
+                type: choice
+                options:
+                    - rc
+                    - final
+concurrency: ${{ github.workflow }}
+jobs:
+    release:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+            GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        with:
+            final: ${{ inputs.mode == 'final' }}
+            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
+            expected-asset-count: 1
+
+    check:
+        name: Post release checks
+        needs: release
+        runs-on: ubuntu-latest
+        steps:
+            - name: Wait for desktop packaging
+              uses: t3chguy/wait-on-check-action@18541021811b56544d90e0f073401c2b99e249d6 # fork
+              with:
+                  ref: master
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  wait-interval: 10
+                  check-name: Deploy
+                  allowed-conclusions: success

.github/workflows/reprepro.yaml

@@ -1,49 +0,0 @@
-on:
-    workflow_call:
-        inputs:
-            artifact-name:
-                type: string
-                required: true
-                description: "The name of the artifact containing the deb to include"
-        secrets:
-            ELEMENT_BOT_TOKEN:
-                required: true
-            CF_R2_ACCESS_KEY_ID:
-                required: true
-            CF_R2_TOKEN:
-                required: true
-# Protect reprepro database using concurrency
-concurrency: reprepro
-jobs:
-    reprepro:
-        name: Deploy debian package
-        environment: packages.element.io
-        runs-on: ubuntu-latest
-        env:
-            R2_INCOMING_BUCKET: ${{ vars.R2_INCOMING_BUCKET }}
-            R2_URL: ${{ vars.CF_R2_S3_API }}
-        steps:
-            - name: Download artifact
-              uses: actions/download-artifact@v3
-              with:
-                  name: ${{ inputs.artifact-name }}
-                  path: dist
-
-            - name: Upload incoming deb
-              id: upload
-              run: |
-                  deb="$(ls *.deb | tail -n1)"
-                  echo "incoming=$deb" >> $GITHUB_OUTPUT
-                  aws s3 cp "$deb" "s3://$R2_INCOMING_BUCKET" --endpoint-url "$R2_URL" --region auto
-              working-directory: dist
-              env:
-                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
-                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
-
-            - name: Notify packages.element.io of incoming deb
-              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
-              with:
-                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
-                  repository: vector-im/packages.element.io
-                  event-type: reprepro-incoming
-                  client-payload: '{"incoming": "${{ steps.upload.outputs.incoming }}"}'

.github/workflows/static_analysis.yaml

@@ -8,10 +8,11 @@ jobs:
         name: "Typescript Syntax Check"
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             # Does not need branch matching as only analyses this layer
@@ -24,15 +25,18 @@ jobs:
     i18n_lint:
         name: "i18n Check"
         uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        with:
+            hardcoded-words: "Element"
 
     js_lint:
         name: "ESLint"
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
+                  node-version-file: package.json
                   cache: "yarn"
 
             # Does not need branch matching as only analyses this layer
@@ -41,3 +45,38 @@ jobs:
 
             - name: Run Linter
               run: "yarn run lint:js"
+
+    workflow_lint:
+        name: "Workflow Lint"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn lint:workflows"
+
+    analyse_dead_code:
+        name: "Analyse Dead Code"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run linter
+              run: "yarn run lint:knip"

.github/workflows/sync-labels.yml

@@ -0,0 +1,21 @@
+name: Sync labels
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 2 * * *" # 2am every day
+    push:
+        branches:
+            - develop
+        paths:
+            - .github/labels.yml
+jobs:
+    sync-labels:
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        with:
+            LABELS: |
+                element-hq/element-web
+                .github/labels.yml
+            DELETE: true
+            WET: true
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-incoming.yml

@@ -0,0 +1,14 @@
+name: Move new issues into Issue triage board
+
+on:
+    issues:
+        types: [opened]
+
+jobs:
+    automate-project-columns-next:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/add-to-project@main
+              with:
+                  project-url: https://github.com/orgs/element-hq/projects/120
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-labelled.yml

@@ -0,0 +1,10 @@
+name: Move labelled issues to correct projects
+
+on:
+    issues:
+        types: [labeled]
+
+jobs:
+    call-triage-labelled:
+        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop
+        secrets: inherit

.prettierignore

@@ -8,6 +8,8 @@
 /CHANGELOG.md
 /package-lock.json
 /yarn.lock
+/playwright/html-report
+/playwright/test-results
 
 **/.idea
 .vscode

build/entitlements.mac.plist

@@ -9,11 +9,11 @@
          Latest electron-builder does, but it appears to be causing issues:
          (https://github.com/electron-userland/electron-builder/issues/4390)
     -->
+
     <!-- https://github.com/electron/electron-notarize#prerequisites -->
     <key>com.apple.security.cs.allow-jit</key>
     <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
+
     <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>

dockerbuild/Dockerfile

@@ -1,49 +1,27 @@
-# Docker image to facilitate building Element Desktop with native bits using a glibc version with broader compatibility
-FROM buildpack-deps:bionic-curl
+# Docker image to facilitate building Element Desktop's native bits using a glibc version with broader compatibility
+FROM rust:buster
 
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN curl --proto "=https" -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
-RUN apt-get -qq update && apt-get -qq dist-upgrade && \
-  # add repo for git-lfs
-  curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \
-  # git ssh for using as docker image on CircleCI
-  # python for node-gyp
-  # rpm is required for FPM to build rpm package
+RUN apt-get -qq update && apt-get -y -qq dist-upgrade && \
+  apt-get -y -qq install --no-install-recommends \
   # tclsh is required for building SQLite as part of SQLCipher
-  # libsecret-1-dev and libgnome-keyring-dev are required even for prebuild keytar
-  apt-get -qq install --no-install-recommends qtbase5-dev bsdtar build-essential autoconf libssl-dev gcc-multilib g++-multilib lzip rpm python libcurl4 git git-lfs ssh unzip tcl \
-  libsecret-1-dev libgnome-keyring-dev \
-  libopenjp2-tools \
-  # Used by github actions \
-  jq grep file \
+  tcl \
+  # libsecret-1-dev is required even for prebuild keytar
+  libsecret-1-dev \
   # Used by seshat (when not SQLCIPHER_STATIC) \
   libsqlcipher-dev && \
-  # git-lfs
-  git lfs install && \
   apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /project
-
-# fix error /usr/local/bundle/gems/fpm-1.5.0/lib/fpm/package/freebsd.rb:72:in `encode': "\xE2" from ASCII-8BIT to UTF-8 (Encoding::UndefinedConversionError)
-# http://jaredmarkell.com/docker-and-locales/
-# http://askubuntu.com/a/601498
-ENV LANG C.UTF-8
-ENV LANGUAGE C.UTF-8
-ENV LC_ALL C.UTF-8
+RUN ln -s /usr/bin/python3 /usr/bin/python & ln -s /usr/bin/pip3 /usr/bin/pip
 
 ENV DEBUG_COLORS true
 ENV FORCE_COLOR true
-ENV NODE_VERSION 16.18.1
 
-# this package is used for snapcraft and we should not clear apt list - to avoid apt-get update during snap build
-RUN curl --proto "=https" -L https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz | tar xz -C /usr/local --strip-components=1 && \
-  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md && \
-  # https://github.com/npm/npm/issues/4531
-  npm config set unsafe-perm true
+WORKDIR /project
 
-ENV RUSTUP_HOME=/usr/local/rustup \
-    CARGO_HOME=/usr/local/cargo \
-    PATH=/usr/local/cargo/bin:$PATH
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal
+ENV NODE_VERSION 20.15.1
+ARG TARGETOS
+ARG TARGETARCH
+COPY setup.sh /setup.sh
+RUN /setup.sh

dockerbuild/aarch64/.cargo/config.toml

@@ -1,3 +0,0 @@
-[target.aarch64-unknown-linux-gnu]
-linker = "aarch64-linux-gnu-gcc"
-rustflags = ["-L/usr/lib/aarch64-linux-gnu"]

dockerbuild/aarch64/.env

@@ -1,11 +0,0 @@
-AS=/usr/bin/aarch64-linux-gnu-as
-STRIP=/usr/bin/aarch64-linux-gnu-strip
-AR=/usr/bin/aarch64-linux-gnu-ar
-CC=/usr/bin/aarch64-linux-gnu-gcc
-CPP=/usr/bin/aarch64-linux-gnu-cpp
-CXX=/usr/bin/aarch64-linux-gnu-g++
-LD=/usr/bin/aarch64-linux-gnu-ld
-FC=/usr/bin/aarch64-linux-gnu-gfortran
-PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig
-CFLAGS=-L/usr/lib/aarch64-linux-gnu
-RUSTFLAGS=-L/usr/lib/aarch64-linux-gnu

dockerbuild/setup.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -x
+declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
+ARCH="${archMap["$TARGETARCH"]}"
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+  unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md

docs/SUMMARY.md

@@ -10,6 +10,7 @@
 # Distribution
 
 -   [Updates](updates.md)
+-   [Packaging](packaging.md)
 
 # Setup
 

docs/packaging.md

@@ -0,0 +1,55 @@
+## Packaging nightlies
+
+Element Desktop nightly builds are build automatically by the [Github Actions workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_and_deploy.yaml).
+The schedule is currently set for once a day at 9am UTC. It will deploy to packages.element.io upon completion.
+
+## Triggering a manual nightly build
+
+Simply go to https://github.com/vector-im/element-desktop/actions/workflows/build_and_deploy.yaml
+
+1. Click `Run workflow`
+1. Feel free to make changes to the checkboxes depending on the circumstances
+1. Click the green `Run workflow`
+
+## Packaging releases
+
+**Don't do this for RCs! We don't build Element Desktop for RCs.**
+
+For releasing Element Desktop, we assume the following prerequisites:
+
+-   a tag of `element-desktop` repo with the Element Desktop version to be released set in `package.json`.
+-   an Element Web tarball published to GitHub with a matching version number.
+
+**Both of these are done automatically when you run the release automation.**
+
+The packaging is kicked off automagically for you when a Github Release for Element Desktop is published.
+
+### More detail on the github actions
+
+We moved to Github Actions for the following reasons:
+
+1. Removing single point of failure
+2. Improving reliability
+3. Unblocking the packaging on a single individual
+4. Improving parallelism
+
+The Windows builds are signed by SSL.com using their Cloud Key Adapter for eSigner.
+This allows us to use Microsoft's signtool to interface with eSigner and send them a hash of the exe along with
+credentials in exchange for a signed certificate which we attach onto all the relevant files.
+
+The Apple builds are signed using standard code signing means and then notarised to appease GateKeeper.
+
+The Linux builds are distributed via a signed reprepro repository.
+
+The packages.element.io site is a public Cloudflare R2 bucket which is deployed to solely from Github Actions.
+The main bucket in R2 is `packages-element-io` which is a direct mapping of packages.element.io,
+we have a workflow which generates the index.html files there to imitate a public index which Cloudflare does not currently support.
+The reprepro database lives in `packages-element-io-db`.
+There is an additional pair of buckets of same name but appended with `-test` which can be used for testing,
+these land on https://packages-element-io-test.element.io/.
+
+### Debian/Ubuntu Distributions
+
+We used to add a new distribution to match each Debian and Ubuntu release. As of April 2020, we have created a `default` distribution that everyone can use (since the packages have never differed by distribution anyway).
+
+The distribution configuration lives in https://github.com/vector-im/packages.element.io/blob/master/debian/conf/distributions as a canonical source.

docs/windows-requirements.md

@@ -1,6 +1,5 @@
 # Windows
 
-
 ## Requirements to build native modules
 
 We rely on Github Actions `windows-latest` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).

electron-builder.ts

@@ -0,0 +1,234 @@
+import * as os from "os";
+import * as fs from "fs";
+import * as path from "path";
+import { Arch, Configuration as BaseConfiguration, AfterPackContext } from "electron-builder";
+import { flipFuses, FuseVersion, FuseV1Options } from "@electron/fuses";
+
+/**
+ * This script has different outputs depending on your os platform.
+ *
+ * On Windows:
+ *  Prefixes the nightly version with `0.0.1-nightly.` as it breaks if it is not semver
+ *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
+ *      build.win.signingHashAlgorithms and build.win.certificateSubjectName respectively if specified.
+ *
+ * On macOS:
+ *   Passes $ED_NOTARYTOOL_TEAM_ID to build.mac.notarize.notarize if specified
+ *
+ * On Linux:
+ *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
+ *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
+ *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
+ */
+
+const NIGHTLY_APP_ID = "im.riot.nightly";
+const NIGHTLY_DEB_NAME = "element-nightly";
+
+interface Pkg {
+    name: string;
+    productName: string;
+    description: string;
+    version: string;
+}
+
+type Writable<T> = NonNullable<
+    T extends Function ? T : T extends object ? { -readonly [K in keyof T]: Writable<T[K]> } : T
+>;
+
+const pkg: Pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+
+interface Configuration extends BaseConfiguration {
+    extraMetadata: Partial<Pick<Pkg, "version">> & Omit<Pkg, "version">;
+    linux: BaseConfiguration["linux"];
+    win: BaseConfiguration["win"];
+    mac: BaseConfiguration["mac"];
+    deb: {
+        fpm: string[];
+    } & BaseConfiguration["deb"];
+}
+
+/**
+ * @type {import('electron-builder').Configuration}
+ * @see https://www.electron.build/configuration/configuration
+ */
+const config: Writable<Configuration> = {
+    appId: "im.riot.app",
+    asarUnpack: "**/*.node",
+    afterPack: async (context: AfterPackContext) => {
+        if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal) {
+            // Burn in electron fuses for proactive security hardening.
+            // On macOS, we only do this for the universal package, as the constituent arm64 and amd64 packages are embedded within.
+            const ext = (<Record<string, string>>{
+                darwin: ".app",
+                win32: ".exe",
+                linux: "",
+            })[context.electronPlatformName];
+
+            let executableName = context.packager.appInfo.productFilename;
+            if (context.electronPlatformName === "linux") {
+                // Linux uses the package name as the executable name
+                executableName = context.packager.appInfo.name;
+            }
+
+            const electronBinaryPath = path.join(context.appOutDir, `${executableName}${ext}`);
+            console.log(`Flipping fuses for: ${electronBinaryPath}`);
+
+            await flipFuses(electronBinaryPath, {
+                version: FuseVersion.V1,
+                resetAdHocDarwinSignature: context.electronPlatformName === "darwin" && context.arch === Arch.universal,
+
+                [FuseV1Options.EnableCookieEncryption]: true,
+                [FuseV1Options.OnlyLoadAppFromAsar]: true,
+
+                [FuseV1Options.RunAsNode]: false,
+                [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+                [FuseV1Options.EnableNodeCliInspectArguments]: false,
+
+                // Mac app crashes on arm for us when `LoadBrowserProcessSpecificV8Snapshot` is enabled
+                [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
+                // https://github.com/electron/fuses/issues/7
+                [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
+            });
+        }
+    },
+    files: [
+        "package.json",
+        {
+            from: ".hak/hakModules",
+            to: "node_modules",
+        },
+        "lib/**",
+    ],
+    extraResources: [
+        {
+            from: "res/img",
+            to: "img",
+        },
+        "webapp.asar",
+    ],
+    extraMetadata: {
+        name: pkg.name,
+        productName: pkg.productName,
+        description: pkg.description,
+    },
+    linux: {
+        target: ["tar.gz", "deb"],
+        category: "Network;InstantMessaging;Chat",
+        maintainer: "support@element.io",
+        icon: "build/icons",
+    },
+    deb: {
+        packageCategory: "net",
+        depends: [
+            "libgtk-3-0",
+            "libnotify4",
+            "libnss3",
+            "libxss1",
+            "libxtst6",
+            "xdg-utils",
+            "libatspi2.0-0",
+            "libuuid1",
+            "libsecret-1-0",
+            "libasound2",
+            "libgbm1",
+        ],
+        recommends: ["libsqlcipher0", "element-io-archive-keyring"],
+        fpm: [
+            "--deb-field",
+            "Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+            "--deb-field",
+            "Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+        ],
+    },
+    mac: {
+        category: "public.app-category.social-networking",
+        darkModeSupport: true,
+        hardenedRuntime: true,
+        gatekeeperAssess: true,
+        entitlements: "./build/entitlements.mac.plist",
+        icon: "build/icons/icon.icns",
+    },
+    win: {
+        target: ["squirrel", "msi"],
+        signingHashAlgorithms: ["sha256"],
+        icon: "build/icons/icon.ico",
+    },
+    msi: {
+        perMachine: true,
+    },
+    directories: {
+        output: "dist",
+    },
+    protocols: [
+        {
+            name: "element",
+            schemes: ["io.element.desktop", "element"],
+        },
+    ],
+};
+
+/**
+ * Allow specifying windows signing cert via env vars
+ * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
+ * @param {string} process.env.ED_SIGNTOOL_THUMBPRINT
+ */
+if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT) {
+    config.win.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
+    config.win.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+}
+
+/**
+ * Allow specifying macOS notary team id via env var
+ * @param {string} process.env.ED_NOTARYTOOL_TEAM_ID
+ */
+if (process.env.ED_NOTARYTOOL_TEAM_ID) {
+    config.mac.notarize = {
+        teamId: process.env.ED_NOTARYTOOL_TEAM_ID,
+    };
+}
+
+/**
+ * Allow specifying nightly version via env var
+ * @param {string} process.env.ED_NIGHTLY
+ */
+if (process.env.ED_NIGHTLY) {
+    config.deb.fpm = []; // Clear the fpm as the breaks deb fields don't apply to nightly
+
+    config.appId = NIGHTLY_APP_ID;
+    config.extraMetadata.productName += " Nightly";
+    config.extraMetadata.name += "-nightly";
+    config.extraMetadata.description += " (nightly unstable build)";
+    config.deb.fpm.push("--name", NIGHTLY_DEB_NAME);
+
+    let version = process.env.ED_NIGHTLY;
+    if (os.platform() === "win32") {
+        // The windows packager relies on parsing this as semver, so we have to make it look like one.
+        // This will give our update packages really stupid names, but we probably can't change that either
+        // because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+        // We just give the installer a static name, so you'll just see this in the 'about' dialog.
+        // Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+        version = "0.0.1-nightly." + version;
+    }
+    config.extraMetadata.version = version;
+}
+
+if (os.platform() === "linux") {
+    // Electron crashes on debian if there's a space in the path.
+    // https://github.com/vector-im/element-web/issues/13171
+    config.extraMetadata.productName = config.extraMetadata.productName.replace(/ /g, "-");
+
+    /**
+     * Allow specifying deb changelog via env var
+     * @param {string} process.env.ED_DEB_CHANGELOG
+     */
+    if (process.env.ED_DEBIAN_CHANGELOG) {
+        config.deb.fpm.push(`--deb-changelog=${process.env.ED_DEBIAN_CHANGELOG}`);
+    }
+
+    if (process.env.SQLCIPHER_BUNDLED) {
+        // Remove sqlcipher dependency when using bundled
+        config.deb.recommends = config.deb.recommends?.filter((d) => d !== "libsqlcipher0");
+    }
+}
+
+export default config;

element.io/nightly/config.json

@@ -23,7 +23,7 @@
     "uisi_autorageshake_app": "element-auto-uisi",
     "show_labs_settings": true,
     "room_directory": {
-        "servers": ["matrix.org", "gitter.im", "libera.chat"]
+        "servers": ["matrix.org", "gitter.im"]
     },
     "enable_presence_by_hs_url": {
         "https://matrix.org": false,
@@ -49,8 +49,14 @@
     },
     "privacy_policy_url": "https://element.io/cookie-policy",
     "features": {
+        "threadsActivityCentre": true,
         "feature_spotlight": true,
-        "feature_video_rooms": true
+        "feature_video_rooms": true,
+        "feature_element_call_video_rooms": true,
+        "feature_new_room_decoration_ui": true
+    },
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 100
     },
     "element_call": {
         "url": "https://call.element.dev"

element.io/release/config.json

@@ -22,7 +22,7 @@
     "bug_report_endpoint_url": "https://element.io/bugreports/submit",
     "uisi_autorageshake_app": "element-auto-uisi",
     "room_directory": {
-        "servers": ["matrix.org", "gitter.im", "libera.chat"]
+        "servers": ["matrix.org", "gitter.im"]
     },
     "show_labs_settings": false,
     "enable_presence_by_hs_url": {
@@ -44,5 +44,8 @@
         "api_host": "https://posthog.element.io"
     },
     "privacy_policy_url": "https://element.io/cookie-policy",
-    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
+    "setting_defaults": {
+        "RustCrypto.staged_rollout_percent": 60
+    }
 }

hak/keytar/build.ts

@@ -32,6 +32,9 @@ export default async function buildKeytar(hakEnv: HakEnv, moduleInfo: Dependency
                 cwd: moduleInfo.moduleBuildDir,
                 env,
                 stdio: "inherit",
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: hakEnv.isWin(),
             },
         );
         proc.on("exit", (code) => {

hak/matrix-seshat/build.ts

@@ -28,16 +28,12 @@ export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Prom
 
     console.log("Running yarn install");
     await new Promise<void>((resolve, reject) => {
-        const proc = childProcess.spawn(
-            "yarn" + (hakEnv.isWin() ? ".cmd" : ""),
-            ["install"],
-            {
-                cwd: moduleInfo.moduleBuildDir,
-                env,
-                shell: true,
-                stdio: "inherit",
-            },
-        );
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["install"], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();
         });
@@ -47,16 +43,12 @@ export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Prom
 
     console.log("Running yarn build");
     await new Promise<void>((resolve, reject) => {
-        const proc = childProcess.spawn(
-            "yarn" + (hakEnv.isWin() ? ".cmd" : ""),
-            ["run", buildTarget],
-            {
-                cwd: moduleInfo.moduleBuildDir,
-                env,
-                shell: true,
-                stdio: "inherit",
-            },
-        );
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["run", buildTarget], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();
         });

hak/tsconfig.json

@@ -2,10 +2,10 @@
     "compilerOptions": {
         "moduleResolution": "node",
         "esModuleInterop": true,
-        "target": "es2016",
+        "target": "es2022",
         "sourceMap": false,
         "strict": true,
-        "lib": ["es2020"]
+        "lib": ["es2022"]
     },
     "include": ["../scripts/@types/*.d.ts", "./**/*.ts"],
     "ts-node": {

knip.ts

@@ -0,0 +1,17 @@
+import { KnipConfig } from "knip";
+
+export default {
+    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.ts", ".eslintrc-*.js", "scripts/**", "hak/**"],
+    project: ["**/*.{js,ts}"],
+    ignoreDependencies: [
+        // Brought in via hak scripts
+        "keytar",
+        "matrix-seshat",
+        // Needed by `electron-builder`
+        "electron-builder-squirrel-windows",
+        "@types/yargs",
+        // Required for `action-validator`
+        "@action-validator/*",
+    ],
+    ignoreBinaries: ["jq", "scripts/in-docker.sh"],
+} satisfies KnipConfig;

package.json

@@ -2,7 +2,7 @@
     "name": "element-desktop",
     "productName": "Element",
     "main": "lib/electron-main.js",
-    "version": "1.11.48",
+    "version": "1.11.76",
     "description": "A feature-rich client for Matrix.org",
     "author": "Element",
     "homepage": "https://element.io",
@@ -13,33 +13,35 @@
     "license": "Apache-2.0",
     "files": [],
     "engines": {
-        "node": ">=16.0.0"
+        "node": ">=18.0.0"
     },
     "scripts": {
         "i18n": "matrix-gen-i18n && yarn i18n:sort && yarn i18n:lint",
         "i18n:sort": "jq --sort-keys '.' src/i18n/strings/en_EN.json > src/i18n/strings/en_EN.json.tmp && mv src/i18n/strings/en_EN.json.tmp src/i18n/strings/en_EN.json",
-        "i18n:lint": "prettier --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:lint": "prettier --log-level=silent  --write src/i18n/strings/ --ignore-path /dev/null",
         "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && yarn i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
         "mkdirs": "mkdirp packages deploys",
         "fetch": "yarn run mkdirs && ts-node scripts/fetch-package.ts",
         "asar-webapp": "asar p webapp webapp.asar",
         "start": "yarn run build:ts && yarn run build:res && electron .",
-        "lint": "yarn lint:types && yarn lint:js",
-        "lint:js": "yarn lint:js:src && yarn lint:js:test && yarn lint:js:scripts && yarn lint:js:hak",
+        "lint": "yarn lint:types && yarn lint:js && yarn lint:workflows",
+        "lint:js": "yarn lint:js:src && yarn lint:js:test && yarn lint:js:scripts && yarn lint:js:hak && prettier --check .",
         "lint:js:src": "eslint --max-warnings 0 src",
-        "lint:js:test": "eslint --max-warnings 0 --config .eslintrc-test.js test",
+        "lint:js:test": "eslint --max-warnings 0 --config .eslintrc-test.js playwright",
         "lint:js:scripts": "eslint --max-warnings 0 --config .eslintrc-scripts.js scripts",
         "lint:js:hak": "eslint --max-warnings 0 --config .eslintrc-hak.js hak",
-        "lint:js-fix": "yarn lint:js-fix:src &&yarn lint:js-fix:test && yarn lint:js-fix:scripts && yarn lint:js-fix:hak",
+        "lint:js-fix": "yarn lint:js-fix:src &&yarn lint:js-fix:test && yarn lint:js-fix:scripts && yarn lint:js-fix:hak && prettier --log-level=warn --write .",
         "lint:js-fix:src": "eslint --fix --max-warnings 0 src",
-        "lint:js-fix:test": "eslint --fix --max-warnings 0 --config .eslintrc-test.js test",
+        "lint:js-fix:test": "eslint --fix --max-warnings 0 --config .eslintrc-test.js playwright",
         "lint:js-fix:scripts": "eslint --fix --max-warnings 0 --config .eslintrc-scripts.js scripts",
         "lint:js-fix:hak": "eslint --fix --max-warnings 0 --config .eslintrc-hak.js hak",
         "lint:types": "yarn lint:types:src && yarn lint:types:test && yarn lint:types:scripts && yarn lint:types:hak",
         "lint:types:src": "tsc --noEmit",
-        "lint:types:test": "tsc --noEmit -p test/tsconfig.json",
+        "lint:types:test": "tsc --noEmit -p playwright/tsconfig.json",
         "lint:types:scripts": "tsc --noEmit -p scripts/tsconfig.json",
         "lint:types:hak": "tsc --noEmit -p hak/tsconfig.json",
+        "lint:workflows": "find .github/workflows -type f \\( -iname '*.yaml' -o -iname '*.yml' \\) | xargs -I {} sh -c 'echo \"Linting {}\"; action-validator \"{}\"'",
+        "lint:knip": "knip",
         "build:native": "yarn run hak",
         "build:native:universal": "yarn run hak --target x86_64-apple-darwin fetchandbuild && yarn run hak --target aarch64-apple-darwin fetchandbuild && yarn run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
         "build:32": "yarn run build:ts && yarn run build:res && electron-builder --ia32",
@@ -48,16 +50,19 @@
         "build": "yarn run build:ts && yarn run build:res && electron-builder",
         "build:ts": "tsc",
         "build:res": "ts-node scripts/copy-res.ts",
-        "docker:setup": "docker build -t element-desktop-dockerbuild dockerbuild",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild dockerbuild",
         "docker:build:native": "scripts/in-docker.sh yarn run hak",
         "docker:build": "scripts/in-docker.sh yarn run build",
         "docker:install": "scripts/in-docker.sh yarn install",
         "clean": "rimraf webapp.asar dist packages deploys lib",
         "hak": "ts-node scripts/hak/index.ts",
-        "test": "jest"
+        "test": "playwright test",
+        "test:open": "yarn test --ui",
+        "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
+        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright"
     },
     "dependencies": {
-        "@sentry/electron": "^4.3.0",
+        "@sentry/electron": "^5.0.0",
         "auto-launch": "^5.0.5",
         "counterpart": "^0.18.6",
         "electron-clear-data": "^1.0.5",
@@ -66,148 +71,58 @@
         "minimist": "^1.2.6",
         "node-fetch": "^2",
         "png-to-ico": "^2.1.1",
-        "uuid": "^9.0.0"
+        "uuid": "^10.0.0"
     },
     "devDependencies": {
+        "@action-validator/cli": "^0.6.0",
+        "@action-validator/core": "^0.6.0",
         "@babel/core": "^7.18.10",
         "@babel/preset-env": "^7.18.10",
         "@babel/preset-typescript": "^7.18.6",
         "@electron/asar": "^3.2.3",
-        "@electron/notarize": "^2.0.0",
+        "@electron/fuses": "^1.7.0",
+        "@mapbox/node-pre-gyp": "^1.0.11",
+        "@playwright/test": "1.45.3",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
-        "@types/detect-libc": "^1.0.0",
-        "@types/jest": "^29.0.0",
         "@types/minimist": "^1.2.1",
-        "@types/mkdirp": "^1.0.2",
-        "@types/node": "16.18.52",
+        "@types/node": "18.19.41",
         "@types/pacote": "^11.1.1",
         "@types/tar": "^6.1.3",
-        "@types/uuid": "^9.0.2",
-        "@typescript-eslint/eslint-plugin": "^5.42.0",
-        "@typescript-eslint/parser": "^5.42.0",
-        "allchange": "^1.0.6",
-        "app-builder-lib": "24.7.0",
-        "babel-jest": "^29.0.0",
+        "@types/uuid": "^10.0.0",
+        "@types/yargs": "^17.0.32",
+        "@typescript-eslint/eslint-plugin": "^7.0.0",
+        "@typescript-eslint/parser": "^7.0.0",
+        "app-builder-lib": "24.13.3",
         "chokidar": "^3.5.2",
-        "detect-libc": "^1.0.3",
-        "electron": "^27.0.0",
-        "electron-builder": "24.6.4",
-        "electron-builder-squirrel-windows": "24.7.0",
+        "detect-libc": "^2.0.0",
+        "electron": "^31.0.0",
+        "electron-builder": "24.13.3",
+        "electron-builder-squirrel-windows": "24.13.3",
         "electron-devtools-installer": "^3.2.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",
         "eslint-config-prettier": "^9.0.0",
         "eslint-plugin-import": "^2.25.4",
         "eslint-plugin-matrix-org": "^1.0.0",
-        "eslint-plugin-unicorn": "^48.0.0",
-        "expect-playwright": "^0.8.0",
-        "find-npm-prefix": "^1.0.2",
-        "fs-extra": "^11.0.0",
-        "glob": "^10.0.0",
-        "jest": "^29.0.0",
-        "matrix-web-i18n": "^3.1.3",
+        "eslint-plugin-unicorn": "^54.0.0",
+        "glob": "^11.0.0",
+        "knip": "^5.0.0",
+        "matrix-web-i18n": "^3.2.1",
         "mkdirp": "^3.0.0",
-        "node-pre-gyp": "^0.17.0",
-        "pacote": "^17.0.0",
-        "playwright": "1.37.1",
-        "prettier": "^2.8.1",
-        "rimraf": "^5.0.0",
-        "tar": "^6.1.2",
-        "ts-jest": "^29.0.0",
+        "pacote": "^18.0.0",
+        "prettier": "^3.0.0",
+        "rimraf": "^6.0.0",
+        "tar": "^6.2.1",
         "ts-node": "^10.9.1",
-        "typescript": "5.2.2"
+        "typescript": "5.5.4"
     },
     "hakDependencies": {
-        "matrix-seshat": "^3.0.1",
+        "matrix-seshat": "^4.0.0",
         "keytar": "^7.9.0"
     },
     "resolutions": {
-        "@types/node": "16.18.52"
-    },
-    "build": {
-        "appId": "im.riot.app",
-        "asarUnpack": "**/*.node",
-        "files": [
-            "package.json",
-            {
-                "from": ".hak/hakModules",
-                "to": "node_modules"
-            },
-            "lib/**"
-        ],
-        "extraResources": [
-            {
-                "from": "res/img",
-                "to": "img"
-            },
-            "webapp.asar"
-        ],
-        "linux": {
-            "target": [
-                "tar.gz",
-                "deb"
-            ],
-            "category": "Network;InstantMessaging;Chat",
-            "maintainer": "support@element.io",
-            "icon": "build/icons"
-        },
-        "deb": {
-            "packageCategory": "net",
-            "depends": [
-                "libgtk-3-0",
-                "libnotify4",
-                "libnss3",
-                "libxss1",
-                "libxtst6",
-                "xdg-utils",
-                "libatspi2.0-0",
-                "libuuid1",
-                "libsecret-1-0",
-                "libasound2",
-                "libgbm1"
-            ],
-            "recommends": [
-                "libsqlcipher0",
-                "element-io-archive-keyring"
-            ]
-        },
-        "mac": {
-            "category": "public.app-category.social-networking",
-            "darkModeSupport": true,
-            "hardenedRuntime": true,
-            "gatekeeperAssess": true,
-            "entitlements": "./build/entitlements.mac.plist",
-            "icon": "build/icons/icon.icns"
-        },
-        "win": {
-            "target": [
-                "squirrel"
-            ],
-            "signingHashAlgorithms": [
-                "sha256"
-            ],
-            "icon": "build/icons/icon.ico"
-        },
-        "directories": {
-            "output": "dist"
-        },
-        "protocols": [
-            {
-                "name": "element",
-                "schemes": [
-                    "element"
-                ]
-            }
-        ]
-    },
-    "jest": {
-        "testEnvironment": "node",
-        "testMatch": [
-            "<rootDir>/test/**/*-test.[jt]s?(x)"
-        ],
-        "setupFilesAfterEnv": [
-            "expect-playwright"
-        ]
+        "@types/node": "18.19.41",
+        "config-file-ts": "0.2.8-rc1"
     }
 }

playwright.config.ts

@@ -0,0 +1,33 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+    use: {
+        viewport: { width: 1280, height: 720 },
+        video: "retain-on-failure",
+        trace: "on-first-retry",
+    },
+    testDir: "playwright/e2e",
+    outputDir: "playwright/test-results",
+    workers: 1,
+    retries: process.env.CI ? 2 : 0,
+    reporter: [["html", { outputFolder: "playwright/html-report" }]],
+    snapshotDir: "playwright/snapshots",
+    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    timeout: 30 * 1000,
+});

playwright/.gitignore

@@ -0,0 +1,5 @@
+/test-results/
+/html-report/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png

playwright/Dockerfile

@@ -0,0 +1,10 @@
+FROM mcr.microsoft.com/playwright:v1.45.3-jammy
+
+WORKDIR /work/element-desktop
+
+RUN apt-get update && apt-get -y install xvfb && apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
+
+USER 1000:1000
+
+COPY docker-entrypoint.sh /opt/docker-entrypoint.sh
+ENTRYPOINT ["bash", "/opt/docker-entrypoint.sh"]

playwright/docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+echo "Starting Xvfb"
+Xvfb :99 -ac &
+sleep 2
+
+export DISPLAY=:99
+
+npx playwright test --update-snapshots --reporter line $1

playwright/e2e/launch/launch.spec.ts

@@ -0,0 +1,48 @@
+/*
+Copyright 2022 - 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { test, expect } from "../../element-desktop-test";
+
+declare global {
+    interface Window {
+        mxPlatformPeg: {
+            get(): {
+                getEventIndexingManager():
+                    | {
+                          supportsEventIndexing(): Promise<boolean>;
+                      }
+                    | undefined;
+            };
+        };
+    }
+}
+
+test.describe("App launch", () => {
+    test.slow();
+    test("should launch and render the welcome view successfully and support seshat", async ({ page }) => {
+        await page.locator("#matrixchat").waitFor();
+        await page.locator(".mx_Welcome").waitFor();
+        await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+        await expect(page).toHaveScreenshot();
+
+        const supported = await page.evaluate<boolean>(async () => {
+            const indexManager = window.mxPlatformPeg.get()?.getEventIndexingManager();
+            return await indexManager?.supportsEventIndexing();
+        });
+
+        expect(supported).toBe(true);
+    });
+});

playwright/element-desktop-test.ts

@@ -0,0 +1,60 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { _electron as electron, test as base, expect as baseExpect, type ElectronApplication } from "@playwright/test";
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+
+export const test = base.extend<{ app: ElectronApplication; tmpDir: string }>({
+    // eslint-disable-next-line no-empty-pattern
+    tmpDir: async ({}, use) => {
+        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
+        console.log("Using temp profile directory: ", tmpDir);
+        await use(tmpDir);
+        await fs.rm(tmpDir, { recursive: true });
+    },
+    app: async ({ tmpDir }, use) => {
+        const args = ["--profile-dir", tmpDir];
+
+        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
+        if (!executablePath) {
+            // Unpackaged mode testing
+            args.unshift(path.join(__dirname, "..", "lib", "electron-main.js"));
+        }
+
+        const app = await electron.launch({
+            env: process.env,
+            executablePath,
+            args,
+        });
+
+        app.process().stdout.pipe(process.stdout);
+        app.process().stderr.pipe(process.stderr);
+
+        await app.firstWindow();
+        await use(app);
+    },
+    page: async ({ app }, use) => {
+        const window = await app.firstWindow();
+        await use(window);
+        await app.close().catch((e) => {
+            console.error(e);
+        });
+    },
+});
+
+export const expect = baseExpect;

playwright/tsconfig.json

@@ -0,0 +1,11 @@
+{
+    "compilerOptions": {
+        "resolveJsonModule": true,
+        "moduleResolution": "node",
+        "esModuleInterop": true,
+        "target": "es2022",
+        "module": "es2022",
+        "lib": ["es2022", "dom"]
+    },
+    "include": ["**/*.ts"]
+}

release.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-#
-# Script to perform a release of element-desktop.
-
-set -e
-
-cd "$(dirname "$0")"
-
-./node_modules/matrix-js-sdk/release.sh "$@"

scripts/@types/find-npm-prefix.d.ts

@@ -1,19 +0,0 @@
-/*
-Copyright 2022 New Vector Ltd
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-declare module "find-npm-prefix" {
-    export default function findPrefix(dir: string): Promise<string>;
-}

scripts/@types/node-pre-gyp.d.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-declare module "node-pre-gyp/lib/util/versioning" {
+declare module "@mapbox/node-pre-gyp/lib/util/versioning" {
     // eslint-disable-next-line @typescript-eslint/naming-convention
     export function get_runtime_abi(runtime: string, version: string): string;
 }

scripts/fetch-package.ts

@@ -12,7 +12,7 @@ import riotDesktopPackageJson from "../package.json";
 import { setPackageVersion } from "./set-version";
 
 const PUB_KEY_URL = "https://packages.riot.im/element-release-key.asc";
-const PACKAGE_URL_PREFIX = "https://github.com/vector-im/element-web/releases/download/";
+const PACKAGE_URL_PREFIX = "https://github.com/element-hq/element-web/releases/download/";
 const DEVELOP_TGZ_URL = "https://develop.element.io/develop.tar.gz";
 const ASAR_PATH = "webapp.asar";
 
@@ -114,7 +114,7 @@ async function main(): Promise<number | undefined> {
             return 1;
         }
 
-        await new Promise<boolean>((resolve) => {
+        await new Promise<boolean>((resolve, reject) => {
             const gpgProc = childProcess.execFile("gpg", ["--import"], (error) => {
                 if (error) {
                     console.log("Failed to import key", error);
@@ -123,9 +123,11 @@ async function main(): Promise<number | undefined> {
                 }
                 resolve(!error);
             });
-            fetch(PUB_KEY_URL).then((resp) => {
-                stream.pipeline(resp.body, gpgProc.stdin!);
-            });
+            fetch(PUB_KEY_URL)
+                .then((resp) => {
+                    stream.pipeline(resp.body, gpgProc.stdin!).catch(reject);
+                })
+                .catch(reject);
         });
         return 0;
     }

scripts/generate-builder-config.ts

@@ -1,129 +0,0 @@
-#!/usr/bin/env -S npx ts-node
-
-/**
- * Script to generate electron-builder.json config files for builds which don't match package.json, e.g. nightlies
- * This script has different outputs depending on your os platform.
- *
- * On Windows:
- *  Prefixes the nightly version with `0.0.1-nightly.` as it breaks if it is not semver
- *
- * On macOS:
- *   Passes --notarytool-team-id to build.mac.notarize.notarize if specified
- *
- * On Linux:
- *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
- *  Passes --deb-custom-control to build.deb.fpm if specified
- *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
- */
-
-import parseArgs from "minimist";
-import fsProm from "fs/promises";
-import * as os from "os";
-import { Configuration } from "app-builder-lib";
-
-const ELECTRON_BUILDER_CFG_FILE = "electron-builder.json";
-
-const NIGHTLY_APP_ID = "im.riot.nightly";
-const NIGHTLY_APP_NAME = "element-desktop-nightly";
-const NIGHTLY_DEB_NAME = "element-nightly";
-
-const argv = parseArgs<{
-    "nightly"?: string;
-    "signtool-thumbprint"?: string;
-    "signtool-subject-name"?: string;
-    "notarytool-team-id"?: string;
-    "deb-changelog"?: string;
-}>(process.argv.slice(2), {
-    string: ["nightly", "deb-changelog", "signtool-thumbprint", "signtool-subject-name", "notarytool-team-id"],
-});
-
-type DeepWriteable<T> = { -readonly [P in keyof T]: DeepWriteable<T[P]> };
-
-interface PackageBuild extends DeepWriteable<Omit<Configuration, "extraMetadata">> {
-    extraMetadata?: {
-        productName?: string;
-        name?: string;
-        version?: string;
-        description?: string;
-    };
-}
-
-interface Package {
-    build: PackageBuild;
-    productName: string;
-    description: string;
-}
-
-async function main(): Promise<number | void> {
-    // Electron builder doesn't overlay with the config in package.json, so load it here
-    const pkg: Package = JSON.parse(await fsProm.readFile("package.json", "utf8"));
-
-    const cfg: PackageBuild = {
-        ...pkg.build,
-        extraMetadata: {
-            productName: pkg.productName,
-            description: pkg.description,
-        },
-    };
-
-    if (!cfg.deb!.fpm) cfg.deb!.fpm = [];
-
-    if (argv.nightly) {
-        cfg.appId = NIGHTLY_APP_ID;
-        cfg.extraMetadata!.productName += " Nightly";
-        cfg.extraMetadata!.name = NIGHTLY_APP_NAME;
-        cfg.extraMetadata!.description += " (nightly unstable build)";
-        cfg.deb!.fpm!.push("--name", NIGHTLY_DEB_NAME);
-
-        let version = argv.nightly;
-        if (os.platform() === "win32") {
-            // The windows packager relies on parsing this as semver, so we have to make it look like one.
-            // This will give our update packages really stupid names, but we probably can't change that either
-            // because squirrel windows parses them for the version too. We don't really care: nobody sees them.
-            // We just give the installer a static name, so you'll just see this in the 'about' dialog.
-            // Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
-            version = "0.0.1-nightly." + version;
-        }
-        cfg.extraMetadata!.version = version;
-    } else {
-        cfg.deb!.fpm!.push("--deb-field", "Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)");
-        cfg.deb!.fpm!.push("--deb-field", "Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)");
-    }
-
-    if (argv["signtool-thumbprint"] && argv["signtool-subject-name"]) {
-        cfg.win!.certificateSubjectName = argv["signtool-subject-name"];
-        cfg.win!.certificateSha1 = argv["signtool-thumbprint"];
-    }
-
-    if (argv["notarytool-team-id"]) {
-        cfg.mac!.notarize = {
-            teamId: argv["notarytool-team-id"],
-        };
-    }
-
-    if (os.platform() === "linux") {
-        // Electron crashes on debian if there's a space in the path.
-        // https://github.com/vector-im/element-web/issues/13171
-        cfg.extraMetadata!.productName = cfg.extraMetadata!.productName!.replace(/ /g, "-");
-
-        if (argv["deb-changelog"]) {
-            cfg.deb!.fpm!.push(`--deb-changelog=${argv["deb-changelog"]}`);
-        }
-
-        if (process.env.SQLCIPHER_BUNDLED) {
-            // Remove sqlcipher dependency when using bundled
-            cfg.deb!.recommends = cfg.deb!.recommends?.filter((d) => d !== "libsqlcipher0");
-        }
-    }
-
-    await fsProm.writeFile(ELECTRON_BUILDER_CFG_FILE, JSON.stringify(cfg, null, 4));
-}
-
-main()
-    .then((ret) => {
-        process.exit(ret!);
-    })
-    .catch((e) => {
-        console.error(e);
-        process.exit(1);
-    });

scripts/glibc-check.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Source https://gist.github.com/vladimyr/9a03481154cd3048a486bdf71e5e1535/57e57a6ace6fb2c8bba948bce726df7a96c3f99f
+# This scripts lets you check which minimum GLIBC version an executable requires.
+# Simply run './glibc-check.sh path/to/your/binary'
+MAX_VER="${MAX_VER:-2.28}"
+
+BINARY="$1"
+
+# Version comparison function in bash
+vercomp() {
+  if [[ $1 == "$2" ]]; then
+    return 0
+  fi
+  local i ver1 ver2
+  IFS="." read -ra ver1 <<<"$1"
+  IFS="." read -ra ver2 <<<"$2"
+  # fill empty fields in ver1 with zeros
+  for ((i = ${#ver1[@]}; i < ${#ver2[@]}; i++)); do
+    ver1[i]=0
+  done
+  for ((i = 0; i < ${#ver1[@]}; i++)); do
+    if [[ -z ${ver2[i]} ]]; then
+      # fill empty fields in ver2 with zeros
+      ver2[i]=0
+    fi
+    if ((10#${ver1[i]} > 10#${ver2[i]})); then
+      return 1
+    fi
+    if ((10#${ver1[i]} < 10#${ver2[i]})); then
+      return 2
+    fi
+  done
+  return 0
+}
+
+IFS="
+"
+VERS=$(objdump -T "$BINARY" | grep GLIBC_ | sed 's/.*GLIBC_\([.0-9]*\).*/\1/g' | sort -u)
+
+for VER in $VERS; do
+  vercomp "$VER" "$MAX_VER"
+  COMP=$?
+  if [[ $COMP -eq 1 ]]; then
+    echo "Error! ${BINARY} requests GLIBC ${VER}, which is higher than target ${MAX_VER}"
+    echo "Affected symbols:"
+    objdump -T "$BINARY" | grep -F "GLIBC_${VER}"
+    echo "Looking for symbols in libraries..."
+    for LIBRARY in $(ldd "$BINARY" | cut -d ' ' -f 3); do
+      echo "$LIBRARY"
+      objdump -T "$LIBRARY" | grep -F "GLIBC_${VER}"
+    done
+    exit 27
+  else
+    echo "Found version ${VER}"
+  fi
+done

scripts/hak/fetch.ts

@@ -44,6 +44,9 @@ export default async function fetch(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(hakEnv.isWin() ? "yarn.cmd" : "yarn", ["install", "--ignore-scripts"], {
             stdio: "inherit",
             cwd: moduleInfo.moduleBuildDir,
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();

scripts/hak/hakEnv.ts

@@ -16,18 +16,18 @@ limitations under the License.
 
 import path from "path";
 import os from "os";
-import nodePreGypVersioning from "node-pre-gyp/lib/util/versioning";
-import { getElectronVersion } from "app-builder-lib/out/electron/electronVersion";
+import nodePreGypVersioning from "@mapbox/node-pre-gyp/lib/util/versioning";
+import { getElectronVersionFromInstalled } from "app-builder-lib/out/electron/electronVersion";
 
 import { Arch, Target, TARGETS, getHost, isHostId, TargetId } from "./target";
 
 async function getRuntime(projectRoot: string): Promise<string> {
-    const electronVersion = await getElectronVersion(projectRoot);
+    const electronVersion = await getElectronVersionFromInstalled(projectRoot);
     return electronVersion ? "electron" : "node-webkit";
 }
 
 async function getRuntimeVersion(projectRoot: string): Promise<string> {
-    const electronVersion = await getElectronVersion(projectRoot);
+    const electronVersion = await getElectronVersionFromInstalled(projectRoot);
     if (electronVersion) {
         return electronVersion;
     } else {
@@ -41,7 +41,10 @@ export default class HakEnv {
     public runtimeVersion?: string;
     public dotHakDir: string;
 
-    public constructor(public readonly projectRoot: string, targetId: TargetId | null) {
+    public constructor(
+        public readonly projectRoot: string,
+        targetId: TargetId | null,
+    ) {
         const target = targetId ? TARGETS[targetId] : getHost();
 
         if (!target) {
@@ -94,15 +97,16 @@ export default class HakEnv {
     }
 
     public makeGypEnv(): Record<string, string | undefined> {
-        return Object.assign({}, process.env, {
+        return {
+            ...process.env,
             npm_config_arch: this.target.arch,
             npm_config_target_arch: this.target.arch,
             npm_config_disturl: "https://electronjs.org/headers",
             npm_config_runtime: this.runtime,
             npm_config_target: this.runtimeVersion,
-            npm_config_build_from_source: true,
+            npm_config_build_from_source: "true",
             npm_config_devdir: path.join(os.homedir(), ".electron-gyp"),
-        });
+        };
     }
 
     public wantsStaticSqlCipher(): boolean {

scripts/hak/index.ts

@@ -15,7 +15,6 @@ limitations under the License.
 */
 
 import path from "path";
-import findNpmPrefix from "find-npm-prefix";
 
 import HakEnv from "./hakEnv";
 import { TargetId } from "./target";
@@ -37,7 +36,7 @@ const METACOMMANDS: Record<string, string[]> = {
 const HAKSCRIPTS = ["check", "fetch", "build"];
 
 async function main(): Promise<void> {
-    const prefix = await findNpmPrefix(process.cwd());
+    const prefix = path.join(__dirname, "..", "..");
     let packageJson;
     try {
         packageJson = require(path.join(prefix, "package.json"));

scripts/hak/link.ts

@@ -53,6 +53,9 @@ export default async function link(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(yarnCmd, ["link"], {
             cwd: moduleInfo.moduleOutDir,
             stdio: "inherit",
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();
@@ -63,6 +66,9 @@ export default async function link(hakEnv: HakEnv, moduleInfo: DependencyInfo):
         const proc = childProcess.spawn(yarnCmd, ["link", moduleInfo.name], {
             cwd: hakEnv.projectRoot,
             stdio: "inherit",
+            // We need shell mode on Windows to be able to launch `.cmd` executables
+            // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+            shell: hakEnv.isWin(),
         });
         proc.on("exit", (code) => {
             code ? reject(code) : resolve();

scripts/hak/target.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { GLIBC, MUSL, family as processLibC } from "detect-libc";
+import { GLIBC, MUSL, familySync as processLibC } from "detect-libc";
 
 // We borrow Rust's target naming scheme as a way of expressing all target
 // details in a single string.
@@ -61,7 +61,7 @@ export type WindowsTarget = Target & {
 
 export type LinuxTarget = Target & {
     platform: "linux";
-    libC: typeof processLibC;
+    libC: typeof GLIBC | typeof MUSL;
 };
 
 export type UniversalTarget = Target & {
@@ -212,7 +212,7 @@ export function getHost(): Target | undefined {
         (target) =>
             target.platform === process.platform &&
             target.arch === process.arch &&
-            (process.platform !== "linux" || (target as LinuxTarget).libC === processLibC),
+            (process.platform !== "linux" || (target as LinuxTarget).libC === processLibC()),
     );
 }
 

scripts/in-docker.sh

@@ -11,6 +11,7 @@ fi
 # Taken from https://www.electron.build/multi-platform-build#docker
 # Pass through any vars prefixed with INDOCKER_, removing the prefix
 docker run --rm -ti \
+ --platform linux/amd64 \
  --env-file <(env | grep -E '^INDOCKER_' | sed -e 's/^INDOCKER_//') \
  --env ELECTRON_CACHE="/root/.cache/electron" \
  --env ELECTRON_BUILDER_CACHE="/root/.cache/electron-builder" \

scripts/set-version.ts

@@ -32,6 +32,11 @@ export async function setPackageVersion(ver: string): Promise<void> {
                 "--new-version",
                 ver,
             ],
+            {
+                // We need shell mode on Windows to be able to launch `.cmd` executables
+                // See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
+                shell: process.platform === "win32",
+            },
             (err) => {
                 if (err) {
                     reject(err);

src/@types/glob.d.ts

@@ -1,6 +0,0 @@
-import { GlobOptions } from "glob";
-
-declare module "glob" {
-    // Workaround for @electron/asar importing IOptions instead of GlobOptions
-    export type IOptions = GlobOptions;
-}

src/electron-main.ts

@@ -41,6 +41,8 @@ import { getProfileFromDeeplink, protocolInit } from "./protocol";
 import { _t, AppLocalization } from "./language-helper";
 import { setDisplayMediaCallback } from "./displayMediaCallback";
 import { setupMacosTitleBar } from "./macos-titlebar";
+import { loadJsonFile } from "./utils";
+import { setupMediaAuth } from "./media-auth";
 
 const argv = minimist(process.argv, {
     alias: { help: "h" },
@@ -143,8 +145,7 @@ async function loadConfig(): Promise<void> {
     const asarPath = await getAsarPath();
 
     try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        global.vectorConfig = require(asarPath + "config.json");
+        global.vectorConfig = loadJsonFile(asarPath, "config.json");
     } catch (e) {
         // it would be nice to check the error code here and bail if the config
         // is unparsable, but we get MODULE_NOT_FOUND in the case of a missing
@@ -155,8 +156,7 @@ async function loadConfig(): Promise<void> {
 
     try {
         // Load local config and use it to override values from the one baked with the build
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const localConfig = require(path.join(app.getPath("userData"), "config.json"));
+        const localConfig = loadJsonFile(app.getPath("userData"), "config.json");
 
         // If the local config has a homeserver defined, don't use the homeserver from the build
         // config. This is to avoid a problem where Riot thinks there are multiple homeservers
@@ -165,16 +165,19 @@ async function loadConfig(): Promise<void> {
             // Rip out all the homeserver options from the vector config
             global.vectorConfig = Object.keys(global.vectorConfig)
                 .filter((k) => !homeserverProps.includes(<any>k))
-                .reduce((obj, key) => {
-                    obj[key] = global.vectorConfig[key];
-                    return obj;
-                }, {} as Omit<Partial<(typeof global)["vectorConfig"]>, keyof typeof homeserverProps>);
+                .reduce(
+                    (obj, key) => {
+                        obj[key] = global.vectorConfig[key];
+                        return obj;
+                    },
+                    {} as Omit<Partial<(typeof global)["vectorConfig"]>, keyof typeof homeserverProps>,
+                );
         }
 
         global.vectorConfig = Object.assign(global.vectorConfig, localConfig);
     } catch (e) {
         if (e instanceof SyntaxError) {
-            dialog.showMessageBox({
+            void dialog.showMessageBox({
                 type: "error",
                 title: `Your ${global.vectorConfig.brand || "Element"} is misconfigured`,
                 message:
@@ -290,7 +293,7 @@ const warnBeforeExit = (event: Event, input: Input): void => {
     }
 };
 
-configureSentry();
+void configureSentry();
 
 // handle uncaught errors otherwise it displays
 // stack traces in popup dialogs, which is terrible (which
@@ -440,7 +443,7 @@ app.on("ready", async () => {
         console.log('Auto update disabled via command line flag "--no-update"');
     } else if (global.vectorConfig["update_base_url"]) {
         console.log(`Starting auto update with base URL: ${global.vectorConfig["update_base_url"]}`);
-        updater.start(global.vectorConfig["update_base_url"]);
+        void updater.start(global.vectorConfig["update_base_url"]);
     } else {
         console.log("No update_base_url is defined: auto update is disabled");
     }
@@ -475,7 +478,7 @@ app.on("ready", async () => {
             webgl: true,
         },
     });
-    global.mainWindow.loadURL("vector://vector/webapp/");
+    void global.mainWindow.loadURL("vector://vector/webapp/");
 
     if (process.platform === "darwin") {
         setupMacosTitleBar(global.mainWindow);
@@ -547,6 +550,8 @@ app.on("ready", async () => {
         global.mainWindow?.webContents.send("openDesktopCapturerSourcePicker");
         setDisplayMediaCallback(callback);
     });
+
+    setupMediaAuth(global.mainWindow);
 });
 
 app.on("window-all-closed", () => {

src/i18n/strings/eo.json

@@ -3,7 +3,7 @@
         "cancel": "Nuligi",
         "close": "Fermi",
         "close_brand": "Fermu %(brand)s",
-        "copy": "Kopiu",
+        "copy": "Kopii",
         "cut": "Tranĉi",
         "delete": "Forigi",
         "edit": "Redakti",
@@ -15,9 +15,9 @@
         "undo": "Malfari"
     },
     "common": {
-        "about": "Informilo",
+        "about": "Prio",
         "help": "Helpo",
-        "preferences": "Preferoj"
+        "preferences": "Agordoj"
     },
     "confirm_quit": "Ĉu vi certas, ke vi volas ĉesi?",
     "edit_menu": {

src/i18n/strings/es.json

@@ -5,7 +5,7 @@
         "close_brand": "Cerrar %(brand)s",
         "copy": "Copiar",
         "cut": "Cortar",
-        "delete": "Eliminar",
+        "delete": "Borrar",
         "edit": "Editar",
         "minimise": "Minimizar",
         "paste": "Pegar",

src/i18n/strings/et.json

@@ -1,6 +1,6 @@
 {
     "action": {
-        "cancel": "Tühista",
+        "cancel": "Loobu",
         "close": "Sulge",
         "close_brand": "Sulge %(brand)s",
         "copy": "Kopeeri",
@@ -22,7 +22,7 @@
         "about": "Rakenduse teave",
         "brand_help": "%(brand)s abiteave",
         "help": "Abiteave",
-        "preferences": "Seadistused"
+        "preferences": "Eelistused"
     },
     "confirm_quit": "Kas sa kindlasti soovid rakendusest väljuda?",
     "edit_menu": {
@@ -53,7 +53,7 @@
         "actual_size": "Näita tavasuuruses",
         "toggle_developer_tools": "Arendaja töövahendid sisse/välja",
         "toggle_full_screen": "Täisekraanivaade sisse/välja",
-        "view": "Vaata"
+        "view": "Näita"
     },
     "window_menu": {
         "bring_all_to_front": "Too kõik esiplaanile",

src/i18n/strings/fa.json

@@ -5,7 +5,7 @@
         "close_brand": "بستن %(brand)s",
         "copy": "رونوشت",
         "cut": "برش",
-        "delete": "حذف",
+        "delete": "پاک‌کردن",
         "edit": "ویرایش",
         "minimise": "کمینه",
         "paste": "جای‌گذاری",
@@ -20,6 +20,7 @@
     },
     "common": {
         "about": "درباره",
+        "brand_help": "کمک %(brand)s",
         "help": "راهنما",
         "preferences": "ترجیحات"
     },
@@ -52,7 +53,7 @@
         "actual_size": "اندازهٔ واقعی",
         "toggle_developer_tools": "تغییر وضعیت ابزارهای توسعه‌دهنده",
         "toggle_full_screen": "تغییر وضعیت تمام‌صفحه",
-        "view": "دیدن"
+        "view": "مشاهده"
     },
     "window_menu": {
         "bring_all_to_front": "همه را به جلو بیاورید",

src/i18n/strings/fi.json

@@ -19,9 +19,9 @@
         "zoom_out": "Pienennä"
     },
     "common": {
-        "about": "Tietoja",
-        "help": "Apua",
-        "preferences": "Asetukset"
+        "about": "Tietoa",
+        "help": "Ohje",
+        "preferences": "Valinnat"
     },
     "confirm_quit": "Haluatko varmasti poistua?",
     "edit_menu": {

src/i18n/strings/fr.json

@@ -36,6 +36,7 @@
     "menu": {
         "hide": "Masquer",
         "hide_others": "Masquer les autres",
+        "services": "Services",
         "unhide": "Dé-masquer"
     },
     "right_click_menu": {
@@ -56,6 +57,7 @@
     },
     "window_menu": {
         "bring_all_to_front": "Tout amener au premier plan",
-        "label": "Fenêtre"
+        "label": "Fenêtre",
+        "zoom": "Zoom"
     }
 }

src/i18n/strings/gl.json

@@ -50,7 +50,7 @@
         "actual_size": "Tamaño real",
         "toggle_developer_tools": "Activar ferramentas de desenvolvemento",
         "toggle_full_screen": "Activar pantalla completa",
-        "view": "Ver"
+        "view": "Vista"
     },
     "window_menu": {
         "bring_all_to_front": "Traer todo á fronte",

src/i18n/strings/he.json

@@ -2,10 +2,11 @@
     "action": {
         "cancel": "ביטול",
         "close": "סגור",
+        "close_brand": "סגור%(brand)s",
         "copy": "העתק",
         "cut": "גזור",
         "delete": "מחק",
-        "edit": "עריכה",
+        "edit": "ערוך",
         "minimise": "מזער",
         "paste": "הדבק",
         "paste_match_style": "הדבק והתאם סגנון",
@@ -19,6 +20,7 @@
     },
     "common": {
         "about": "אודות",
+        "brand_help": "%(brand)s עזרה",
         "help": "עזרה",
         "preferences": "העדפות"
     },

src/i18n/strings/hu.json

@@ -1,26 +1,27 @@
 {
     "action": {
-        "cancel": "Mégsem",
-        "close": "Bezár",
+        "cancel": "Mégse",
+        "close": "Bezárás",
         "close_brand": "%(brand)s bezárása",
-        "copy": "Másol",
-        "cut": "Kivág",
-        "delete": "Töröl",
-        "edit": "Szerkeszt",
+        "copy": "Másolás",
+        "cut": "Kivágás",
+        "delete": "Törlés",
+        "edit": "Szerkesztés",
         "minimise": "Lecsukás",
         "paste": "Beillesztés",
         "paste_match_style": "Beillesztés formázással",
-        "quit": "Kilép",
+        "quit": "Kilépés",
         "redo": "Újra",
         "select_all": "Összes kijelölése",
-        "show_hide": "Megmutat/Elrejt",
-        "undo": "Visszavon",
-        "zoom_in": "Nagyít",
-        "zoom_out": "Kicsinyít"
+        "show_hide": "Megjelenítés/elrejtés",
+        "undo": "Visszavonás",
+        "zoom_in": "Nagyítás",
+        "zoom_out": "Kicsinyítés"
     },
     "common": {
         "about": "Névjegy",
-        "help": "Segítség",
+        "brand_help": "%(brand)s Súgó",
+        "help": "Súgó",
         "preferences": "Beállítások"
     },
     "confirm_quit": "Biztos, hogy kilép?",
@@ -33,18 +34,18 @@
         "label": "Fájl"
     },
     "menu": {
-        "hide": "Eltakar",
-        "hide_others": "Minden mást eltakar",
+        "hide": "Elrejtés",
+        "hide_others": "Mások elrejtése",
         "services": "Szolgáltatás",
-        "unhide": "Felfed"
+        "unhide": "Felfedés"
     },
     "right_click_menu": {
         "add_to_dictionary": "Hozzáadás a szótárhoz",
-        "copy_email": "E-mail cím másolása",
+        "copy_email": "E-mail-cím másolása",
         "copy_image": "Kép másolása",
         "copy_image_url": "Kép címének másolása",
         "copy_link_url": "Hivatkozás másolása",
-        "save_image_as": "Kép mentése másként...",
+        "save_image_as": "Kép mentése másként…",
         "save_image_as_error_description": "A kép mentése sikertelen",
         "save_image_as_error_title": "Kép mentése sikertelen"
     },
@@ -52,7 +53,7 @@
         "actual_size": "Jelenlegi méret",
         "toggle_developer_tools": "Fejlesztői eszközök",
         "toggle_full_screen": "Teljes képernyő",
-        "view": "Nézet"
+        "view": "Megtekintés"
     },
     "window_menu": {
         "bring_all_to_front": "Mindent előtérbe hoz",

src/i18n/strings/id.json

@@ -1,11 +1,12 @@
 {
     "action": {
-        "cancel": "Batal",
+        "cancel": "Batalkan",
         "close": "Tutup",
         "close_brand": "Tutuo %(brand)s",
         "copy": "Salin",
         "cut": "Potong",
         "delete": "Hapus",
+        "edit": "Sunting",
         "minimise": "Minimalkan",
         "paste": "Tempel",
         "paste_match_style": "Tempel dan Cocokkan Gaya",
@@ -21,7 +22,7 @@
         "about": "Tentang",
         "brand_help": "Bantuan %(brand)s",
         "help": "Bantuan",
-        "preferences": "Pengaturan"
+        "preferences": "Preferensi"
     },
     "confirm_quit": "Apakah Anda yakin ingin keluar?",
     "edit_menu": {
@@ -29,6 +30,9 @@
         "speech_start_speaking": "Mulai Berbicara",
         "speech_stop_speaking": "Berhenti Berbicara"
     },
+    "file_menu": {
+        "label": "Berkas"
+    },
     "menu": {
         "hide": "Sembunyikan",
         "hide_others": "Sembunyikan yang Lain",

src/i18n/strings/it.json

@@ -30,6 +30,9 @@
         "speech_start_speaking": "Inizia a parlare",
         "speech_stop_speaking": "Smetti di parlare"
     },
+    "file_menu": {
+        "label": "File"
+    },
     "menu": {
         "hide": "Nascondi",
         "hide_others": "Nascondi gli altri",
@@ -54,6 +57,7 @@
     },
     "window_menu": {
         "bring_all_to_front": "Porta tutto in primo piano",
-        "label": "Finestra"
+        "label": "Finestra",
+        "zoom": "Ingrandisci"
     }
 }

src/i18n/strings/lt.json

@@ -6,7 +6,7 @@
         "copy": "Kopijuoti",
         "cut": "Iškirpti",
         "delete": "Ištrinti",
-        "edit": "Redaguoti",
+        "edit": "Koreguoti",
         "minimise": "Sumažinti",
         "paste": "Įklijuoti",
         "paste_match_style": "Įklijuoti ir suderinti stilių",
@@ -52,7 +52,7 @@
         "actual_size": "Tikrasis dydis",
         "toggle_developer_tools": "Perjungti kūrėjo įrankius",
         "toggle_full_screen": "Perjungti viso ekrano režimą",
-        "view": "Peržiūrėti"
+        "view": "Žiūrėti"
     },
     "window_menu": {
         "bring_all_to_front": "Viską iškelti į priekį",

src/i18n/strings/pl.json

@@ -51,8 +51,8 @@
     },
     "view_menu": {
         "actual_size": "Rozmiar rzeczywisty",
-        "toggle_developer_tools": "Przełącz na narzędzia deweloperskie",
-        "toggle_full_screen": "Przełącz na pełny ekran",
+        "toggle_developer_tools": "Przełącz narzędzia deweloperskie",
+        "toggle_full_screen": "Przełącz pełny ekran",
         "view": "Wyświetl"
     },
     "window_menu": {

src/i18n/strings/pt_BR.json

@@ -5,7 +5,7 @@
         "close_brand": "Fechar %(brand)s",
         "copy": "Copiar",
         "cut": "Cortar",
-        "delete": "Deletar",
+        "delete": "Excluir",
         "edit": "Editar",
         "minimise": "Minimizar",
         "paste": "Colar",
@@ -52,7 +52,7 @@
         "actual_size": "Tamanho de Verdade",
         "toggle_developer_tools": "Ativar/Desativar Ferramentas de Desenvolvimento",
         "toggle_full_screen": "Pôr em/Tirar de Tela Cheia",
-        "view": "Visualizar"
+        "view": "Ver"
     },
     "window_menu": {
         "bring_all_to_front": "Trazer Todas Para Frente",

src/i18n/strings/sk.json

@@ -6,7 +6,7 @@
         "copy": "Kopírovať",
         "cut": "Vystrihnúť",
         "delete": "Odstrániť",
-        "edit": "Úpravy",
+        "edit": "Upraviť",
         "minimise": "Minimalizovať",
         "paste": "Vložiť",
         "paste_match_style": "Vložiť a prispôsobiť štýl",
@@ -19,10 +19,10 @@
         "zoom_out": "Oddialiť"
     },
     "common": {
-        "about": "O aplikácii",
+        "about": "Informácie",
         "brand_help": "%(brand)s Pomoc",
         "help": "Pomocník",
-        "preferences": "Vlastnosti"
+        "preferences": "Predvoľby"
     },
     "confirm_quit": "Naozaj chcete zavrieť aplikáciu?",
     "edit_menu": {

src/i18n/strings/sv.json

@@ -6,7 +6,7 @@
         "copy": "Kopiera",
         "cut": "Klipp ut",
         "delete": "Radera",
-        "edit": "Redigera",
+        "edit": "Ändra",
         "minimise": "Minimera",
         "paste": "Klistra in",
         "paste_match_style": "Klistra in och matcha stilen",

src/i18n/strings/vi.json

@@ -1,12 +1,12 @@
 {
     "action": {
-        "cancel": "Hủy bỏ",
+        "cancel": "Huỷ bỏ",
         "close": "Đóng",
         "close_brand": "Đóng %(brand)s",
         "copy": "Sao chép",
         "cut": "Cắt",
-        "delete": "Xóa",
-        "edit": "Chỉnh sửa",
+        "delete": "Xoá",
+        "edit": "Sửa",
         "minimise": "Thu nhỏ",
         "paste": "Dán",
         "paste_match_style": "Dán và khớp kiểu",

src/ipc.ts

@@ -38,13 +38,15 @@ ipcMain.on("setBadgeCount", function (_ev: IpcMainEvent, count: number): void {
 
 let focusHandlerAttached = false;
 ipcMain.on("loudNotification", function (): void {
-    if (process.platform === "win32" && global.mainWindow && !global.mainWindow.isFocused() && !focusHandlerAttached) {
-        global.mainWindow.flashFrame(true);
-        global.mainWindow.once("focus", () => {
-            global.mainWindow?.flashFrame(false);
-            focusHandlerAttached = false;
-        });
-        focusHandlerAttached = true;
+    if (process.platform === "win32" || process.platform === "linux") {
+        if (global.mainWindow && !global.mainWindow.isFocused() && !focusHandlerAttached) {
+            global.mainWindow.flashFrame(true);
+            global.mainWindow.once("focus", () => {
+                global.mainWindow?.flashFrame(false);
+                focusHandlerAttached = false;
+            });
+            focusHandlerAttached = true;
+        }
     }
 });
 
@@ -98,9 +100,8 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
         case "focusWindow":
             if (global.mainWindow.isMinimized()) {
                 global.mainWindow.restore();
-            } else if (!global.mainWindow.isVisible()) {
-                global.mainWindow.show();
             } else {
+                global.mainWindow.show();
                 global.mainWindow.focus();
             }
             break;
@@ -216,11 +217,11 @@ ipcMain.on("ipcCall", async function (_ev: IpcMainEvent, payload) {
                             label: r.initial,
                             backgroundColor: defaultColors[total % defaultColors.length],
                             click: (): void => {
-                                global.mainWindow?.loadURL(`vector://vector/webapp/#/room/${r.roomId}`);
+                                void global.mainWindow?.loadURL(`vector://vector/webapp/#/room/${r.roomId}`);
                             },
                         });
                         if (r.avatarUrl) {
-                            fetch(r.avatarUrl)
+                            void fetch(r.avatarUrl)
                                 .then((resp) => {
                                     if (!resp.ok) return;
                                     return resp.arrayBuffer();

src/language-helper.ts

@@ -19,15 +19,12 @@ import { TranslationKey as TKey } from "matrix-web-i18n";
 
 import type Store from "electron-store";
 import type EN from "./i18n/strings/en_EN.json";
+import { loadJsonFile } from "./utils";
 
 const FALLBACK_LOCALE = "en";
 
 type TranslationKey = TKey<typeof EN>;
 
-export function _td(text: TranslationKey): TranslationKey {
-    return text;
-}
-
 type SubstitutionValue = number | string;
 
 interface Variables {
@@ -109,7 +106,7 @@ export class AppLocalization {
     public fetchTranslationJson(locale: string): Record<string, string> {
         try {
             console.log("Fetching translation json for locale: " + locale);
-            return require(`./i18n/strings/${this.denormalize(locale)}.json`);
+            return loadJsonFile(__dirname, "i18n", "strings", `${this.denormalize(locale)}.json`);
         } catch (e) {
             console.log(`Could not fetch translation json for locale: '${locale}'`, e);
             return {};

src/macos-titlebar.ts

@@ -150,15 +150,15 @@ export function setupMacosTitleBar(window: BrowserWindow): void {
 
     window.on("enter-full-screen", () => {
         if (cssKey !== undefined) {
-            window.webContents.removeInsertedCSS(cssKey);
+            void window.webContents.removeInsertedCSS(cssKey);
         }
     });
     window.on("leave-full-screen", () => {
-        applyStyling();
+        void applyStyling();
     });
     window.webContents.on("did-finish-load", () => {
         if (!window.isFullScreen()) {
-            applyStyling();
+            void applyStyling();
         }
     });
 }

src/media-auth.ts

@@ -0,0 +1,80 @@
+/*
+Copyright 2024 New Vector Ltd
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { BrowserWindow, ipcMain, session } from "electron";
+
+/**
+ * Check for feature support from the server.
+ * This requires asking the renderer process for supported versions.
+ */
+async function getSupportedVersions(window: BrowserWindow): Promise<string[]> {
+    return new Promise((resolve) => {
+        ipcMain.once("serverSupportedVersions", (_, versionsResponse) => {
+            resolve(versionsResponse?.versions || []);
+        });
+        window.webContents.send("serverSupportedVersions"); // ping now that the listener exists
+    });
+}
+
+/**
+ * Get the access token for the user.
+ * This requires asking the renderer process for the access token.
+ */
+async function getAccessToken(window: BrowserWindow): Promise<string | undefined> {
+    return new Promise((resolve) => {
+        ipcMain.once("userAccessToken", (_, accessToken) => {
+            resolve(accessToken);
+        });
+        window.webContents.send("userAccessToken"); // ping now that the listener exists
+    });
+}
+
+export function setupMediaAuth(window: BrowserWindow): void {
+    session.defaultSession.webRequest.onBeforeRequest(async (req, callback) => {
+        // This handler emulates the element-web service worker, where URLs are rewritten late in the request
+        // for backwards compatibility. As authenticated media becomes more prevalent, this should be replaced
+        // by the app using authenticated URLs from the outset.
+        let url = req.url;
+        if (!url.includes("/_matrix/media/v3/download") && !url.includes("/_matrix/media/v3/thumbnail")) {
+            return callback({}); // not a URL we care about
+        }
+
+        const supportedVersions = await getSupportedVersions(window);
+        // We have to check that the access token is truthy otherwise we'd be intercepting pre-login media request too,
+        // e.g. those required for SSO button icons.
+        const accessToken = await getAccessToken(window);
+        if (supportedVersions.includes("v1.11") && accessToken) {
+            url = url.replace(/\/media\/v3\/(.*)\//, "/client/v1/media/$1/");
+            return callback({ redirectURL: url });
+        } else {
+            return callback({}); // no support == no modification
+        }
+    });
+
+    session.defaultSession.webRequest.onBeforeSendHeaders(async (req, callback) => {
+        if (!req.url.includes("/_matrix/client/v1/media")) {
+            return callback({}); // invoke unmodified
+        }
+
+        // Only add authorization header to authenticated media URLs. This emulates the service worker
+        // behaviour in element-web.
+        const accessToken = await getAccessToken(window);
+        // `accessToken` can be falsy, but if we're trying to download media without authentication
+        // then we should expect failure anyway.
+        const headers = { ...req.requestHeaders, Authorization: `Bearer ${accessToken}` };
+        return callback({ requestHeaders: headers });
+    });
+}

src/preload.ts

@@ -35,6 +35,8 @@ const CHANNELS = [
     "userDownloadCompleted",
     "userDownloadAction",
     "openDesktopCapturerSourcePicker",
+    "userAccessToken",
+    "serverSupportedVersions",
 ];
 
 contextBridge.exposeInMainWorld("electron", {

src/protocol.ts

@@ -19,7 +19,8 @@ import { URL } from "url";
 import path from "path";
 import fs from "fs";
 
-const PROTOCOL = "element:";
+const LEGACY_PROTOCOL = "element";
+const PROTOCOL = "io.element.desktop";
 const SEARCH_PARAM = "element-desktop-ssoid";
 const STORE_FILE_NAME = "sso-sessions.json";
 
@@ -33,7 +34,7 @@ function processUrl(url: string): void {
     // sanity check: we only register for the one protocol, so we shouldn't
     // be getting anything else unless the user is forcing a URL to open
     // with the Element app.
-    if (parsed.protocol !== PROTOCOL) {
+    if (parsed.protocol !== `${PROTOCOL}:` && parsed.protocol !== `${LEGACY_PROTOCOL}:`) {
         console.log("Ignoring unexpected protocol: ", parsed.protocol);
         return;
     }
@@ -49,7 +50,7 @@ function processUrl(url: string): void {
     urlToLoad.hash = parsed.hash;
 
     console.log("Opening URL: ", urlToLoad.href);
-    global.mainWindow.loadURL(urlToLoad.href);
+    void global.mainWindow.loadURL(urlToLoad.href);
 }
 
 function readStore(): Record<string, string> {
@@ -82,12 +83,17 @@ export function recordSSOSession(sessionID: string): void {
 
 export function getProfileFromDeeplink(args: string[]): string | undefined {
     // check if we are passed a profile in the SSO callback url
-    const deeplinkUrl = args.find((arg) => arg.startsWith(PROTOCOL + "//"));
+    const deeplinkUrl = args.find((arg) => arg.startsWith(`${PROTOCOL}://`) || arg.startsWith(`${LEGACY_PROTOCOL}://`));
     if (deeplinkUrl?.includes(SEARCH_PARAM)) {
         const parsedUrl = new URL(deeplinkUrl);
-        if (parsedUrl.protocol === PROTOCOL) {
-            const ssoID = parsedUrl.searchParams.get(SEARCH_PARAM)!;
+        if (parsedUrl.protocol === `${PROTOCOL}:` || parsedUrl.protocol === `${LEGACY_PROTOCOL}:`) {
             const store = readStore();
+            let ssoID = parsedUrl.searchParams.get(SEARCH_PARAM);
+            if (!ssoID) {
+                // In OIDC, we must shuttle the value in the `state` param rather than `element-desktop-ssoid`
+                // We encode it as a suffix like `:element-desktop-ssoid:XXYYZZ`
+                ssoID = parsedUrl.searchParams.get("state")!.split(`:${SEARCH_PARAM}:`)[1];
+            }
             console.log("Forwarding to profile: ", store[ssoID]);
             return store[ssoID];
         }
@@ -100,11 +106,13 @@ export function protocolInit(): void {
     // --profile/--profile-dir are passed via the SEARCH_PARAM var in the callback url
     const args = process.argv.slice(1).filter((arg) => arg !== "--hidden" && arg !== "-hidden");
     if (app.isPackaged) {
-        app.setAsDefaultProtocolClient("element", process.execPath, args);
+        app.setAsDefaultProtocolClient(PROTOCOL, process.execPath, args);
+        app.setAsDefaultProtocolClient(LEGACY_PROTOCOL, process.execPath, args);
     } else if (process.platform === "win32") {
         // on Mac/Linux this would just cause the electron binary to open
         // special handler for running without being packaged, e.g `electron .` by passing our app path to electron
-        app.setAsDefaultProtocolClient("element", process.execPath, [app.getAppPath(), ...args]);
+        app.setAsDefaultProtocolClient(PROTOCOL, process.execPath, [app.getAppPath(), ...args]);
+        app.setAsDefaultProtocolClient(LEGACY_PROTOCOL, process.execPath, [app.getAppPath(), ...args]);
     }
 
     if (process.platform === "darwin") {
@@ -117,7 +125,7 @@ export function protocolInit(): void {
         // Protocol handler for win32/Linux
         app.on("second-instance", (ev, commandLine) => {
             const url = commandLine[commandLine.length - 1];
-            if (!url.startsWith(PROTOCOL + "//")) return;
+            if (!url.startsWith(`${PROTOCOL}://`) && !url.startsWith(`${LEGACY_PROTOCOL}://`)) return;
             processUrl(url);
         });
     }

src/squirrelhooks.ts

@@ -18,12 +18,16 @@ import path from "path";
 import { spawn } from "child_process";
 import { app } from "electron";
 
+export function getSquirrelExecutable(): string {
+    return path.resolve(path.dirname(process.execPath), "..", "Update.exe");
+}
+
 function runUpdateExe(args: string[]): Promise<void> {
     // Invokes Squirrel's Update.exe which will do things for us like create shortcuts
     // Note that there's an Update.exe in the app-x.x.x directory and one in the parent
     // directory: we need to run the one in the parent directory, because it discovers
     // information about the app by inspecting the directory it's run from.
-    const updateExe = path.resolve(path.dirname(process.execPath), "..", "Update.exe");
+    const updateExe = getSquirrelExecutable();
     console.log(`Spawning '${updateExe}' with args '${args}'`);
     return new Promise((resolve) => {
         spawn(updateExe, args, {
@@ -39,7 +43,7 @@ function checkSquirrelHooks(): boolean {
 
     switch (cmd) {
         case "--squirrel-install":
-            runUpdateExe(["--createShortcut=" + target]).then(() => app.quit());
+            void runUpdateExe(["--createShortcut=" + target]).then(() => app.quit());
             return true;
 
         case "--squirrel-updated":
@@ -48,7 +52,7 @@ function checkSquirrelHooks(): boolean {
             return true;
 
         case "--squirrel-uninstall":
-            runUpdateExe(["--removeShortcut=" + target]).then(() => app.quit());
+            void runUpdateExe(["--removeShortcut=" + target]).then(() => app.quit());
             return true;
 
         default:

src/tray.ts

@@ -72,7 +72,9 @@ export function create(config: IConfig): void {
         guid = uuidv5(`${app.getName()}-${app.getPath("userData")}`, getUuid());
     }
 
-    trayIcon = new Tray(defaultIcon, guid);
+    // Passing guid=undefined on Windows will cause it to throw `Error: Invalid GUID format`
+    // The type here is wrong, the param must be omitted, never undefined.
+    trayIcon = guid ? new Tray(defaultIcon, guid) : new Tray(defaultIcon);
     trayIcon.setToolTip(config.brand);
     initApplicationMenu();
     trayIcon.on("click", toggleWin);

src/updater.ts

@@ -15,6 +15,9 @@ limitations under the License.
 */
 
 import { app, autoUpdater, ipcMain } from "electron";
+import fs from "node:fs/promises";
+
+import { getSquirrelExecutable } from "./squirrelhooks";
 
 const UPDATE_POLL_INTERVAL_MS = 60 * 60 * 1000;
 const INITIAL_UPDATE_DELAY_MS = 30 * 1000;
@@ -74,10 +77,12 @@ async function pollForUpdates(): Promise<void> {
     }
 }
 
-export function start(updateBaseUrl: string): void {
-    if (updateBaseUrl.slice(-1) !== "/") {
+export async function start(updateBaseUrl: string): Promise<void> {
+    if (!(await available(updateBaseUrl))) return;
+    if (!updateBaseUrl.endsWith("/")) {
         updateBaseUrl = updateBaseUrl + "/";
     }
+
     try {
         let url: string;
         let serverType: "json" | undefined;
@@ -93,7 +98,6 @@ export function start(updateBaseUrl: string): void {
             // Squirrel / electron only supports auto-update on these two platforms.
             // I'm not even going to try to guess which feed style they'd use if they
             // implemented it on Linux, or if it would be different again.
-            console.log("Auto update not supported on this platform");
             return;
         }
 
@@ -116,6 +120,26 @@ export function start(updateBaseUrl: string): void {
     }
 }
 
+async function available(updateBaseUrl?: string): Promise<boolean> {
+    if (process.platform === "linux") {
+        // Auto update is not supported on Linux
+        console.log("Auto update not supported on this platform");
+        return false;
+    }
+
+    if (process.platform === "win32") {
+        try {
+            await fs.access(getSquirrelExecutable());
+        } catch {
+            console.log("Squirrel not found, auto update not supported");
+            return false;
+        }
+    }
+
+    // Otherwise we're either on macOS or Windows with Squirrel
+    return !!updateBaseUrl;
+}
+
 ipcMain.on("install_update", installUpdate);
 ipcMain.on("check_updates", pollForUpdates);
 

src/utils.ts

@@ -15,6 +15,8 @@ limitations under the License.
 */
 
 import crypto from "crypto";
+import fs from "node:fs";
+import path from "node:path";
 
 export async function randomArray(size: number): Promise<string> {
     return new Promise((resolve, reject) => {
@@ -27,3 +29,20 @@ export async function randomArray(size: number): Promise<string> {
         });
     });
 }
+
+type JsonValue = null | string | number;
+type JsonArray = Array<JsonValue | JsonObject | JsonArray>;
+interface JsonObject {
+    [key: string]: JsonObject | JsonArray | JsonValue;
+}
+type Json = JsonArray | JsonObject;
+
+/**
+ * Synchronously load a JSON file from the local filesystem.
+ * Unlike `require`, will never execute any javascript in a loaded file.
+ * @param paths - An array of path segments which will be joined using the system's path delimiter.
+ */
+export function loadJsonFile<T extends Json>(...paths: string[]): T {
+    const file = fs.readFileSync(path.join(...paths), { encoding: "utf-8" });
+    return JSON.parse(file);
+}

src/vectormenu.ts

@@ -140,7 +140,7 @@ export function buildMenuTemplate(): Menu {
                     // XXX: vectorConfig won't have defaults applied to it so we need to duplicate them here
                     label: _t("common|brand_help", { brand: global.vectorConfig?.brand || "Element" }),
                     click(): void {
-                        shell.openExternal(global.vectorConfig?.help_url || "https://element.io/help");
+                        void shell.openExternal(global.vectorConfig?.help_url || "https://element.io/help");
                     },
                 },
             ],

src/webcontents-handler.ts

@@ -33,7 +33,7 @@ import {
 import url from "url";
 import fs from "fs";
 import fetch from "node-fetch";
-import { pipeline } from "stream";
+import { pipeline } from "stream/promises";
 import path from "path";
 
 import { _t } from "./language-helper";
@@ -53,7 +53,7 @@ function safeOpenURL(target: string): void {
         // so we know the url parser has understood all the parts
         // of the input string
         const newTarget = url.format(parsedUrl);
-        shell.openExternal(newTarget);
+        void shell.openExternal(newTarget);
     }
 }
 
@@ -165,11 +165,11 @@ function onLinkContextMenu(ev: Event, params: ContextMenuParams, webContents: We
                             const resp = await fetch(url);
                             if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
                             if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
-                            pipeline(resp.body, fs.createWriteStream(filePath));
+                            await pipeline(resp.body, fs.createWriteStream(filePath));
                         }
                     } catch (err) {
                         console.error(err);
-                        dialog.showMessageBox({
+                        void dialog.showMessageBox({
                             type: "error",
                             title: _t("right_click_menu|save_image_as_error_title"),
                             message: _t("right_click_menu|save_image_as_error_description"),
@@ -275,7 +275,7 @@ const userDownloadMap = new Map<number, string>(); // Map from id to path
 ipcMain.on("userDownloadAction", function (ev: IpcMainEvent, { id, open = false }) {
     const path = userDownloadMap.get(id);
     if (open && path) {
-        shell.openPath(path);
+        void shell.openPath(path);
     }
     userDownloadMap.delete(id);
 });

test/launch-test.ts

@@ -1,66 +0,0 @@
-/*
-Copyright 2022 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import * as os from "os";
-import * as fs from "fs";
-import * as path from "path";
-import "expect-playwright";
-import { _electron as electron } from "playwright";
-import { ElectronApplication, Page } from "playwright-core";
-
-describe("App launch", () => {
-    const artifactsPath = path.join(process.cwd(), "test_artifacts");
-    if (!fs.existsSync(artifactsPath)) fs.mkdirSync(artifactsPath);
-
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "element-desktop-tests"));
-    console.log("Using temp profile directory: ", tmpDir);
-
-    let app: ElectronApplication;
-    let window: Page;
-
-    beforeAll(async () => {
-        const args = ["--profile-dir", tmpDir];
-
-        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
-        if (!executablePath) {
-            // Unpackaged mode testing
-            args.unshift("./lib/electron-main.js");
-        }
-
-        app = await electron.launch({
-            executablePath,
-            args,
-            recordVideo: {
-                dir: artifactsPath,
-            },
-        });
-        window = await app.firstWindow();
-    }, 60000);
-
-    afterAll(async () => {
-        await app?.close().catch((e) => {
-            console.error(e);
-        });
-        fs.rmSync(tmpDir, { recursive: true });
-    }, 60000);
-
-    it("should launch and render the welcome view successfully", async () => {
-        await window.locator("#matrixchat").waitFor();
-        await window.locator(".mx_Welcome").waitFor();
-        await expect(window).toMatchURL("vector://vector/webapp/#/welcome");
-        await window.screenshot({ path: path.join(artifactsPath, "welcome.png") });
-    }, 60000);
-});

test/tsconfig.json

@@ -1,16 +0,0 @@
-{
-    "compilerOptions": {
-        "resolveJsonModule": true,
-        "moduleResolution": "node",
-        "esModuleInterop": true,
-        "target": "es2017",
-        "module": "commonjs",
-        "sourceMap": false,
-        "strict": true,
-        "lib": ["es2020", "dom"]
-    },
-    "include": ["./**/*.ts"],
-    "ts-node": {
-        "transpileOnly": true
-    }
-}

tsconfig.json

@@ -4,13 +4,13 @@
         "esModuleInterop": true,
         "module": "commonjs",
         "moduleResolution": "node",
-        "target": "es2016",
+        "target": "es2022",
         "sourceMap": false,
         "outDir": "./lib",
         "rootDir": "./src",
         "declaration": true,
         "typeRoots": ["src/@types", "node_modules/@types"],
-        "lib": ["es2020", "dom"],
+        "lib": ["es2022", "dom"],
         "types": ["node"],
         "strict": true
     },