Arch Linux User Repository

It run again

I have updated the pkgbuild to v0.6.4.1 in my repo but it fails to launch https://github.com/FabioLolix/PKGBUILD-AUR_fix/tree/master/t/thrive-bin

I've removed myself as the maintainer from this package as I never really did anything (I was added as a maintainer as I'm one of the Thrive developers) and I just noticed I had become the last listed maintainer. This package is now fully without a maintainer.

since this is installing a prebuilt binary shouldn't the package be named thrive-bin?

With this package, it is not convenient to launch Thrive from the terminal. Consider adding operation like:

ln -s /opt/thrive/Thrive -T "$pkgdir/usr/bin/thrive"

The hash is incorrect and must be updated.

I could only install the pkg after updating the hash file to 5c75ca15827af5337f11c9ac54078921ff7f09014a4e0367a7415e1b7f82e44e.

Actually There is not issue with the chrome sandbox itself. It's related to the User Namespace being disabled on arch. I used the command as stated here. https://github.com/Revolutionary-Games/Thrive/issues/749#issuecomment-489430284

BTW, I think it might be time to update the package if the chrome sandbox issue is now cleared.

Hi, I'm one of the Thrive developers and responsible for the provided Linux packages.

Recently an issue was opened concerning the "chrome-sandbox" binary: https://github.com/Revolutionary-Games/Thrive/issues/749 and this package was linked there. I'll reiterate some of my points here (and I ended up writing more info here, that I'll copy there).

The game uses Chromium Embedded Framework for the GUI. They recommend that the GUI content process is sandboxed (like in chrome) to prevent loaded web content from exploiting bugs in chromium to escape the browser process and do malicious things to the computer. Currently the game has no web content loaded in it but in the future we might want to show something like a wiki or help forums inside the game which is only partly controlled by us and could contain for example malicious JavaScript meant to exploit chrome. So the chrome-sandbox binary is part of CEF and distributed with the game. Slightly offtopic note is that on Windows due to the MD MT flag craziness the sandbox is not used.

In the packaged version the chrome-sandbox binary is included, but it is not even marked executable as that is the way the CEF library creates it when compiling. On my system (Fedora 28) this works just fine. I think this might be as I have chrome installed and have chrome-sandbox owned by root with permissions "-rwsr-xr-x." installed in opt/google/chrome/chrome-sandbox. When I deleted the chrome-sandbox binary from Thrive-0.4.0.2-LINUX-generic/bin the game still ran fine leading me to believe that that binary must be installed system wide in a location that CEF looks for. And the packaged binary is currently not needed / it needs to be installed with the correct permissions. As a fix for running the game I think the "--no-sandbox" flag should allow the game to start without a proper chrome-sandbox binary. Suggestions as to how to solve this and pull requests are welcome.

I've been planning on switching away from CEF but that won't be happening soon. And I'd like to keep the possibility of having web content in the game in the future as well, which might work with servo if that becomes usable as an embedded browser.

For reference, here's my current PKGBUILD (some dependencies are not necessary anymore).

THIS PKGBUILD MAY BE DANGEROUS!

# Maintainer: Sebastien Duthil <duthils@duthils.net>
# Contributor: Pol Marcet Sardà <polmarcetsarda@gmail.com>

pkgname=thrive
pkgver=0.4.0.2
pkgrel=1
pkgdesc="Game about evolution, in which the player guides a species from their origin as a microbe to the space age and beyond. "                                                                                  
arch=('i686' 'x86_64')
url="http://revolutionarygamesstudio.com"
license=('GPL')
depends=()
makedepends=('p7zip')
source=(https://github.com/Revolutionary-Games/Thrive/releases/download/v${pkgver}/Thrive-${pkgver}-LINUX-generic.7z                                                                                               
        thrive.sh)
sha256sums=('060b653fb466644452594c00d72103e743699032ba03a63df430d606cea666ec'
            'd4ffae8d96c0a2e2f23a281053a6d5817f964668556e770c2b62574d86c74ce7')
_Pkgname=Thrive

package() {
  cd "$srcdir/Thrive-${pkgver}-LINUX-generic"

  mkdir -p "$pkgdir/opt/thrive"
  cp -r * "$pkgdir/opt/thrive"
  chgrp -R games "$pkgdir/opt/thrive"
  chmod -R g+w "$pkgdir/opt/thrive"
  chmod ugo+x /opt/thrive/bin/chrome-sandbox
  chmod u+s /opt/thrive/bin/chrome-sandbox
  install -Dm755 "$srcdir/thrive.sh" "$pkgdir/usr/bin/thrive"
}

Thanks Pol_M for the patch :)

I had to run the following commands to package() to make it work:

chmod ugo+x /opt/thrive/bin/chrome-sandbox
chmod u+s /opt/thrive/bin/chrome-sandbox  # THIS IS DANGEROUS!

The game complained about permissions of this binary, saying it should have 4755 permissions, SUID and owned by root. However, I don't understand why the games wants to give SUID to this root-owned binary. No game should have to run as root... I found no reference to "chrome-sandbox" in the code and that worries me a lot.

As long as I don't understand why or how to avoid it I will not update the package.