Fetch newest `fpm` version + add arm64/aarch64

[mkurz]

Currently a very old fpm version will be fetched.
Also missing is an arm64/aarch64 binary.

See signalapp/Signal-Desktop#6063 (comment)

Code:

app-builder/pkg/download/tool.go

Lines 17 to 28 in 4e2aa6a

	if runtime.GOARCH == "amd64" {
	//noinspection SpellCheckingInspection
	checksum = "fcKdXPJSso3xFs5JyIJHG1TfHIRTGDP0xhSBGZl7pPZlz4/TJ4rD/q3wtO/uaBBYeX0qFFQAFjgu1uJ6HLHghA=="
	archSuffix = "-x86_64"
	} else {
	//noinspection SpellCheckingInspection
	checksum = "OnzvBdsHE5djcXcAT87rwbnZwS789ZAd2ehuIO42JWtBAHNzXKxV4o/24XFX5No4DJWGO2YSGQttW+zn7d/4rQ=="
	archSuffix = "-x86"
	}
	//noinspection SpellCheckingInspection
	name := "fpm-1.9.3-2.3.1-linux" + archSuffix

[mkurz]

@develar can you please also take a look at here? Thanks!

[develar]

That's not easy, as building FPM is very complicated. We build a special version of FPM, where Ruby installation is not required.

[mkurz]

Hmm.. but it would be good at some point to upgrade to latest FPM...

[develar]

You can install newest FPM and then set env USE_SYSTEM_FPM=true as a workaround.

[mkurz]

Yes, but would be nice to avoid this workaround and have it work out of the box, I think this would also help build Signal, since they do not have fpm set up on their build machine as it seems.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[mkurz]

asdf

[AviVahl]

Currently used version (fpm-1.9.3-2.3.1-linux) is broken when trying to build RPMs on Fedora 41. Need to use latest fpm v1.16.0 to get their fix.

Any chance of re-looking into this one?

I've worked around by installing latest fpm using ruby's gem and setting the USE_SYSTEM_FPM environment variable as instructed. It works, but makes prerequisites much more complicated.

If you can find a way to create a newer fpm distributable that works without requiring Ruby it would simplify downstream flows a lot.

EDIT: btw, that's what we deserve for writing TypeScript code, that compiles to JavaScript (electron-builder), that executes Go (app-builder), which executes Ruby (fpm), that executes C++ (rpmbuild) ;)

[mmaietta]

Since the files are being served from electron-builder-binaries, it's highly highly unlikely anything will be pushed there from a community contribution/PR due to security risks to prevent a Supply Chain Compromise. The repo is unmaintained, and its release process is bewildering at best, so there's not much help I think I can provide here

btw, that's what we deserve for writing TypeScript code, that compiles to JavaScript (electron-builder), that executes Go (app-builder), which executes Ruby (fpm), that executes C++ (rpmbuild) ;)

Yeahhhh, it's an unfortunate sequence. Happy to accept feedback/ideas for electron-builder side of affairs since I'm the core maintainer of that project 🙂

[emlowe]

Just to point out as I was looking today that electron-builder-binaries now includes fpm 1.16.0 with arm binaries (https://github.com/electron-userland/electron-builder-binaries/releases) has fpm 1.16.0 with arm64 and arm64v8 binaries.

[t3chguy]

@emlowe good spot, empirically this does seem to work for both arm64 & including the recent upstream fpm fix for hardlinks: https://github.com/element-hq/element-desktop/actions/runs/18840810656?pr=2661

[mmaietta]

@emlowe Yes! I actually was able to acquire maintainer permissions for the repo. It feels like it took ages to get a portable fpm/ruby bundle into a distributable state with proper monorepo and security processes put in place on the overall electron-builder-binaries. Now it also utilizes Trusted Signing and GitHub Artifact Attestation, and leverages socket.dev for dependency chain monitoring.

That all being said, this app-builder project is still unmaintained and also has not migrated to NPM Trusted Signing publishing, which I don't think I can accomplish on my side (in this repo) without @develar taking over that migration.