Unable to copy, file is symlinked outside the package

[kingyue737]

After I upgraded to v26, it throws error during build:

  • electron-builder  version=26.0.12 os=10.0.26100
  • loaded configuration  file=D:\Solutions\rho-meter\electron-builder.json
  • writing effective config  file=release\0.0.1\builder-effective-config.yaml
  • skipped dependencies rebuild  reason=npmRebuild is set to false
  • packaging       platform=win32 arch=x64 electron=35.1.5 appOutDir=release\0.0.1\win-unpacked
  • custom electronDist provided but no zip found; assuming unpacked electron directory.  electronDist=node_modules\electron\dist expectedFile=electron-v35.1.5-win32-x64.zip
  • copying Electron  source=D:\Solutions\rho-meter\node_modules\electron\dist destination=D:\Solutions\rho-meter\release\0.0.1\win-unpacked
  ⨯ unable to copy, file is symlinked outside the package  source=node_modules\@serialport\bindings-cpp\prebuilds\win32-x64\node.napi.node realPathFile=node_modules\.pnpm\@serialport+bindings-cpp@12.0.1\node_modules\@serialport\bindings-cpp\prebuilds\win32-x64\node.napi.node
  ⨯ unable to copy, file is symlinked outside the package  source=node_modules\@libsql\win32-x64-msvc\index.node realPathFile=node_modules\.pnpm\@libsql+win32-x64-msvc@0.5.4\node_modules\@libsql\win32-x64-msvc\index.node
  ⨯ Cannot cleanup: 

Error #1 --------------------------------------------------------------------------------
Error: Cannot copy file (node.napi.node) symlinked to file (node.napi.node) outside the package as that violates asar security integrity
    at writeFileOrProcessSymlink (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:126:15)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async Promise.all (index 2)
    at AsyncTaskManager.awaitTasks (D:\Solutions\rho-meter\node_modules\.pnpm\builder-util@26.0.11\node_modules\builder-util\src\asyncTaskManager.ts:65:25)     
    at AsarPackager.detectAndCopy (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:161:11)
    at AsarPackager.pack (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:48:44)
    at D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\platformPackager.ts:545:11
    at async Promise.all (index 0)
    at AsyncTaskManager.awaitTasks (D:\Solutions\rho-meter\node_modules\.pnpm\builder-util@26.0.11\node_modules\builder-util\src\asyncTaskManager.ts:65:25)     
    at WinPackager.doPack (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\platformPackager.ts:317:5)

Error #2 --------------------------------------------------------------------------------
Error: Cannot copy file (index.node) symlinked to file (index.node) outside the package as that violates asar security integrity
    at writeFileOrProcessSymlink (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:126:15)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async Promise.all (index 4)
    at AsyncTaskManager.awaitTasks (D:\Solutions\rho-meter\node_modules\.pnpm\builder-util@26.0.11\node_modules\builder-util\src\asyncTaskManager.ts:65:25)     
    at AsarPackager.detectAndCopy (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:161:11)
    at AsarPackager.pack (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\asar\asarUtil.ts:48:44)
    at D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\platformPackager.ts:545:11
    at async Promise.all (index 0)
    at AsyncTaskManager.awaitTasks (D:\Solutions\rho-meter\node_modules\.pnpm\builder-util@26.0.11\node_modules\builder-util\src\asyncTaskManager.ts:65:25)     
    at WinPackager.doPack (D:\Solutions\rho-meter\node_modules\.pnpm\app-builder-lib@26.0.12_dmg_b995bd80b8ff3a8a64cee8adb9a5f824\node_modules\app-builder-lib\src\platformPackager.ts:317:5)  failedTask=build stackTrace=Error: Cannot cleanup:

How do you think I could fix this? I'm using pnpm, thus the files in node_modules are all symlinks.

[kingyue737]

Related #8823

[beyondkmp]

If pnpm has set the node-linker, it will use npm list to obtain node modules. Previously, npm list did not apply realpathSync to paths, which caused this issue. After this PR(#9010 ), realpathSync will be applied to all node modules paths, fixing the problem.

electron-builder/packages/app-builder-lib/src/node-module-collector/nodeModulesCollector.ts

Line 111 in 8bd1a10

dir: this.resolvePath(p),

The latest electron-builder no longer requires setting node-linker. You can remove it, then delete node_modules, and reinstall. This might also resolve the issue you mentioned above.

[mmaietta]

Released v26.0.13

[kingyue737]

v26.0.13 still the same error:

• electron-builder  version=26.0.13 os=10.0.26100
  • loaded configuration  file=D:\Solutions\rho-meter\electron-builder.json
  • writing effective config  file=release\0.0.1\builder-effective-config.yaml
  • skipped dependencies rebuild  reason=npmRebuild is set to false
  • packaging       platform=win32 arch=x64 electron=35.1.5 appOutDir=release\0.0.1\win-unpacked
  • custom electronDist provided but no zip found; assuming unpacked electron directory.  electronDist=node_modules\electron\dist expectedFile=electron-v35.1.5-win32-x64.zip
  • copying Electron  source=D:\Solutions\rho-meter\node_modules\electron\dist destination=D:\Solutions\rho-meter\release\0.0.1\win-unpacked
  ⨯ unable to copy, file is symlinked outside the package  source=node_modules\@serialport\bindings-cpp\prebuilds\win32-x64\node.napi.node realPathFile=node_modules\.pnpm\@serialport+bindings-cpp@12.0.1\node_modules\@serialport\bindings-cpp\prebuilds\win32-x64\node.napi.node
  ⨯ unable to copy, file is symlinked outside the package  source=node_modules\@libsql\win32-x64-msvc\index.node realPathFile=node_modules\.pnpm\@libsql+win32-x64-msvc@0.5.5\node_modules\@libsql\win32-x64-msvc\index.node
  ⨯ Cannot cleanup: 

[kingyue737]

Here is my config, I copied node addons via files

{
  "$schema": "node_modules/app-builder-lib/scheme.json",
  "asar": true,
  "directories": {
    "output": "release/${version}",
    "buildResources": ".output/public"
  },
  "electronDist": "./node_modules/electron/dist",
  "files": [
    "dist-electron",
    ".output/**/*",
  ],
  "electronLanguages": ["zh-CN"],
  "win": {
    "signAndEditExecutable": false,
    "icon": ".output/public/favicon.ico",
    "files": [
      {
        "from": "node_modules/@serialport/bindings-cpp/prebuilds/win32-x64",
        "to": "prebuilds/win32-x64"
      },
      {
        "from": "node_modules/@libsql/win32-x64-msvc",
        "to": "node_modules/@libsql/win32-x64-msvc",
        "filter": ["!{CHANGELOG.md,README.md,README,readme.md,readme}"]
      }
    ],
    "extraFiles": [
      {
        "from": "drizzle",
        "to": "drizzle"
      },
      {
        "from": "templates",
        "to": "templates"
      }
    ],
    "target": [
      {
        "target": "nsis",
        "arch": ["x64"]
      }
    ]
  },
  "npmRebuild": false,
  "nsis": {
    "oneClick": false,
    "perMachine": false,
    "allowToChangeInstallationDirectory": true,
    "deleteAppDataOnUninstall": false,
    "differentialPackage": false
  }
}

[beyondkmp]

@kingyue737 Adding this check is to prevent some malicious packages from containing symbolic links to system files. I suggest replacing the file paths in "from" with real paths and avoid using symbolic links.

@mmaietta We should add some documentation to clarify that only real file paths can be used in "from," and symbolic links are not allowed.

[kingyue737]

But I'm using pnpm, most files and directories in node_modules with pnpm are symbolic links (or hard links) pointing to the global store. It seems that I cannot avoid using symbolic links.

Would you consider adding an option to turn off this symlink check?

[mmaietta]

Would you consider adding an option to turn off this symlink check?

The symlink check is enforced on the electron/asar side as well, so I think that'd be a no-go to exclude from our side, I just had wanted to provide a more specific error message
https://github.com/electron/asar/blob/e4fb057678562b7b6170699a046d983ae6d31cb8/src/filesystem.ts#L159-L169

    if (link.startsWith('..')) {
      throw new Error(`${p}: file "${link}" links out of the package`);
    }

[lyswhut]

For me, using this way makes it work:

"files": [
  //...
  {
    from: fs.realpathSync(path.join(__dirname, '../node_modules/better-sqlite3/build/Release')),
    to: 'dist/electron/native',
    filter: ['better_sqlite3.node'],
  }
],

[pelletier197]

I have the same issue as well. Is there a way to avoid this check altogether ? I don't feel it's necessary in my case

I am using the latest 26.0.15

[mmaietta]

You can't disable the check, ref: #9025 (comment) Something else smells fishy here though.

@lyswhut, can you share a minimum repro repo? Curious as to why realpathSync resolves the issue for you

[lyswhut]

@mmaietta I made a demo to reproduce it:

electron-builder-cp-file.patch

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..0cf6da2
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+node_modules
+build
+pnpm-lock.yaml
\ No newline at end of file
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..8d4e290
--- /dev/null
+++ b/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "electron-builder-cp-file",
+  "version": "1.0.0",
+  "scripts": {
+    "build": "pnpm -F app build"
+  },
+  "packageManager": "pnpm@10.10.0"
+}
diff --git a/packages/app/build.js b/packages/app/build.js
new file mode 100644
index 0000000..e511570
--- /dev/null
+++ b/packages/app/build.js
@@ -0,0 +1,27 @@
+const builder = require('electron-builder')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const build = async () => {
+  await builder.build({
+    dir: true,
+    config: {
+      appId: 'app.id',
+      productName: 'test',
+      directories: {
+        output: path.join(__dirname, 'build'),
+      },
+      files: [
+        '!node_modules/**/*',
+        {
+          // from: fs.realpathSync(path.join(__dirname, 'node_modules/better-sqlite3/build/Release')),
+          from: 'node_modules/better-sqlite3/build/Release',
+          to: 'dist/app/native',
+          filter: ['better_sqlite3.node'],
+        },
+      ],
+    },
+  })
+}
+
+build()
diff --git a/packages/app/index.js b/packages/app/index.js
new file mode 100644
index 0000000..57d2a94
--- /dev/null
+++ b/packages/app/index.js
@@ -0,0 +1 @@
+console.log('hello')
\ No newline at end of file
diff --git a/packages/app/package.json b/packages/app/package.json
new file mode 100644
index 0000000..024e9c3
--- /dev/null
+++ b/packages/app/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "app",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "build": "node build.js",
+    "postinstall": "electron-builder install-app-deps"
+  },
+  "dependencies": {
+    "better-sqlite3": "^11.10.0"
+  },
+  "devDependencies": {
+    "electron": "^36.2.0",
+    "electron-builder": "^26.0.15"
+  }
+}
\ No newline at end of file
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..18ec407
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+packages:
+  - 'packages/*'

you can create an empty folder and apply this patch,
then pnpm i, npm run build, you should encounter this problem, then edit the packages/app/build.js file:

          from: fs.realpathSync(path.join(__dirname, 'node_modules/better-sqlite3/build/Release')),
          // from: 'node_modules/better-sqlite3/build/Release',

Execute npm run build again

[kingyue737]

@lyswhut Thanks for sharing your solution! Those who use rollup/vite as the bundler can also use rollup-plugin-copy to copy and dereference the symlink. Then it can pass the check of electron-builder.

[mmaietta]

Yeah, this smells like a bug in electron-builder if realpathSync is resolving the issue for you. I'll need to take a deeper look when I can find some time but am traveling for the next week