guix_mirror_bot pushed a commit to branch core-packages-team in repository guix.
commit e0dc77ba81ae4bc34d2c7be993a5b7929e751a99 Author: Sergio Pastor Pérez <[email protected]> AuthorDate: Mon Mar 16 17:28:21 2026 +0100 build-systems/gnu: Make desktop files executable. Program launchers such as Plasma's expect desktop files to be either owned by root or executable, this is a security measure since any exec line in a desktop file essentially makes the file as dangerous as an executable file. For more information, read the discussion on: https://codeberg.org/guix/guix/issues/1578 * guix/build/gnu-build-system.scm (patch-dot-desktop-files): Set executable permissions for desktop files Fixes: guix/guix#1578 Change-Id: I5f2d68290db8517a9a038bad029860f2a45736b6 --- guix/build/gnu-build-system.scm | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/guix/build/gnu-build-system.scm b/guix/build/gnu-build-system.scm index cf5fa53630..123a88e8e2 100644 --- a/guix/build/gnu-build-system.scm +++ b/guix/build/gnu-build-system.scm @@ -3,6 +3,7 @@ ;;; Copyright © 2018 Mark H Weaver <[email protected]> ;;; Copyright © 2020 Brendan Tildesley <[email protected]> ;;; Copyright © 2021, 2022 Maxim Cournoyer <[email protected]> +;;; Copyright © 2026 Sergio Pastor Pérez <[email protected]> ;;; ;;; This file is part of GNU Guix. ;;; @@ -770,7 +771,7 @@ MAN-COMPRESSOR, using MAN-COMPRESSOR-FLAGS." (define* (patch-dot-desktop-files #:key outputs inputs #:allow-other-keys) "Replace any references to executables in '.desktop' files with their -absolute file names." +absolute file names and set executable permissions." (define bin-directories (append-map (match-lambda ((_ . directory) @@ -804,7 +805,16 @@ which cannot be found~%" (string-append "Exec=" (which binary) rest)) (("^TryExec=([^/[:blank:]\r\n]+)(.*)$" _ binary rest) (string-append "TryExec=" - (which binary) rest))))))))) + (which binary) rest)))) + ;; Program launchers such as Plasma's expect desktop + ;; files to be either owned by root or executable, this + ;; is a security measure since any exec line in a + ;; desktop file essentially makes the file as dangerous as + ;; an executable file. + ;; + ;; For more information, read the discussion on: + ;; https://codeberg.org/guix/guix/issues/1578 + (for-each make-file-executable files)))))) outputs)) (define* (make-dynamic-linker-cache #:key outputs
