From 9daa9068270cd7b84f57eaf3bab36447dbf9697c Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Thu, 24 Sep 2026 12:42:41 +0000 Subject: [PATCH] Take MarkSyncr from its release, not from Google's queue The bundled MarkSyncr came from the Chrome Web Store's published CRX, which tied this bundle to Google's review queue. A fix released upstream does not reach the published CRX until a reviewer approves it, so v3.15.0 shipped a vault import that had already been fixed. It is silent too: the build succeeds and nobody learns the bundled copy is behind until a user hits the old bug. Right now that gap is open again. MarkSyncr 0.8.42 carries a Bitwarden JSON import fix and 0.8.43 makes that import fast, and the store still serves 0.8.41 because 0.8.42 is in review and 0.8.43 is queued behind it. A TronBrowser release today would bundle the same 0.8.41 it already has. MarkSyncr now attaches its built ZIP to its GitHub release, so this prefers that: the same artifact, published the moment a version is tagged, with no third party in the path. The store stays as a fallback, because losing the bundled extension entirely would be worse than bundling an older one. The fetch also reports which version it got, and says when it came from the store and may therefore lag. Not knowing that is precisely how v3.15.0 went out. Verified with no release asset published yet: it falls back and prints "fetched MarkSyncr 0.8.41 (CWS ..., may lag behind the release)". Co-Authored-By: Claude Opus 5 (1M context) --- apps/desktop/scripts/build-release.sh | 56 ++++++++++++++++++++++----- 1 file changed, 46 insertions(+), 10 deletions(-) diff --git a/apps/desktop/scripts/build-release.sh b/apps/desktop/scripts/build-release.sh index 5991d06..a0cd6ae 100755 --- a/apps/desktop/scripts/build-release.sh +++ b/apps/desktop/scripts/build-release.sh @@ -14,20 +14,56 @@ DESKTOP="$REPO_ROOT/apps/desktop" OUT="$REPO_ROOT/dist" mkdir -p "$OUT" -# Fetch MarkSyncr ONCE from the Chrome Web Store (latest published CRX). Open -# source (github.com/profullstack/marksyncr.com), MV3 bookmark sync. Non-fatal. +# Fetch MarkSyncr ONCE. Open source (github.com/profullstack/marksyncr.com), +# MV3 bookmark sync. Non-fatal. +# +# Their GitHub release first, the Chrome Web Store second. +# +# The store was the only source, which tied this bundle to Google's review queue: +# a MarkSyncr fix does not reach the published CRX until a reviewer approves it, +# so v3.15.0 shipped a vault import that had already been fixed upstream. Worse, +# it is silent -- the build succeeds and nobody learns the bundled copy is months +# behind until a user hits the old bug. +# +# The release ZIP is the same artifact, published by us the moment a version is +# tagged. The store fallback stays because it is what worked before, and losing +# the bundled extension entirely would be worse than bundling an older one. MKS_ID="hjcjjcpialiakkalcgadnfnoomdaegjg" MKS_SRC="" + +# Unpack a MarkSyncr archive into MKS_SRC if it holds a manifest. +_try_marksyncr_archive() { + local archive="$1" label="$2" d + d="$(mktemp -d)" + # A CRX has a header before the zip, so unzip warns and exits 1 while still + # extracting correctly; don't gate on its exit code. A plain zip is fine too. + unzip -q -o "$archive" -d "$d" 2>/dev/null || true + local m; m="$(find "$d" -maxdepth 2 -name manifest.json | head -1)" + if [ -n "$m" ]; then + MKS_SRC="$(dirname "$m")" + local v; v="$(grep -o '"version"[[:space:]]*:[[:space:]]*"[^"]*"' "$m" | head -1 | sed 's/.*"\([^"]*\)"$/\1/')" + echo " + fetched MarkSyncr ${v:-?} ($label)" + return 0 + fi + return 1 +} + fetch_marksyncr() { - local url="https://clients2.google.com/service/update2/crx?response=redirect&acceptformat=crx2,crx3&prodversion=120.0.0.0&x=id%3D${MKS_ID}%26installsource%3Dondemand%26uc" - local z d m; z="$(mktemp)"; d="$(mktemp -d)" - if curl -fsSL -A "Mozilla/5.0 Chrome/120.0.0.0" "$url" -o "$z" 2>/dev/null; then - # CRX files have a header before the zip → unzip prints a warning and exits - # 1 even though it extracts fine; don't gate on its exit code. - unzip -q -o "$z" -d "$d" 2>/dev/null || true - m="$(find "$d" -maxdepth 2 -name manifest.json | head -1)" - if [ -n "$m" ]; then MKS_SRC="$(dirname "$m")"; echo " + fetched MarkSyncr (CWS $MKS_ID)"; fi + local z; z="$(mktemp)" + + # 1) Our own release: current the moment MarkSyncr is tagged. + local rel="https://github.com/profullstack/marksyncr.com/releases/latest/download/marksyncr-chrome.zip" + if curl -fsSL "$rel" -o "$z" 2>/dev/null && _try_marksyncr_archive "$z" "GitHub release"; then + rm -f "$z" + return fi + + # 2) The Chrome Web Store, which lags by however long review takes. + local cws="https://clients2.google.com/service/update2/crx?response=redirect&acceptformat=crx2,crx3&prodversion=120.0.0.0&x=id%3D${MKS_ID}%26installsource%3Dondemand%26uc" + if curl -fsSL -A "Mozilla/5.0 Chrome/120.0.0.0" "$cws" -o "$z" 2>/dev/null; then + _try_marksyncr_archive "$z" "CWS $MKS_ID, may lag behind the release" || true + fi + rm -f "$z" [ -n "$MKS_SRC" ] || echo " ! MarkSyncr fetch skipped (non-fatal)" }