fix: prevent x64 build from producing arm64 packages with wrong native modules

The linux target config specified arch: ['x64', 'arm64'] for each format,
causing the x64 build job to also produce arm64 packages. These packages
contained x86-64 native modules (node-pty, serialport) since the x64 job
only rebuilds for x64. When artifacts were merged in the release job,
the incorrect arm64 deb from the x64 build could overwrite the correct
one from the arm64 build.

Remove arch from linux target config so the CLI flags (--x64/--arm64)
control which architecture is built per job.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/build.yml

@@ -93,6 +93,8 @@ jobs:
     name: build-linux-x64
     runs-on: ubuntu-22.04
     env:
+      npm_config_arch: x64
+      npm_config_target_arch: x64
       VITE_SYNC_GITHUB_CLIENT_ID: ${{ secrets.VITE_SYNC_GITHUB_CLIENT_ID }}
       VITE_SYNC_GOOGLE_CLIENT_ID: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_ID }}
       VITE_SYNC_GOOGLE_CLIENT_SECRET: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_SECRET }}
@@ -122,16 +124,22 @@ jobs:
           npm pkg set version="${VERSION}"
 
       - name: Prepare node-pty Linux runtime
+        env:
+          npm_config_arch: x64
         run: bash scripts/ensure-node-pty-linux.sh prepare x64
 
       - name: Build package
         env:
+          npm_config_arch: x64
           ELECTRON_BUILDER_PUBLISH: "never"
         run: npm run pack:linux-x64
 
       - name: Verify packaged node-pty Linux runtime
         run: bash scripts/ensure-node-pty-linux.sh verify x64
 
+      - name: Verify packaged deb artifact
+        run: bash scripts/verify-linux-deb-artifact.sh amd64
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -153,6 +161,8 @@ jobs:
     container:
       image: debian:bullseye
     env:
+      npm_config_arch: arm64
+      npm_config_target_arch: arm64
       VITE_SYNC_GITHUB_CLIENT_ID: ${{ secrets.VITE_SYNC_GITHUB_CLIENT_ID }}
       VITE_SYNC_GOOGLE_CLIENT_ID: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_ID }}
       VITE_SYNC_GOOGLE_CLIENT_SECRET: ${{ secrets.VITE_SYNC_GOOGLE_CLIENT_SECRET }}
@@ -198,6 +208,9 @@ jobs:
       - name: Verify packaged node-pty Linux runtime
         run: bash scripts/ensure-node-pty-linux.sh verify arm64
 
+      - name: Verify packaged deb artifact
+        run: bash scripts/verify-linux-deb-artifact.sh arm64
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -230,6 +243,20 @@ jobs:
       - name: List artifacts
         run: ls -la artifacts/
 
+      - name: Verify downloaded Linux amd64 deb artifact
+        run: |
+          deb_file="$(find artifacts -maxdepth 1 -type f -name '*-linux-amd64.deb' -print | sort | head -n 1)"
+          test -n "${deb_file}"
+          bash scripts/verify-linux-deb-artifact.sh amd64 "${deb_file}"
+
+      - name: Verify downloaded Linux arm64 deb artifact metadata
+        env:
+          VERIFY_LOAD: "0"
+        run: |
+          deb_file="$(find artifacts -maxdepth 1 -type f -name '*-linux-arm64.deb' -print | sort | head -n 1)"
+          test -n "${deb_file}"
+          bash scripts/verify-linux-deb-artifact.sh arm64 "${deb_file}"
+
       - name: Generate Release Body
         run: node .github/scripts/generate-release-note.js
         env:

electron-builder.config.cjs

@@ -6,6 +6,7 @@ module.exports = {
     productName: 'Netcatty',
     artifactName: '${productName}-${version}-${os}-${arch}.${ext}',
     icon: 'public/icon.png',
+    npmRebuild: false,
     directories: {
         buildResources: 'build',
         output: 'release'
@@ -90,20 +91,7 @@ module.exports = {
         shortcutName: 'Netcatty'
     },
     linux: {
-        target: [
-            {
-                target: 'AppImage',
-                arch: ['x64', 'arm64']
-            },
-            {
-                target: 'deb',
-                arch: ['x64', 'arm64']
-            },
-            {
-                target: 'rpm',
-                arch: ['x64', 'arm64']
-            }
-        ],
+        target: ['AppImage', 'deb', 'rpm'],
         category: 'Development'
     },
     deb: {

scripts/ensure-node-pty-linux.sh

@@ -53,22 +53,43 @@ assert_loadable_native_module() {
   ' "${file}"
 }
 
+resolve_serialport_prebuild() {
+  local root="$1"
+  local arch="$2"
+  local file
+
+  file="$(find "${root}/prebuilds/linux-${arch}" -maxdepth 1 -type f -name '@serialport+bindings-cpp*.glibc.node' -print | sort | head -n 1)"
+  if [[ -z "${file}" ]]; then
+    echo "[node-pty] serialport glibc prebuild not found for linux-${arch}" >&2
+    exit 1
+  fi
+
+  echo "${file}"
+}
+
 prepare() {
   local arch="$1"
   local root="node_modules/node-pty"
   local release_dir="${root}/build/Release"
   local prebuild_dir="${root}/prebuilds/linux-${arch}"
+  local serialport_root="node_modules/@serialport/bindings-cpp"
+  local serialport_release_dir="${serialport_root}/build/Release"
+  local serialport_prebuild
 
   echo "[node-pty] rebuilding native modules for Electron on linux-${arch}"
   log_electron_runtime_info
-  npx electron-rebuild
+  rm -rf "${release_dir}" "${prebuild_dir}" "${serialport_release_dir}"
+  npx electron-rebuild --force --arch "${arch}" -w "node-pty,@serialport/bindings-cpp"
 
   test -f "${release_dir}/pty.node"
+  test -f "${serialport_release_dir}/bindings.node"
 
   echo "[node-pty] built Linux runtime artifacts:"
   log_file_info "${release_dir}/pty.node"
   log_optional_spawn_helper "${release_dir}/spawn-helper"
   assert_loadable_native_module "${release_dir}/pty.node"
+  log_file_info "${serialport_release_dir}/bindings.node"
+  assert_loadable_native_module "${serialport_release_dir}/bindings.node"
 
   mkdir -p "${prebuild_dir}"
   cp "${release_dir}/pty.node" "${prebuild_dir}/pty.node"
@@ -79,17 +100,26 @@ prepare() {
   echo "[node-pty] mirrored Linux runtime artifacts into ${prebuild_dir}:"
   log_file_info "${prebuild_dir}/pty.node"
   log_optional_spawn_helper "${prebuild_dir}/spawn-helper"
+
+  serialport_prebuild="$(resolve_serialport_prebuild "${serialport_root}" "${arch}")"
+  echo "[node-pty] serialport packaged prebuild candidate:"
+  log_file_info "${serialport_prebuild}"
+  assert_loadable_native_module "${serialport_prebuild}"
 }
 
 verify() {
   local arch="$1"
   local release_dir
   local prebuild_dir
+  local serialport_release_file
+  local serialport_prebuild_file
 
   log_electron_runtime_info
 
   release_dir="$(find release -type d -path "*/resources/app.asar.unpacked/node_modules/node-pty/build/Release" -print -quit)"
   prebuild_dir="$(find release -type d -path "*/resources/app.asar.unpacked/node_modules/node-pty/prebuilds/linux-${arch}" -print -quit)"
+  serialport_release_file="$(find release -type f -path "*/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/build/Release/bindings.node" -print -quit)"
+  serialport_prebuild_file="$(find release -type f -path "*/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/prebuilds/linux-${arch}/@serialport+bindings-cpp*.glibc.node" -print | sort | head -n 1)"
 
   if [[ -z "${release_dir}" ]]; then
     echo "[node-pty] packaged build/Release directory not found under release/" >&2
@@ -101,6 +131,16 @@ verify() {
     exit 1
   fi
 
+  if [[ -z "${serialport_release_file}" ]]; then
+    echo "[node-pty] packaged serialport build/Release binding not found under release/" >&2
+    exit 1
+  fi
+
+  if [[ -z "${serialport_prebuild_file}" ]]; then
+    echo "[node-pty] packaged serialport glibc prebuild not found for linux-${arch} under release/" >&2
+    exit 1
+  fi
+
   test -f "${release_dir}/pty.node"
   test -f "${prebuild_dir}/pty.node"
 
@@ -114,10 +154,22 @@ verify() {
   log_optional_spawn_helper "${prebuild_dir}/spawn-helper"
   assert_loadable_native_module "${prebuild_dir}/pty.node"
 
+  echo "[node-pty] packaged serialport build/Release artifact:"
+  log_file_info "${serialport_release_file}"
+  assert_loadable_native_module "${serialport_release_file}"
+
+  echo "[node-pty] packaged serialport prebuild artifact:"
+  log_file_info "${serialport_prebuild_file}"
+  assert_loadable_native_module "${serialport_prebuild_file}"
+
   echo "[node-pty] packaged artifact locations:"
   find release -path "*/resources/app.asar.unpacked/node_modules/node-pty/*" \
     \( -name 'pty.node' -o -name 'spawn-helper' \) \
     -print | sort
+
+  find release -path "*/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp/*" \
+    \( -name 'bindings.node' -o -name '@serialport+bindings-cpp*.node' \) \
+    -print | sort
 }
 
 main() {

scripts/verify-linux-deb-artifact.sh

@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+TEMP_DIR=""
+
+usage() {
+  echo "Usage: $0 <amd64|arm64> [deb-file]" >&2
+  exit 1
+}
+
+checksum() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$@"
+  else
+    shasum -a 256 "$@"
+  fi
+}
+
+require_cmd() {
+  local cmd="$1"
+  command -v "${cmd}" >/dev/null 2>&1 || {
+    echo "[deb-verify] missing required command: ${cmd}" >&2
+    exit 1
+  }
+}
+
+assert_exists() {
+  local file="$1"
+  if [[ ! -e "${file}" ]]; then
+    echo "[deb-verify] expected file does not exist: ${file}" >&2
+    exit 1
+  fi
+}
+
+assert_executable() {
+  local file="$1"
+  if [[ ! -x "${file}" ]]; then
+    echo "[deb-verify] expected executable file is missing or not executable: ${file}" >&2
+    exit 1
+  fi
+}
+
+log_file_info() {
+  local file="$1"
+  echo "[deb-verify] file: ${file}"
+  ls -lh "${file}"
+  file "${file}"
+  checksum "${file}"
+}
+
+assert_file_arch() {
+  local file="$1"
+  local expected="$2"
+  local info
+
+  info="$(file "${file}")"
+  echo "[deb-verify] arch-check: ${info}"
+  if [[ "${info}" != *"${expected}"* ]]; then
+    echo "[deb-verify] unexpected architecture for ${file}" >&2
+    echo "[deb-verify] expected substring: ${expected}" >&2
+    exit 1
+  fi
+}
+
+assert_loadable_native_module() {
+  local electron_bin="$1"
+  local native_module="$2"
+
+  if [[ "${VERIFY_LOAD:-1}" != "1" ]]; then
+    echo "[deb-verify] skipping native module load check for ${native_module} (VERIFY_LOAD=${VERIFY_LOAD:-1})"
+    return
+  fi
+
+  echo "[deb-verify] loading native module with packaged Electron runtime: ${native_module}"
+  ELECTRON_RUN_AS_NODE=1 "${electron_bin}" -e '
+    const path = require("node:path");
+    require(path.resolve(process.argv[1]));
+    console.log("[deb-verify] native module loaded successfully");
+  ' "${native_module}"
+}
+
+resolve_file_from_glob() {
+  local search_dir="$1"
+  local pattern="$2"
+  find "${search_dir}" -maxdepth 1 -type f -name "${pattern}" -print | sort | head -n 1
+}
+
+resolve_single_file() {
+  local search_dir="$1"
+  local pattern="$2"
+  local file
+
+  file="$(resolve_file_from_glob "${search_dir}" "${pattern}")"
+  if [[ -z "${file}" ]]; then
+    echo "[deb-verify] no file matched ${pattern} under ${search_dir}" >&2
+    exit 1
+  fi
+
+  echo "${file}"
+}
+
+resolve_serialport_prebuild() {
+  local root="$1"
+  local arch="$2"
+  local prebuild_dir="${root}/prebuilds/linux-${arch}"
+  local file
+
+  file="$(find "${prebuild_dir}" -maxdepth 1 -type f -name '@serialport+bindings-cpp*.glibc.node' -print | sort | head -n 1)"
+  if [[ -z "${file}" ]]; then
+    echo "[deb-verify] serialport glibc prebuild not found under ${prebuild_dir}" >&2
+    exit 1
+  fi
+
+  echo "${file}"
+}
+
+verify_native_module() {
+  local label="$1"
+  local electron_bin="$2"
+  local file="$3"
+  local expected_machine="$4"
+
+  assert_exists "${file}"
+  echo "[deb-verify] verifying ${label}"
+  log_file_info "${file}"
+  assert_file_arch "${file}" "${expected_machine}"
+  assert_loadable_native_module "${electron_bin}" "${file}"
+}
+
+main() {
+  if [[ $# -lt 1 || $# -gt 2 ]]; then
+    usage
+  fi
+
+  local deb_arch="$1"
+  local prebuild_arch
+  local expected_machine
+  local deb_file
+  local control_arch
+  local electron_bin
+  local main_binary
+  local build_release_pty
+  local prebuild_pty
+  local serialport_root
+  local build_release_serialport
+  local prebuild_serialport
+
+  require_cmd dpkg-deb
+  require_cmd file
+
+  case "${deb_arch}" in
+    amd64)
+      prebuild_arch="x64"
+      expected_machine="x86-64"
+      ;;
+    arm64)
+      prebuild_arch="arm64"
+      expected_machine="ARM aarch64"
+      ;;
+    *)
+      usage
+      ;;
+  esac
+
+  if [[ $# -eq 2 ]]; then
+    deb_file="$2"
+    assert_exists "${deb_file}"
+  else
+    deb_file="$(resolve_single_file "release" "*-linux-${deb_arch}.deb")"
+  fi
+
+  echo "[deb-verify] verifying deb artifact: ${deb_file}"
+  log_file_info "${deb_file}"
+
+  control_arch="$(dpkg-deb -f "${deb_file}" Architecture)"
+  echo "[deb-verify] control architecture: ${control_arch}"
+  if [[ "${control_arch}" != "${deb_arch}" ]]; then
+    echo "[deb-verify] deb control architecture mismatch: expected ${deb_arch}, got ${control_arch}" >&2
+    exit 1
+  fi
+
+  TEMP_DIR="$(mktemp -d)"
+  trap 'rm -rf "${TEMP_DIR:-}"' EXIT
+  dpkg-deb -x "${deb_file}" "${TEMP_DIR}"
+
+  electron_bin="${TEMP_DIR}/opt/Netcatty/netcatty"
+  main_binary="${TEMP_DIR}/opt/Netcatty/netcatty"
+  build_release_pty="${TEMP_DIR}/opt/Netcatty/resources/app.asar.unpacked/node_modules/node-pty/build/Release/pty.node"
+  prebuild_pty="${TEMP_DIR}/opt/Netcatty/resources/app.asar.unpacked/node_modules/node-pty/prebuilds/linux-${prebuild_arch}/pty.node"
+  serialport_root="${TEMP_DIR}/opt/Netcatty/resources/app.asar.unpacked/node_modules/@serialport/bindings-cpp"
+  build_release_serialport="${serialport_root}/build/Release/bindings.node"
+  prebuild_serialport="$(resolve_serialport_prebuild "${serialport_root}" "${prebuild_arch}")"
+
+  assert_executable "${electron_bin}"
+
+  echo "[deb-verify] verifying packaged binary architectures"
+  log_file_info "${main_binary}"
+  assert_file_arch "${main_binary}" "${expected_machine}"
+  verify_native_module "node-pty build/Release" "${electron_bin}" "${build_release_pty}" "${expected_machine}"
+  verify_native_module "node-pty prebuild" "${electron_bin}" "${prebuild_pty}" "${expected_machine}"
+  verify_native_module "serialport build/Release" "${electron_bin}" "${build_release_serialport}" "${expected_machine}"
+  verify_native_module "serialport glibc prebuild" "${electron_bin}" "${prebuild_serialport}" "${expected_machine}"
+
+  echo "[deb-verify] deb artifact verification passed for ${deb_file}"
+}
+
+main "$@"