fix(snap): migrate snap to core24 to fix launch on modern Linux

The Linux snap failed to launch on modern systems: native modules built on the
ubuntu-24.04 CI runner (glibc 2.39) couldn't load on the core20 base (glibc 2.31)
-> "libm.so.6: version GLIBC_2.38 not found" loading better_sqlite3.node. The old
gnome-3-28-1804 platform also lacked a working GPU driver for current hardware.

Migrate the snap to base core24 via electron-builder's `snapcraft.core24`:
- base core24 -> glibc 2.39, matching the build toolchain (fixes the fatal load)
- GNOME extension (default) -> gnome-46-2404 + mesa-2404/gpu-2404 (modern GPU)
- XDG_SESSION_TYPE=x11 -> forces XWayland, restoring the old allowNativeWayland:false
  behavior (Electron 40 removed ELECTRON_OZONE_PLATFORM_HINT and snapcraft core24
  rejects '=' in an app command, so this env var is the supported mechanism)
- plain browser-support plug -> auto-connects on install (snapd only blocks
  auto-connect for allow-sandbox:true); electron-builder adds --no-sandbox itself
- network / home / password-manager-service plugs preserved

CI: core24 builds via the snapcraft CLI in an LXD container, so the x64 Linux job
installs snapcraft + lxd, grants the LXD socket, and allows iptables FORWARD (the
runner's Docker sets it to DROP, blocking the build container's network). Gated to
runs where the snap target is actually built.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: valkirilov

.github/workflows/pipeline-build-linux.yml

@@ -119,6 +119,31 @@ jobs:
           sudo apt-get install -qy ruby ruby-dev build-essential
           sudo gem install --no-document fpm
 
+      # The snap target builds on core24 via snapcraft + the GNOME extension,
+      # which requires an isolated build environment (LXD). x64 only — snap is x64.
+      - name: Install snapcraft + LXD (for core24 snap build)
+        if: >-
+          matrix.arch == 'x64'
+          && steps.resolve-targets.outputs.should_build == 'true'
+          && (steps.resolve-targets.outputs.mode == 'default'
+              || contains(steps.resolve-targets.outputs.custom_targets, 'snap'))
+        run: |
+          sudo snap install snapcraft --classic
+          sudo snap install lxd
+          sudo lxd waitready --timeout=60
+          sudo lxd init --auto
+          sudo usermod -aG lxd "$USER"
+          # The build step runs in a shell started before the group change, so the
+          # new 'lxd' group isn't active there and snapcraft's pylxd can't reach the
+          # socket ("LXD requires additional permissions"). Grant the socket directly
+          # so snapcraft can connect without a re-login.
+          sudo chmod 0666 /var/snap/lxd/common/lxd/unix.socket
+          # GitHub runners run Docker, which sets the iptables FORWARD policy to DROP.
+          # That blocks the LXD bridge's NAT traffic, so the snapcraft build container
+          # has no internet ("A network related operation failed..."). Allow forwarding
+          # so the container can fetch the base, GNOME extension, and stage-packages.
+          sudo iptables -P FORWARD ACCEPT
+
       - name: Build linux packages (production)
         if: vars.ENV == 'production' && steps.resolve-targets.outputs.mode == 'default'
         run: yarn package:prod --linux ${{ matrix.defaultTargets }}

electron-builder.json

@@ -136,11 +136,22 @@
   "rpm": {
     "fpm": ["--rpm-digest", "sha256"]
   },
-  "snap": {
-    "plugs": ["default", "password-manager-service"],
-    "confinement": "strict",
-    "stagePackages": ["default"],
-    "allowNativeWayland": false
+  "snapcraft": {
+    "base": "core24",
+    "core24": {
+      "confinement": "strict",
+      "useLXD": true,
+      "stagePackages": ["default"],
+      "environment": {
+        "XDG_SESSION_TYPE": "x11"
+      },
+      "plugs": [
+        "network",
+        "home",
+        "password-manager-service",
+        "browser-support"
+      ]
+    }
   },
   "flatpak": {
     "runtimeVersion": "20.08",