fix: use renameSync instead of mv

[beyondkmp]

fix #8698

[changeset-bot]

🦋 Changeset detected

Latest commit: 43213ef

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
electron-updater	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[imconnorngl]

We desperately need this fix. Our Linux users are having to manually move the App images our auto updater downloads

[mmaietta]

This doesn't seem like it would work due to installerPath being a space-escaped string for piping to the cmd shell. Right?

If the platform is Linux, replace spaces with '\ ' for shell compatibility

electron-builder/packages/electron-updater/src/BaseUpdater.ts

Lines 52 to 60 in 6a6bed4

	// Get the installer path, ensuring spaces are escaped on Linux
	// 1. Check if downloadedUpdateHelper is not null
	// 2. Check if downloadedUpdateHelper.file is not null
	// 3. If both checks pass:
	// a. If the platform is Linux, replace spaces with '\ ' for shell compatibility
	// b. If the platform is not Linux, use the original path
	// 4. If any check fails, set installerPath to null
	const installerPath =
	downloadedUpdateHelper && downloadedUpdateHelper.file ? (process.platform === "linux" ? downloadedUpdateHelper.file.replace(/ /g, "\\ ") : downloadedUpdateHelper.file) : null

[beyondkmp]

Yes, I found that this was the cause, so I changed it to draft.

I don't think it's handled well here - it shouldn't directly add /. Instead, it should be handled by each deb/rpm/pacman separately.

These linux install commands use string concatenation, so if malicious code is added to the name, it could lead to serious security vulnerabilities.

electron-builder/packages/electron-updater/src/PacmanUpdater.ts

Lines 34 to 35 in 6a6bed4

	const cmd = ["pacman", "-U", "--noconfirm", options.installerPath]
	this.spawnSyncLog(sudo, [`${wrapper}/bin/bash`, "-c", `'${cmd.join(" ")}'${wrapper}`])

[mmaietta]

Just to double check, was this tested? (Same for pacman and Rpm)

Pretty sure this will fail as my previous project required piping it to bash