chore: add srt sandbox dependencies to deb and rpm (#297819)

* chore: add srt sandbox dependencies to deb and rpm

* fix: move the depedency to recommends

build/gulpfile.vscode.linux.ts

@@ -15,6 +15,7 @@ import packageJson from '../package.json' with { type: 'json' };
 import product from '../product.json' with { type: 'json' };
 import { getDependencies } from './linux/dependencies-generator.ts';
 import { recommendedDeps as debianRecommendedDependencies } from './linux/debian/dep-lists.ts';
+import { recommendedDeps as rpmRecommendedDependencies } from './linux/rpm/dep-lists.ts';
 import * as path from 'path';
 import * as cp from 'child_process';
 import { promisify } from 'util';
@@ -202,6 +203,7 @@ function prepareRpmPackage(arch: string) {
 			.pipe(replace('@@QUALITY@@', (product as typeof product & { quality?: string }).quality || '@@QUALITY@@'))
 			.pipe(replace('@@UPDATEURL@@', (product as typeof product & { updateUrl?: string }).updateUrl || '@@UPDATEURL@@'))
 			.pipe(replace('@@DEPENDENCIES@@', dependencies.join(', ')))
+			.pipe(replace('@@RECOMMENDS@@', rpmRecommendedDependencies.join(', ')))
 			.pipe(replace('@@STRIP@@', stripBinary))
 			.pipe(rename('SPECS/' + product.applicationName + '.spec'));
 

build/linux/debian/dep-lists.ts

@@ -17,7 +17,9 @@ export const additionalDeps = [
 // Dependencies that we can only recommend
 // for now since some of the older distros don't support them.
 export const recommendedDeps = [
-	'libvulkan1' // Move to additionalDeps once support for Trusty and Jessie are dropped.
+	'libvulkan1', // Move to additionalDeps once support for Trusty and Jessie are dropped.
+	'bubblewrap', // agent command sandboxing
+	'socat', // agent command sandboxing
 ];
 
 export const referenceGeneratedDepsByArch = {

build/linux/rpm/dep-lists.ts

@@ -13,7 +13,12 @@ export const additionalDeps = [
 	'rpmlib(FileDigests) <= 4.6.0-1',
 	'libvulkan.so.1()(64bit)',
 	'libcurl.so.4()(64bit)',
-	'xdg-utils' // OS integration
+	'xdg-utils', // OS integration
+];
+
+export const recommendedDeps = [
+	'bubblewrap', // agent command sandboxing
+	'socat', // agent command sandboxing
 ];
 
 export const referenceGeneratedDepsByArch = {

resources/linux/rpm/code.spec.template

@@ -9,6 +9,7 @@ License:  @@LICENSE@@
 URL:      https://code.visualstudio.com/
 Icon:     @@NAME@@.xpm
 Requires: @@DEPENDENCIES@@
+Recommends: @@RECOMMENDS@@
 AutoReq:  0
 
 %global __provides_exclude_from ^%{_datadir}/%{name}/.*\\.so.*$