The AppImage tree is readable by everyone before it is repackaged

appimagetool's continuous build from 2026-10-29 rejects a tree that not every user can read and run, which failed the desktop Linux lane. Extraction keeps the build's restrictive modes (0700 directories, a 0770 AppRun.wrapped), and an AppImage runs as whichever user launches it, so the modes are corrected rather than the check skipped. Issue #6712. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-30 10:09:58 -04:00
parent 0f787c6363
commit f2b48069e3
1 changed files with 5 additions and 0 deletions
@@ -109,6 +109,11 @@ chmod +x "$APPIMAGETOOL"

 echo "==> Repackaging AppImage (overwriting original)"
 rm -f "$APPIMAGE"
+# appimagetool refuses a tree it can't be sure everyone can read and run: the
+# AppImage runs as whichever user launches it, and extraction keeps the build's
+# restrictive modes.
+chmod -R a+rX "$WORK/squashfs-root"
+chmod a+rx "$WORK/squashfs-root/AppRun"
 # APPIMAGE_EXTRACT_AND_RUN lets appimagetool (itself an AppImage) run without
 # FUSE in the CI container; ARCH is required by the embedded runtime.
 export APPIMAGE_EXTRACT_AND_RUN=1