From f2b48069e3e55952c5dbc5d8e6a0201e4503f0ed Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Fri, 30 Oct 2026 10:09:58 -0400 Subject: [PATCH] The AppImage tree is readable by everyone before it is repackaged appimagetool's continuous build from 2026-10-29 rejects a tree that not every user can read and run, which failed the desktop Linux lane. Extraction keeps the build's restrictive modes (0700 directories, a 0770 AppRun.wrapped), and an AppImage runs as whichever user launches it, so the modes are corrected rather than the check skipped. Issue #6712. Co-Authored-By: Claude Opus 5.5 --- desktop/packaging/appimage/debundle-graphics.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/desktop/packaging/appimage/debundle-graphics.sh b/desktop/packaging/appimage/debundle-graphics.sh index 84fc657..73e45c8 100755 --- a/desktop/packaging/appimage/debundle-graphics.sh +++ b/desktop/packaging/appimage/debundle-graphics.sh @@ -109,6 +109,11 @@ chmod +x "$APPIMAGETOOL" echo "==> Repackaging AppImage (overwriting original)" rm -f "$APPIMAGE" +# appimagetool refuses a tree it can't be sure everyone can read and run: the +# AppImage runs as whichever user launches it, and extraction keeps the build's +# restrictive modes. +chmod -R a+rX "$WORK/squashfs-root" +chmod a+rx "$WORK/squashfs-root/AppRun" # APPIMAGE_EXTRACT_AND_RUN lets appimagetool (itself an AppImage) run without # FUSE in the CI container; ARCH is required by the embedded runtime. export APPIMAGE_EXTRACT_AND_RUN=1