bvandeusen/inkwell
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 4 Wiki Activity

The AppImage tree is readable by everyone before it is repackaged
CI & Build / Build now, or wait for Android? (push) Successful in 2s
Details
Desktop (Tauri) / Build, or is the channel already serving this? (push) Successful in 3s
Details
CI & Build / Web typecheck and unit tests (push) Successful in 10s
Details
CI & Build / Python lint (push) Successful in 1s
Details
Android / Build, or is the channel already serving this? (push) Successful in 3s
Details
Android / Core and FFI clippy and tests (push) Skipped
Details
Android / Kotlin + Rust (APK) (push) Skipped
Details
Android / Build the server image (push) Skipped
Details
CI & Build / Python tests (push) Successful in 13s
Details
Desktop (Tauri) / Web tests, clippy, Rust tests and rustfmt (push) Successful in 1m45s
Details
Desktop (Tauri) / Windows installer (cross-compiled) (push) Successful in 1m56s
Details
Desktop (Tauri) / Update manifest (push) Successful in 4s
Details
CI & Build / integration (push) Successful in 1m31s
Details
CI & Build / Build & push image (push) Successful in 14s
Details
Desktop (Tauri) / Tauri desktop (Linux) (push) Successful in 2m59s
Details

Browse Source 
appimagetool's continuous build from 2026-10-29 rejects a tree that not every
user can read and run, which failed the desktop Linux lane. Extraction keeps the
build's restrictive modes (0700 directories, a 0770 AppRun.wrapped), and an
AppImage runs as whichever user launches it, so the modes are corrected rather
than the check skipped.

Issue #6712.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
bvandeusen
2026-10-30 10:09:58 -04:00
co-authored by Claude Opus 5.5
parent 0f787c6363
commit f2b48069e3
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
desktop/packaging/appimage/debundle-graphics.sh
+5
View File
@@ -109,6 +109,11 @@ chmod +x "$APPIMAGETOOL"
echo "==> Repackaging AppImage (overwriting original)"
rm -f "$APPIMAGE"
# appimagetool refuses a tree it can't be sure everyone can read and run: the
# AppImage runs as whichever user launches it, and extraction keeps the build's
# restrictive modes.
chmod -R a+rX "$WORK/squashfs-root"
chmod a+rx "$WORK/squashfs-root/AppRun"
# APPIMAGE_EXTRACT_AND_RUN lets appimagetool (itself an AppImage) run without
# FUSE in the CI container; ARCH is required by the embedded runtime.
export APPIMAGE_EXTRACT_AND_RUN=1