Fix Linux AppImage runtime closure

[AnthonyRonning]

Summary

• repair the AppDir after linuxdeploy so non-glibc runtime libraries skipped by linuxdeploy are bundled from the pinned Nix runtime closure
• rewrite absolute Nix-store DT_NEEDED entries in AppImage libraries to bundled sonames
• verify AppImage runtime closure during Linux artifact verification
• fix Linux .deb verifier handling for relative artifact paths

Local validation

• git diff --check
• bash -n scripts/ci/_common.sh scripts/ci/verify-release-artifacts.sh scripts/ci/desktop-release.sh scripts/ci/desktop-pr.sh
• nix develop .#desktop-linux -c ./scripts/ci/desktop-pr.sh passed locally on aarch64 before commit and staged libfribidi.so.0 plus other skipped runtime libraries into the AppImage
• generated a fresh temporary Linux release manifest from local artifacts and ran nix develop .#desktop-linux -c ./scripts/ci/verify-release-artifacts.sh <tmp> linux; it verified hashes, AppImage executable metadata, AppImage runtime closure, and .deb executable metadata
• published v3.1.0 AppImage fails the new runtime closure verifier with missing libfribidi.so.0 and absolute Nix-store SQLite DT_NEEDED entries, matching the reported install failure

---

Summary by CodeRabbit

• Chores
  • Improved Linux AppImage/AppDir staging to automatically repair the runtime library closure, rewrite missing library references, and verify the result.
  • Updated AppImage wrapper behavior so --appdir uses the shared staging preparation flow, including cleanup and interpreter/RPATH sanitization.
  • Enhanced reproducibility by normalizing timestamps in the prepared AppDir.
• Tests / Verification
  • Tightened Linux package verification by using canonical absolute paths and adding runtime-closure validation for extracted AppDirs.

[cloudflare-workers-and-pages]

Deploying maple with Cloudflare Pages

Latest commit:	6d759af
Status:	✅ Deploy successful!
Preview URL:	https://ce0d12cc.maple-ca8.pages.dev
Branch Preview URL:	https://fix-linux-deb-verifier-relat.maple-ca8.pages.dev

View logs

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7d89c57f-d243-4a79-9599-3d15560e0890

📥 Commits

Reviewing files that changed from the base of the PR and between 99a0ea3 and 6d759af.

📒 Files selected for processing (1)

• scripts/ci/_common.sh

---

📝 Walkthrough

Walkthrough

scripts/ci/_common.sh gains ten new functions implementing iterative AppImage runtime-closure repair and verification using patchelf and the Nix closure store paths. Both AppImage wrapper --appdir branches are updated to delegate to the new prepare_linux_appdir_for_appimage. Existing .deb and AppImage metadata verification functions receive a path normalization fix and a closure-verification call respectively.

Changes

AppImage Runtime Closure Repair and Verification

Layer / File(s)	Summary
Runtime closure repair and verification helpers scripts/ci/_common.sh	Ten new functions added: helpers to classify ignored DT_NEEDED entries, resolve Nix-closure libraries by soname, copy and verify libraries in appdir/usr/lib, iteratively rewrite DT_NEEDED entries with patchelf until convergence, verify all required sonames, and a top-level prepare_linux_appdir_for_appimage orchestrator that sequences sanitize → repair → verify → reproducible timestamps.
Wrapper integration and metadata verification updates scripts/ci/_common.sh	Both AppImage wrapper --appdir branches replace inline .DirIcon removal and sanitization with a call to prepare_linux_appdir_for_appimage. verify_linux_deb_package_executable_metadata normalizes deb to a canonical absolute path. verify_linux_appimage_executable_metadata adds a call to verify_linux_appdir_runtime_closure on the extracted AppDir.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• OpenSecretCloud/Maple#574: Modifies the same verify_linux_deb_package_executable_metadata and verify_linux_appimage_executable_metadata functions and the AppImage --appdir handling path in scripts/ci/_common.sh.
• OpenSecretCloud/Maple#544: Both PRs enhance Linux AppImage/AppDir tooling in scripts/ci/_common.sh around patchelf and runtime handling, with this PR adding DT_NEEDED closure repair and verification.

Poem

🐇 Hopping through the Nix store late at night,
I gather each .so and set the paths right.
With patchelf in paw and a bounded loop's grace,
I repair the closure and verify the space.
Each soname found, the AppImage complete —
This bunny's build pipeline smells oh-so neat! 🎉

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: implementing a runtime closure repair mechanism for Linux AppImages to handle missing runtime libraries.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/linux-deb-verifier-relative-path

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}