Daniel Johnson dcb0f518e1 appimage: make WebKit login work on non-Ubuntu hosts ...

Three related bugs prevented the AppImage's WebKit-based service
login from working on Fedora / Arch / openSUSE — invisible on Ubuntu
because the host happens to satisfy the AppDir's missing pieces.

1. TLS backend not bundled. linuxdeploy-plugin-gtk copies libgio but
   not the GIO modules directory that holds glib-networking's
   libgiognutls.so. Without it GIO falls back to a compile-time libdir
   that doesn't exist off-Debian, and WebKit reports "TLS is not
   available" on the first HTTPS request. Copy the modules directory
   into $APPDIR/usr/lib/gio/modules with an $ORIGIN/../.. RPATH, add
   glib-networking to apt explicitly (it was pulled transitively but
   its modules weren't being copied), and export GIO_MODULE_DIR in
   AppRun.

2. WebKit shared libraries not bundled. libwebkit2gtk-4.1 and
   libjavascriptcoregtk-4.1 are loaded lazily via gi.repository when
   the user clicks a login button, so they never appear in any
   binary's NEEDED chain — linuxdeploy has no reason to bundle them.
   On non-Ubuntu hosts dlopen() falls through to the host copies with
   different symbols, e.g. `undefined symbol: webkit_web_context_new`.
   Pass both sonames to linuxdeploy explicitly.

3. WebKit helper processes not bundled and hardcoded path unreachable.
   WebKit2 4.1 forks WebKitNetworkProcess / WebKitWebProcess from a
   compile-time path baked into libwebkit2gtk-4.1.so.0
   (/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1/). linuxdeploy bundles
   shared libraries, not auxiliary executables, and WEBKIT_EXEC_PATH
   was removed upstream — the path is only overridable by byte-patching
   the .so. Copy the webkit2gtk-4.1/ directory into the AppDir with
   $ORIGIN/.. RPATH on each helper, and byte-patch the hardcoded
   compile-time path inside libwebkit2gtk-4.1.so.0 to a writable
   /tmp/.lutris-appimage.dir/webkit2gtk-4.1 (same byte length). AppRun
   creates the symlink there before launch.

Also disable WebKit's bubblewrap sandbox
(WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1): bwrap opens a fresh
mount namespace that can't see the AppImage's FUSE mount at
/tmp/.mount_LutrisXXX, so any helper spawned inside it fails to reach
either the symlink target or the bundled libs. Lutris already runs
unsandboxed and spawns Wine, so an additional WebKit sandbox buys
negligible isolation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-07-01 19:32:36 -04:00

4.6 KiB

Executable File

Raw Blame History

View Raw