Merge pull request #5 from wownero/fix/appimage-libcom-err-20261024

fix(appimage): bundle libcom_err runtime

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
                             qt6-wayland-dev qt6-declarative-dev libzip-dev libsodium-dev libgcrypt20-dev libx11-xcb-dev
                             qml6-module-qtquick qml6-module-qtquick-layouts qml6-module-qtquick-window qml6-module-qtqml-workerscript qml6-module-qtqml-models
                             protobuf-compiler libprotobuf-dev libhidapi-dev libzxing-dev libusb-dev
-                            libusb-1.0-0-dev patchelf
+                            libusb-1.0-0-dev libcom-err2 patchelf
       - name: configure git
         run: git config --global --add safe.directory '*'
       - uses: actions/checkout@v4
@@ -77,10 +77,20 @@ jobs:
           export EXTRA_QT_PLUGINS="svg;multimedia;tls"
           export QML_SOURCES_PATHS="$PWD/src/assets/qml"
           export PATH="$PWD:$PATH"
+          # linuxdeploy's AppImage excludelist assumes libcom_err.so.2 is present on the host.
+          # Minimal Debian and openSUSE systems may omit it, but it is a transitive runtime dependency.
+          LIBCOM_ERR="$(ldconfig -p | awk '$1 == "libcom_err.so.2" { print $NF; exit }')"
+          if [[ -z "$LIBCOM_ERR" || ! -f "$LIBCOM_ERR" ]]; then
+            echo "ERROR: libcom_err.so.2 is unavailable in the build image; cannot make a portable AppImage." >&2
+            exit 1
+          fi
           # Populate AppDir (libs + Qt plugins + QML modules) — no --output yet, so we can patch QML first.
           ./linuxdeploy --appdir AppDir --plugin qt \
+            --library "$LIBCOM_ERR" \
             -d AppDir/usr/share/applications/wowlet.desktop \
             -i AppDir/usr/share/icons/hicolor/256x256/apps/wowlet.png
+          # Guard this packaging regression: the AppImage must carry the excluded system library.
+          bash contrib/AppImage/check-libcom-err.sh AppDir
           # ---------------------------------------------------------------------------------------
           # Make the QML bundle COMPLETE and deterministic (no whack-a-mole).
           #

contrib/AppImage/check-libcom-err.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+appdir="${1:?usage: check-libcom-err.sh APPDIR}"
+library="$(find "$appdir/usr/lib" -name libcom_err.so.2 -print -quit 2>/dev/null || true)"
+if [[ -z "$library" || ! -e "$library" ]]; then
+  echo "ERROR: AppDir is missing the bundled libcom_err.so.2 runtime library." >&2
+  exit 1
+fi

contrib/release/sign_macos.py

@@ -5,10 +5,12 @@ https://github.com/apple-oss-distributions/SecurityTool/blob/main/security.c
 Output stays captured because native diagnostics may repeat supplied input.
 """
 import base64
+from contextlib import contextmanager
 import json
 import os
 from pathlib import Path
 import secrets
+import shlex
 import subprocess
 import sys
 import tempfile
@@ -34,7 +36,7 @@ def child_environment():
 def security(operation, *values):
     if operation not in {
         "create-keychain", "set-keychain-settings", "unlock-keychain", "import",
-        "set-key-partition-list", "delete-keychain",
+        "set-key-partition-list", "delete-keychain", "list-keychains",
     }:
         raise ValueError("Keychain operation is outside candidate signing")
     command = " ".join(argument(value) for value in (operation, *values)) + "\n"
@@ -56,6 +58,8 @@ def security(operation, *values):
                      "native keychain operation returned an error")
         raise RuntimeError(f"{operation}: {cause} (exit {result.returncode}); raw diagnostics withheld")
 
+    return result.stdout
+
 
 def run(arguments, *, timeout=120):
     result = subprocess.run(arguments, text=True, capture_output=True,
@@ -66,6 +70,14 @@ def run(arguments, *, timeout=120):
             "User interaction is not allowed": "signing key requires interactive access",
             "errSecInternalComponent": "keychain denied access to the signing identity",
             "not signed at all": "candidate contains an unsigned component",
+            "resource fork, Finder information": "candidate contains metadata forbidden by code signing",
+            "unable to build chain": "signing certificate chain could not be built",
+            "unsealed contents present": "embedded bundle has unsealed root contents",
+            "bundle format unrecognized": "component has an unsupported bundle format",
+            "timestamp service": "Apple timestamp service failed",
+            "Timestamping service": "Apple timestamp service failed",
+            "certificate has expired": "signing certificate has expired",
+            "CSSMERR_TP_CERT_EXPIRED": "signing certificate has expired",
         }
         cause = next((cause for marker, cause in causes.items() if marker in result.stderr),
                      "native signing operation returned an error")
@@ -73,6 +85,27 @@ def run(arguments, *, timeout=120):
     return result.stdout
 
 
+@contextmanager
+def keychain_search(keychain):
+    previous = [value for value in shlex.split(security("list-keychains", "-d", "user"))
+                if Path(value) != keychain]
+    if not previous or any(not Path(value).is_absolute() for value in previous):
+        raise RuntimeError("Existing user keychain search list is absent or malformed")
+    try:
+        security("list-keychains", "-d", "user", "-s", str(keychain), *previous)
+        yield
+    finally:
+        security("list-keychains", "-d", "user", "-s", *previous)
+
+
+def signable_files(app):
+    for path in sorted(app.rglob("*")):
+        if path.is_symlink() or not path.is_file() or any(part.endswith(".framework") for part in path.parts):
+            continue
+        if "Mach-O" in run(["/usr/bin/file", "-b", str(path)]):
+            yield path
+
+
 def private_file(path, content):
     descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
     with os.fdopen(descriptor, "wb") as stream:
@@ -115,40 +148,40 @@ def main():
                 security("set-key-partition-list", "-S", "apple-tool:,apple:", "-s",
                          "-k", password, str(keychain))
 
-                def sign(path):
+                with keychain_search(keychain):
-                    run(["/usr/bin/codesign", "--force", "--options", "runtime", "--timestamp",
+                    def sign(path):
-                         "--keychain", str(keychain), "--sign",
+                        print("Signing component: " + (str(path.relative_to(app)) if path != app else "Wowlet.app"), flush=True)
-                         credentials["APPLE_SIGNING_IDENTITY"], str(path)])
+                        run(["/usr/bin/codesign", "--force", "--options", "runtime", "--timestamp",
+                             "--keychain", str(keychain), "--sign",
+                             credentials["APPLE_SIGNING_IDENTITY"], str(path)])
 
-                for path in sorted(app.rglob("*")):
+                    for path in signable_files(app):
-                    if path.is_file() and not any(part.endswith(".framework") for part in path.parts):
+                        sign(path)
-                        if "Mach-O" in run(["/usr/bin/file", "-b", str(path)]):
+                    frameworks = app / "Contents/Frameworks"
-                            sign(path)
+                    for path in sorted(frameworks.glob("*.framework")):
-                frameworks = app / "Contents/Frameworks"
+                        sign(path)
-                for path in sorted(frameworks.glob("*.framework")):
+                    sign(app)
-                    sign(path)
+                    run(["/usr/bin/codesign", "--verify", "--deep", "--strict", str(app)])
-                sign(app)
+                    archive = workspace / "candidate.zip"
-                run(["/usr/bin/codesign", "--verify", "--deep", "--strict", str(app)])
+                    run(["/usr/bin/ditto", "-c", "-k", "--keepParent", str(app), str(archive)])
-                archive = workspace / "candidate.zip"
+                    raw = run(["/usr/bin/xcrun", "notarytool", "submit", str(archive),
-                run(["/usr/bin/ditto", "-c", "-k", "--keepParent", str(app), str(archive)])
+                               "--key", str(notary_key), "--key-id", credentials["APPLE_API_KEY"],
-                raw = run(["/usr/bin/xcrun", "notarytool", "submit", str(archive),
+                               "--issuer", credentials["APPLE_API_ISSUER"], "--wait", "--timeout", "30m",
-                           "--key", str(notary_key), "--key-id", credentials["APPLE_API_KEY"],
+                               "--output-format", "json"], timeout=1900)
-                           "--issuer", credentials["APPLE_API_ISSUER"], "--wait", "--timeout", "30m",
+                    response = json.loads(raw)
-                           "--output-format", "json"], timeout=1900)
+                    if response.get("status") != "Accepted":
-                response = json.loads(raw)
+                        raise RuntimeError("Apple notarization did not return Accepted")
-                if response.get("status") != "Accepted":
+                    try:
-                    raise RuntimeError("Apple notarization did not return Accepted")
+                        uuid.UUID(response.get("id", ""))
-                try:
+                    except (ValueError, TypeError, AttributeError):
-                    uuid.UUID(response.get("id", ""))
+                        raise RuntimeError("Apple notarization submission identity is missing or malformed") from None
-                except (ValueError, TypeError, AttributeError):
+                    run(["/usr/bin/xcrun", "stapler", "staple", str(app)])
-                    raise RuntimeError("Apple notarization submission identity is missing or malformed") from None
+                    run(["/usr/bin/xcrun", "stapler", "validate", str(app)])
-                run(["/usr/bin/xcrun", "stapler", "staple", str(app)])
+                    private_file(app.parent / "macos-signing.json", json.dumps({
-                run(["/usr/bin/xcrun", "stapler", "validate", str(app)])
+                        "developer_id_verified": True, "notarization_status": "Accepted",
-                private_file(app.parent / "macos-signing.json", json.dumps({
+                        "notary_submission_id": response.get("id"), "staple_validated": True,
-                    "developer_id_verified": True, "notarization_status": "Accepted",
+                    }, sort_keys=True).encode())
-                    "notary_submission_id": response.get("id"), "staple_validated": True,
+                    print("Developer ID signature verified; notarization accepted; staple validated")
-                }, sort_keys=True).encode())
-                print("Developer ID signature verified; notarization accepted; staple validated")
             finally:
                 if created:
                     security("delete-keychain", str(keychain))

contrib/release/tests/test_appimage_dependency_bundle.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[3]
+CHECKER = ROOT / "contrib/AppImage/check-libcom-err.sh"
+
+
+class AppImageDependencyBundleTest(unittest.TestCase):
+    def test_accepts_appdir_with_libcom_err(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            appdir = Path(temporary) / "AppDir"
+            library = appdir / "usr/lib/libcom_err.so.2"
+            library.parent.mkdir(parents=True)
+            library.write_bytes(b"fixture")
+
+            result = subprocess.run(["bash", str(CHECKER), str(appdir)], check=False)
+
+            self.assertEqual(result.returncode, 0)
+
+    def test_refuses_appdir_without_libcom_err(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            appdir = Path(temporary) / "AppDir"
+            (appdir / "usr/lib").mkdir(parents=True)
+
+            result = subprocess.run(
+                ["bash", str(CHECKER), str(appdir)],
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+
+            self.assertNotEqual(result.returncode, 0)
+            self.assertTrue(result.stderr.strip())
+
+
+if __name__ == "__main__":
+    unittest.main()

contrib/release/tests/test_sign_macos.py

@@ -2,6 +2,7 @@ import importlib.util
 from pathlib import Path
 from types import SimpleNamespace
 import unittest
+import tempfile
 from unittest.mock import patch
 
 spec = importlib.util.spec_from_file_location("sign_macos", Path(__file__).parents[1] / "sign_macos.py")
@@ -43,3 +44,52 @@ class MacSigningTests(unittest.TestCase):
             with self.assertRaises(ValueError):
                 signing.security("dump-keychain", "login.keychain")
             execute.assert_not_called()
+
+    def test_user_keychain_search_is_restored_after_signing_failure(self):
+        previous = ['/Users/runner/Library/Keychains/login.keychain-db', '/Library/Keychains/System.keychain']
+        calls = []
+        def security(operation, *values):
+            calls.append((operation, values))
+            return ' '.join('"' + value + '"' for value in previous)
+        with patch.object(signing, "security", security):
+            with self.assertRaisesRegex(RuntimeError, "synthetic signing failure"):
+                with signing.keychain_search(Path('/private/candidate.keychain-db')):
+                    self.assertEqual(calls[-1][1][-len(previous):], tuple(previous))
+                    self.assertIn('/private/candidate.keychain-db', calls[-1][1])
+                    raise RuntimeError('synthetic signing failure')
+        self.assertEqual(calls[-1], ('list-keychains', ('-d', 'user', '-s', *previous)))
+
+    def test_failed_search_list_write_still_restores_original_list(self):
+        calls = []
+        previous = '/Users/runner/Library/Keychains/login.keychain-db'
+        def security(operation, *values):
+            calls.append((operation, values))
+            if '/private/candidate.keychain-db' in values:
+                raise RuntimeError('synthetic search write failure')
+            return '"' + previous + '"'
+        with patch.object(signing, "security", security):
+            with self.assertRaises(RuntimeError):
+                with signing.keychain_search(Path('/private/candidate.keychain-db')):
+                    self.fail('failed search-list setup entered signing')
+        self.assertEqual(calls[-1][1], ('-d', 'user', '-s', previous))
+
+    def test_signing_walk_skips_symlink_aliases_and_framework_internals(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            app = Path(temporary)
+            executable = app / 'actual.dylib'
+            executable.write_bytes(b'mach-o fixture')
+            (app / 'alias.dylib').symlink_to(executable.name)
+            framework = app / 'QtCore.framework'
+            framework.mkdir()
+            (framework / 'QtCore').write_bytes(b'framework fixture')
+            with patch.object(signing, 'run', return_value='Mach-O arm64'):
+                self.assertEqual(list(signing.signable_files(app)), [executable])
+
+    def test_native_failure_cause_does_not_echo_untrusted_diagnostics(self):
+        sentinel = 'must-not-echo-native-input'
+        result = SimpleNamespace(returncode=1, stdout='', stderr='unable to build chain ' + sentinel)
+        with patch.object(signing.subprocess, 'run', return_value=result):
+            with self.assertRaises(RuntimeError) as caught:
+                signing.run(['/usr/bin/codesign', 'public-component'])
+        self.assertIn('certificate chain', str(caught.exception))
+        self.assertNotIn(sentinel, str(caught.exception))