Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug]: Stable AppImage ships AppRun.wrapped as 0770, fails under firejail / AppImage catalog test

Closed
  • Is something wrong?
#879 2 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@vivekyarra is already working on this.

Since Oct 10, 2026.

  • #962 by @vivekyarra — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, linux, tauri
Domain
build-system

Research direction

Start with .github/workflows/build.yml and trace the stable Linux AppImage path through the tauri build/linuxdeploy step; compare it with the experimental path. Reproduce by extracting the built AppImage and checking executable-file permissions, then add a CI check or fix the permissions at the source. Done when stable AppImages ship AppRun.wrapped as 0755 and the permission check passes.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

The stable AppImage ships AppRun.wrapped with mode 0770, so the file is not readable or executable by "other". Any launcher that runs the AppImage as a different user, or from a mount it does not own, fails before the app starts.

This blocks the AppImage catalog listing: the automated test in https://github.com/AppImage/appimage.github.io/pull/9442 runs the AppImage under firejail and fails with:

/run/firejail/appimage/AppRun: line 12: /run/firejail/appimage/AppRun.wrapped: Permission denied
ERROR: The application exited within 11 seconds instead of showing a window

Checked on the published artifacts:

Release Bundler AppRun.wrapped
v0.25.0 (tabularis_0.25.0_amd64.AppImage) linuxdeploy (official tauri-cli) 0770 (wrong)
nightly-20261006-c0fe758 experimental sharun format not present, AppRun / AppRun.sh / AppRun.lib are 0755 (fine)

So only the stable path (.github/workflows/build.yml, !inputs.experimental_appimage) is affected. AppRun.wrapped is the linuxdeploy ELF that the generated AppRun script execs after sourcing apprun-hooks/linuxdeploy-plugin-gtk.sh. Every other file in the AppDir is 0755/0644.

To Reproduce
  1. gh release download v0.25.0 -R TabularisDB/tabularis -p 'tabularis_0.25.0_amd64.AppImage'
  2. chmod +x tabularis_0.25.0_amd64.AppImage && ./tabularis_0.25.0_amd64.AppImage --appimage-extract
  3. ls -l squashfs-root/ shows AppRun.wrapped as -rwxrwx---
  4. find squashfs-root -type f -perm -u+x ! -perm -o+x lists only squashfs-root/AppRun.wrapped
  5. Run the AppImage under firejail (firejail --appimage ./tabularis_0.25.0_amd64.AppImage): permission denied, no window
Expected

All executables in the AppDir are 0755 before the squashfs is packed.

Possible fix
  • Find where the 0770 comes from (umask in the runner during the linuxdeploy step, or the way tauri-bundler/linuxdeploy writes AppRun.wrapped) and fix it at the source, e.g. umask 022 before tauri build on Linux.
  • Otherwise normalize permissions on the AppDir right before packing. The pre-seeded linuxdeploy-plugin-gtk.sh patch runs too early (the AppRun wrapping happens after plugins), so this probably needs a separate step: extract, chmod 755 AppRun.wrapped, repack with appimagetool, and regenerate the updater .sig afterwards so latest.json stays valid.
  • Add a CI check on the built AppImage (--appimage-extract + find -perm) so a regression fails the build.

Once a release with the fix is out, comment /retest on the catalog PR.

OS Version

Linux (AppImage catalog test runner, firejail sandbox); reproduced locally on Arch Linux

Tabularis Version

v0.25.0

Relevant Log Output
$ ls -l squashfs-root
drwxr-xr-x  apprun-hooks/
drwxr-xr-x  usr/
lrwxrwxrwx  .DirIcon -> tabularis.png
-rwxr-xr-x  AppRun
-rwxrwx---  AppRun.wrapped
lrwxrwxrwx  tabularis.desktop -> usr/share/applications/tabularis.desktop
lrwxrwxrwx  tabularis.png -> usr/share/icons/hicolor/64x64/apps/tabularis.png

Full catalog test log: https://github.com/AppImage/appimage.github.io/actions/runs/36673202815

Dominant language
TypeScript
Stars
5.1k
Forks
335
Avg merge
1d 8h
Merged PRs (30d)
246

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from TabularisDB/tabularis

All issues in TabularisDB/tabularis

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.