fix(release): verify packaged Linux executables

Author: debpalash

.github/workflows/release.yml

@@ -51,7 +51,8 @@ jobs:
       - name: Install build and packaging dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libfontconfig1-dev libxkbcommon-x11-dev pkg-config rpm
+          sudo apt-get install -y \
+            libfontconfig1-dev libxkbcommon-x11-dev pkg-config rpm xauth xvfb
       - name: Download pinned AppImage tools
         shell: bash
         run: |

scripts/package-linux.sh

@@ -138,13 +138,18 @@ sed 's|@EXEC@|bootable-desktop|g' \
   > "$appdir/usr/share/applications/app.bootable.Bootable.desktop"
 # The adjacent helper lets the runtime retain its fixed-name fallback inside the AppImage.
 install -m 0755 "$binary_dir/bootable-helper" "$appdir/usr/bin/bootable-helper"
-"$linuxdeploy" \
+# linuxdeploy bundles an older strip that rejects RELR sections found in
+# current distro libraries. Dependency deployment does not require stripping.
+NO_STRIP=1 "$linuxdeploy" \
   --appdir "$appdir" \
   --executable "$appdir/usr/bin/bootable-desktop" \
   --executable "$appdir/usr/bin/bootable" \
   --executable "$appdir/usr/bin/bootable-helper" \
   --desktop-file "$appdir/usr/share/applications/app.bootable.Bootable.desktop" \
   --icon-file "$appdir/usr/share/icons/hicolor/scalable/apps/bootable.svg"
+# linuxdeploy points AppRun at the desktop executable. Remove that symlink before
+# writing the dispatcher, or shell redirection replaces the desktop binary.
+rm -f "$appdir/AppRun"
 cat > "$appdir/AppRun" <<'EOF'
 #!/bin/sh
 set -eu

scripts/verify-linux-packages.sh

@@ -33,12 +33,39 @@ trap 'rm -rf "$extract"' EXIT
 for path in AppRun usr/bin/bootable usr/bin/bootable-desktop usr/bin/bootable-helper; do
   test -x "$extract/squashfs-root/$path"
 done
+test -f "$extract/squashfs-root/AppRun"
+test ! -L "$extract/squashfs-root/AppRun"
+test ! "$extract/squashfs-root/AppRun" -ef "$extract/squashfs-root/usr/bin/bootable-desktop"
+test "$(od -An -N4 -t x1 "$extract/squashfs-root/usr/bin/bootable-desktop" | tr -d ' \n')" = "7f454c46"
 test "$("$extract/squashfs-root/usr/bin/bootable" --version)" = "bootable $version"
+test "$("$appimage" --tui --version)" = "bootable $version"
+
+smoke="$extract/gui-smoke"
+install -d "$smoke/home" "$smoke/config" "$smoke/cache" "$smoke/data" "$smoke/state"
+install -d -m 0700 "$smoke/runtime"
+set +e
+env \
+  HOME="$smoke/home" \
+  XDG_CONFIG_HOME="$smoke/config" \
+  XDG_CACHE_HOME="$smoke/cache" \
+  XDG_DATA_HOME="$smoke/data" \
+  XDG_STATE_HOME="$smoke/state" \
+  XDG_RUNTIME_DIR="$smoke/runtime" \
+  timeout --signal=TERM 5s xvfb-run -a "$extract/squashfs-root/AppRun" \
+  >"$smoke/bootable.log" 2>&1
+status=$?
+set -e
+if [ "$status" -ne 124 ]; then
+  cat "$smoke/bootable.log"
+  echo "AppImage GUI exited before the five-second smoke window (status $status)" >&2
+  exit 1
+fi
 
 mkdir "$extract/archive"
 tar -xzf "$archive" -C "$extract/archive"
 for executable in bootable bootable-desktop bootable-helper install.sh; do
   test -x "$extract/archive/$executable"
 done
+test "$(od -An -N4 -t x1 "$extract/archive/bootable-desktop" | tr -d ' \n')" = "7f454c46"
 test "$("$extract/archive/bootable" --version)" = "bootable $version"
 "$extract/archive/bootable" --help >/dev/null