[w3irdrobot]

Fixes #804.
Fixes #805.
Supersedes #1471, which was approved and is included here unchanged apart from one interaction noted below.

The AppImage bundled what the DT_NEEDED closure could see and missed or mishandled anything loaded at runtime. That caused four separate failures on non-Nix hosts.

Problem	Symptom	Fix
No GIO TLS module (#804)	every webview HTTPS request fails; login shows Load failed	bundle glib-networking's TLS module; AppRun sets GIO_MODULE_DIR to it
No GTK3 GSettings schemas (#805)	any file dialog aborts the process	bundle GTK3's compiled schemas
Nix-built libgbm bundled	window stays white on a real GPU (found on Fedora 45)	leave libgbm and libdrm to the host, like glibc
libepoxy and GStreamer load libraries from Nix paths (was #1471)	WebKitWebProcess aborts on hosts without a compatible GLES	bundle libglvnd's GL/GLES dispatch libraries; rewrite those paths to sonames

The rule throughout: bundle what only talks to other bundled libraries, and leave anything tied to the GPU, kernel or drivers to the host. The pinned linuxdeploy's own excludelist already leaves out libgbm.so.1 and libdrm.so.2; Maple's closure repair was adding them back.

Changes

• TLS and schemas: stage libgiognutls.so and GTK3's gschemas.compiled before the closure repair, which then bundles the module's dependencies. A closure missing either file fails the build.
• GBM and libdrm: add them to linux_appimage_ignored_needed_library next to glibc. The host's libgbm then finds the host's drivers, NVIDIA's included.
• GLES and GStreamer (from fix(research): make AppImage GLES runtime loading portable #1471): bundle the libglvnd dispatch libraries libepoxy opens at runtime, point libepoxy's fallback at its own directory, and replace absolute libsoup loads in GStreamer plugins with sonames.
• One interaction: fix(research): make AppImage GLES runtime loading portable #1471's path rewrite now skips copying host-supplied libraries. A Nix libgbm or libdrm path still gets rewritten to the soname, but the library resolves from the host instead of being bundled.

Package verification

• scripts/ci/appimage_gio_runtime.py loads the extracted AppImage's own libraries and fails unless they have a TLS backend and the file chooser's schema and template. The dev shell sets its own GIO_MODULE_DIR, so only the package can show this gap.
• The runtime-closure check rejects an AppImage that bundles a host-supplied library (glibc, libgbm, libdrm).
• fix(research): make AppImage GLES runtime loading portable #1471's checks reject live Nix library paths in .rodata and missing libepoxy dlopen dependencies.

Verification

All runtime checks used the packaged AppImage from desktop-pr.sh (fake updater signing) under Xvfb. This build talks to the Dev enclave; login used an address with no account.

Build and host	Login	Libraries loaded
Combined, Ubuntu 26.10 (glibc 2.44)	Invalid email, password, or login method, so the server answered	host libgbm and libdrm (/usr/lib/x86_64-linux-gnu)
Combined, Arch (glibc 2.44)	same	host libgbm and libdrm (/usr/lib)
TLS commit only, libgiognutls.so deleted, Ubuntu 26.10	Load failed	—

Neither combined run logged any GBM, MESA-LOADER or /run/opengl-driver errors.

File chooser (#805's reproducer, gtk_file_chooser_widget_new, run through the real AppRun):

Bundle	Result
Published 3.4.7, AppRun's GIO and GSettings variables set by hand	aborts, exit 134
This PR, Ubuntu 26.10 and Arch	widget created, exit 0

Real GPU on Fedora 45: a TLS-only build left the window white because the bundled libgbm was searching /run/opengl-driver/lib/gbm. With GBM_BACKENDS_PATH=/usr/lib64/gbm it drew, which is what led to the GBM change. The combined build (CI artifact from 06491aef) draws there with no environment overrides and no GBM errors, signing in to a real Dev account works, and the image picker's file dialog opens without crashing.

GLES (from #1471): Ubuntu 26.10/Xvfb previously showed the GLES error followed by WebKitWebProcess SIGABRT. After the fix, the AppImage started and ran until the timeout without either.

• Package verification passes on the combined build: verified-linux-appimage-gio-runtime, runtime closure, portable runtime paths, and GLIBC_2.44 floor=2.44 files=629.
• just lane repo passes: 574 CI script tests, 2 skipped.

Not verified

• Real GPUs beyond Fedora 45. CI and the containers have no GPU, so they can't catch a blank window.
• A host without libgbm. It would now fail at start with a missing-library error. Any desktop with Mesa has it.
• desktop-release.sh, NixOS, and NVIDIA's proprietary driver.

Notes for review

• Still bundled: libEGL, libGLX, libGLdispatch, libvulkan and libva are bundled even though linuxdeploy excludes most of them. fix(research): make AppImage GLES runtime loading portable #1471 bundles the GL dispatch libraries on purpose; the rest are left as they are here.
• Hardware video decoding: the bundled libva likely also has a Nix driver path, which would only affect hardware video decoding. Not investigated.
• Linux AppImage: GTK3 is broken in the bundle — any file dialog aborts the whole process #805's first defect did not reproduce. The broken GTK resources it reports don't occur on 3.4.7; the abort there is only the missing schemas. The verifier still checks the template.
• No gio-querymodules cache: GIO scans the module directory without one.
• Child processes: GIO_MODULE_DIR is inherited by processes the app launches, as the bundle's LD_LIBRARY_PATH already is.
• Reach: the AppImage still needs glibc 2.44 or newer. Older hosts get AppRun's message pointing to the .deb or .rpm.

🤖 Generated with Claude Code

[github-actions]

Maple development preview: https://40b79d42.maple-ca8.pages.dev

Commit: 06491aeff41cefb34c9477e5b38446a0157d3fee

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[github-actions]

Maple Auth development preview: https://eee47159.maple-auth-dev.pages.dev

Commit: 06491aeff41cefb34c9477e5b38446a0157d3fee

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.