Merge pull request jellyfin#1150 from jellyfin/appimage-ubuntu

Fix AppImage crashes on Ubuntu and other non-Arch distros

Author: andrewrabert

dev/appimage/Dockerfile

@@ -89,7 +89,6 @@ RUN rm -rf /AppDir/usr/lib/dri \
           /AppDir/usr/lib/libOpenGL.so* \
           /AppDir/usr/lib/libgbm.so* \
           /AppDir/usr/lib/libvulkan.so* \
-          /AppDir/usr/lib/libvdpau.so* \
           /AppDir/usr/lib/libdrm.so* \
           /AppDir/usr/lib/libdrm_*.so* \
           /AppDir/usr/lib/libxshmfence.so* \
@@ -120,14 +119,19 @@ RUN cp /AppDir/usr/share/applications/org.jellyfin.JellyfinDesktop.desktop /AppD
     ln -sf org.jellyfin.JellyfinDesktop.svg /AppDir/.DirIcon
 
 # Wrap QtWebEngineProcess so it also uses the bundled ld-linux.
-# Without this, Chromium's renderer/GPU subprocesses would use the host's
-# dynamic linker and hit the same glibc mismatch.
-COPY dev/appimage/QtWebEngineProcess.wrapper /tmp/QtWebEngineProcess.wrapper
+# This MUST be a statically-linked binary, not a shell script.  The parent
+# exports LD_LIBRARY_PATH pointing to the bundled (Arch) libs; a script
+# wrapper would be interpreted by /bin/bash loaded via the host's ld-linux,
+# which then pulls in the bundled glibc — an ABI mismatch that segfaults
+# on distros whose glibc differs from the build host.
+COPY dev/appimage/webengine-wrapper.c /tmp/webengine-wrapper.c
+RUN gcc -static -O2 -o /tmp/webengine-wrapper /tmp/webengine-wrapper.c && \
+    strip /tmp/webengine-wrapper
 RUN set -e && \
     webengine_bin="$(find /AppDir/usr/lib -name QtWebEngineProcess -type f)" && \
     if [ -n "$webengine_bin" ]; then \
         mv "$webengine_bin" "${webengine_bin}.real" && \
-        cp /tmp/QtWebEngineProcess.wrapper "$webengine_bin" && \
+        cp /tmp/webengine-wrapper "$webengine_bin" && \
         chmod +x "$webengine_bin"; \
     fi
 

dev/appimage/QtWebEngineProcess.wrapper

@@ -1,10 +1,16 @@
 #!/bin/bash
-# APPDIR is exported by AppRun
+SELF="$(readlink -f "$0")"
+
+# Derive APPDIR from script location if not inherited from AppRun.
+# The script is always under $APPDIR/usr/lib/..., so stripping from
+# /usr/lib/ onward gives us the AppDir root.
+: "${APPDIR:="${SELF%%/usr/lib/*}"}"
+
 LIBRARY_PATH="${APPDIR}/usr/lib"
 LIBRARY_PATH="${LIBRARY_PATH}:/usr/lib64:/usr/lib:/lib64:/lib"
 LIBRARY_PATH="${LIBRARY_PATH}:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu"
 
 exec "$APPDIR/usr/lib/ld-linux-x86-64.so.2" \
     --inhibit-cache \
     --library-path "${LIBRARY_PATH}" \
-    "$(readlink -f "$0").real" "$@"
+    "${SELF}.real" "$@"

dev/appimage/webengine-wrapper.c

@@ -0,0 +1,68 @@
+/*
+ * Statically-linked wrapper for QtWebEngineProcess.
+ *
+ * Qt WebEngine launches this as a subprocess.  Because the parent sets
+ * LD_LIBRARY_PATH to the AppImage's bundled libraries, a shell-script
+ * wrapper would crash: the host's /bin/bash gets loaded by the host's
+ * dynamic linker, which then pulls in the *bundled* glibc — an ABI
+ * mismatch that segfaults on distros whose glibc differs from the build
+ * host (e.g. Ubuntu vs Arch).
+ *
+ * A static binary sidesteps the problem entirely: it has no shared
+ * library dependencies, so LD_LIBRARY_PATH is irrelevant.  It simply
+ * re-execs the real QtWebEngineProcess binary through the bundled
+ * ld-linux with an explicit --library-path.
+ */
+
+#include <limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+    char self[PATH_MAX];
+    ssize_t len = readlink("/proc/self/exe", self, sizeof(self) - 1);
+    if (len < 0)
+        _exit(127);
+    self[len] = '\0';
+
+    /* Derive APPDIR: this binary lives under $APPDIR/usr/lib/...,
+       so the first /usr/lib/ in the path marks the boundary. */
+    char *p = strstr(self, "/usr/lib/");
+    if (!p)
+        _exit(127);
+
+    int appdir_len = (int)(p - self);
+
+    char ldlinux[PATH_MAX];
+    snprintf(ldlinux, sizeof(ldlinux),
+             "%.*s/usr/lib/ld-linux-x86-64.so.2", appdir_len, self);
+
+    char real_bin[PATH_MAX + 8];
+    snprintf(real_bin, sizeof(real_bin), "%s.real", self);
+
+    char lib_path[PATH_MAX * 2];
+    snprintf(lib_path, sizeof(lib_path),
+             "%.*s/usr/lib"
+             ":/usr/lib64:/usr/lib:/lib64:/lib"
+             ":/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu",
+             appdir_len, self);
+
+    /* argv: ld-linux --inhibit-cache --library-path <path> <real> [original args…] */
+    char **new_argv = calloc((size_t)(argc + 5), sizeof(char *));
+    if (!new_argv)
+        _exit(127);
+
+    new_argv[0] = ldlinux;
+    new_argv[1] = "--inhibit-cache";
+    new_argv[2] = "--library-path";
+    new_argv[3] = lib_path;
+    new_argv[4] = real_bin;
+    for (int i = 1; i < argc; i++)
+        new_argv[i + 4] = argv[i];
+
+    execv(ldlinux, new_argv);
+    _exit(127);
+}