The workflow stays on Ubuntu 22.04 so updating Python does not also raise the AppImage's glibc requirement. Python is built separately from a checked source archive. python.env holds its version and SHA-256. CFFI and pycparser are pinned in python-requirements.txt, including wheel hashes.

The Python interpreter used to build the documentation is separate from the one used by the scripting plugin. The docs-python Meson option selects the interpreter with Sphinx; it defaults to python3 for normal builds.

What was in the published build

Checked on October 27, 2026, using the 2.20.0-dev release asset:

Zoitechat-2.20.0-dev-x86_64.AppImage

SHA-256: 062eff9ba37556d3eca6c17388db45451353732a0cdf15c2bf3d6a3eae620989

Component	Published AppImage	This build
Python	3.10.12, built August 31, 2026	3.14.10
CFFI	1.15.0	2.1.1
pycparser	2.21	3.12
Perl	5.34.0	Ubuntu 22.04 package, with available updates
OpenSSL reported by Python	3.0.2	Ubuntu 22.04 package, with available updates

The old build copied the runner's entire Python dist-packages tree. That included cloud-init, the Azure agent, apt bindings, Sphinx and other build-host packages. The new bundle includes the standard library and the two declared Python plugin dependencies. It leaves out CPython regression tests, bytecode caches, static libraries and build tools. Tcl/Tk's runtime scripts are included for the standard library's tkinter module.

Python 3.10 reached upstream end of life in October 2026. That does not mean every Ubuntu Python 3.10 package is unpatched: Ubuntu backports security fixes. The same applies to the old-looking OpenSSL and Perl version strings. The old AppImage did not record the Ubuntu package revisions, so those strings alone cannot establish its vulnerability status.

Python 3.14 is a deliberate choice. It is maintained upstream and supported by CFFI. Moving a scripting runtime can still affect scripts using removed Python APIs or native extensions built for Python 3.10. Third-party modules required by user scripts need to be supplied for the new interpreter; incidental runner packages are no longer treated as part of the scripting API.

Checks and rebuilds

The workflow can be run manually and rebuilds weekly to pick up available Ubuntu package and CA certificate updates. It creates an artifact; releasing a new download is still a separate step. Already downloaded AppImages do not receive those updates.

After packaging, the workflow extracts the AppImage into a path containing a space and hides the Python build prefix. check-runtime.py checks the bundled interpreter, native standard-library extensions, CFFI, CA loading and GIO TLS. It starts the actual application under Xvfb and runs Python, Perl and Lua scripts through their plugins. A missing script marker, process error or timeout fails the build. Existing emoji tests remain in the workflow.

The zoitechat-appimage-audit artifact contains runtime versions, the build host's exact Ubuntu package revisions, hashes of the deployment helpers and the final AppImage checksum. The package list describes the build host, not an SBOM of the AppImage. linuxdeploy's continuous download and its output plugin remain upstream-managed; their versions should be reviewed when packaging changes.

The GTK deployment helper is pinned to a commit. Its unconditional X11 override is removed so AppRun can honour GDK_BACKEND and choose Wayland with X11 fallback. Hooks run once through linuxdeploy's generated outer launcher. The Xvfb test covers X11; Wayland still needs testing in a Wayland session.

When updating Python, change its version and checksum together, refresh the two wheel pins and hashes, and run the workflow. Review the audit artifact and test the result on both Ubuntu 22.04 and a current distribution before release.

References: