mirror of
https://github.com/ZoiteChat/zoitechat.git
synced 2026-10-28 22:15:38 +00:00
83 lines
4.1 KiB
Markdown
83 lines
4.1 KiB
Markdown
# AppImage build
|
|
|
|
The workflow stays on Ubuntu 22.04 so updating Python does not also raise the
|
|
AppImage's glibc requirement. Python is built separately from a checked source
|
|
archive. `python.env` holds its version and SHA-256. CFFI and pycparser are pinned
|
|
in `python-requirements.txt`, including wheel hashes.
|
|
|
|
The Python interpreter used to build the documentation is separate from the
|
|
one used by the scripting plugin. The `docs-python` Meson option selects the
|
|
interpreter with Sphinx; it defaults to `python3` for normal builds.
|
|
|
|
## What was in the published build
|
|
|
|
Checked on October 27, 2026, using the 2.20.0-dev release asset:
|
|
|
|
`Zoitechat-2.20.0-dev-x86_64.AppImage`
|
|
|
|
SHA-256: `062eff9ba37556d3eca6c17388db45451353732a0cdf15c2bf3d6a3eae620989`
|
|
|
|
| Component | Published AppImage | This build |
|
|
| --- | --- | --- |
|
|
| Python | 3.10.12, built August 31, 2026 | 3.14.10 |
|
|
| CFFI | 1.15.0 | 2.1.1 |
|
|
| pycparser | 2.21 | 3.12 |
|
|
| Perl | 5.34.0 | Ubuntu 22.04 package, with available updates |
|
|
| OpenSSL reported by Python | 3.0.2 | Ubuntu 22.04 package, with available updates |
|
|
|
|
The old build copied the runner's entire Python `dist-packages` tree. That
|
|
included cloud-init, the Azure agent, apt bindings, Sphinx and other build-host
|
|
packages. The new bundle includes the standard library and the two declared
|
|
Python plugin dependencies. It leaves out CPython regression tests, bytecode
|
|
caches, static libraries and build tools. Tcl/Tk's runtime scripts are included
|
|
for the standard library's tkinter module.
|
|
|
|
Python 3.10 reached upstream end of life in October 2026. That does not mean
|
|
every Ubuntu Python 3.10 package is unpatched: Ubuntu backports security fixes.
|
|
The same applies to the old-looking OpenSSL and Perl version strings. The old
|
|
AppImage did not record the Ubuntu package revisions, so those strings alone
|
|
cannot establish its vulnerability status.
|
|
|
|
Python 3.14 is a deliberate choice. It is maintained upstream and supported by
|
|
CFFI. Moving a scripting runtime can still affect scripts using removed Python
|
|
APIs or native extensions built for Python 3.10. Third-party modules required
|
|
by user scripts need to be supplied for the new interpreter; incidental runner
|
|
packages are no longer treated as part of the scripting API.
|
|
|
|
## Checks and rebuilds
|
|
|
|
The workflow can be run manually and rebuilds weekly to pick up available
|
|
Ubuntu package and CA certificate updates. It creates an artifact; releasing a
|
|
new download is still a separate step. Already downloaded AppImages do not
|
|
receive those updates.
|
|
|
|
After packaging, the workflow extracts the AppImage into a path containing a
|
|
space and hides the Python build prefix. `check-runtime.py` checks the bundled
|
|
interpreter, native standard-library extensions, CFFI, CA loading and GIO TLS.
|
|
It starts the actual application under Xvfb and runs Python, Perl and Lua
|
|
scripts through their plugins. A missing script marker, process error or timeout
|
|
fails the build. Existing emoji tests remain in the workflow.
|
|
|
|
The `zoitechat-appimage-audit` artifact contains runtime versions, the build
|
|
host's exact Ubuntu package revisions, hashes of the deployment helpers and
|
|
the final AppImage checksum. The package list describes the build host, not an
|
|
SBOM of the AppImage. linuxdeploy's `continuous` download and its output plugin
|
|
remain upstream-managed; their versions should be reviewed when packaging
|
|
changes.
|
|
|
|
The GTK deployment helper is pinned to a commit. Its unconditional X11
|
|
override is removed so AppRun can honour `GDK_BACKEND` and choose Wayland with
|
|
X11 fallback. Hooks run once through linuxdeploy's generated outer launcher.
|
|
The Xvfb test covers X11; Wayland still needs testing in a Wayland session.
|
|
|
|
When updating Python, change its version and checksum together, refresh the
|
|
two wheel pins and hashes, and run the workflow. Review the audit artifact and
|
|
test the result on both Ubuntu 22.04 and a current distribution before release.
|
|
|
|
References:
|
|
|
|
- [Python release status](https://devguide.python.org/versions/)
|
|
- [Python 3.14.10](https://www.python.org/downloads/release/python-31410/)
|
|
- [CFFI release notes](https://cffi.readthedocs.io/en/latest/whatsnew.html)
|
|
- [Ubuntu security updates](https://documentation.ubuntu.com/security/security-updates/)
|