fix(linux): restore tauri-cef pin so AppImage stops bundling libm.so.6 (#2154)#2236
Conversation
tinyhumansai#2154) Commit 983f297 ("chore(branding): update all app icons and logos to new brand kit", tinyhumansai#2110) accidentally reverted the app/src-tauri/vendor/tauri-cef submodule pin from e22ec719 -> f75bc21f, undoing the Linux AppImage library exclusion fixes from tinyhumansai#1996 (exclude glibc core libs) and tinyhumansai#2032 (exclude bundled NSS libs). With f75bc21f the AppImage re-bundles an old libm.so.6; on Ubuntu 24.x (GLIBC 2.39) it shadows the host libm and NSS fails to load the host libsqlite3 (nss_error=-5925), crashing on startup (tinyhumansai#2154) and on the post-login restart (tinyhumansai#2088). Restore the pin to e22ec719 (the value set by tinyhumansai#2032, on main until tinyhumansai#2110 reverted it). Add a lightweight CI guard (tauri-cef-pin-guard.yml + .github/tauri-cef-expected-sha) that fails any PR whose committed gitlink no longer matches the recorded SHA, so a non-Linux PR cannot silently revert it again; intentional bumps just update the expected-sha file. Coverage: N/A - submodule pin + CI YAML, not instrumentable by diff-cover. Closes tinyhumansai#2154 Closes tinyhumansai#2088 Co-Authored-By: Claude <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds a pinned-SHA file for Tauri CEF, a GitHub Actions workflow that verifies the repo's recorded submodule gitlink SHA against the expected SHA on push/PR/dispatch, and updates the repository's submodule pointer to the pinned commit. ChangesTauri CEF submodule pinning infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tauri-cef-pin-guard.yml:
- Around line 28-29: The Checkout step using actions/checkout@v5 should disable
credential persistence; update the step labeled "Checkout" (uses:
actions/checkout@v5) to include the input persist-credentials: false so
credentials are not written to the GitHub workspace after checkout.
- Line 29: Replace the mutable tag reference for the checkout action by pinning
to the specific commit SHA: change the uses entry that currently reads
actions/checkout@v5 to actions/checkout@93cb6ef so the workflow is locked to the
exact commit and prevents supply-chain risks; update the uses line in the
tauri-cef-pin-guard.yml file accordingly.
In `@app/src-tauri/vendor/tauri-cef`:
- Line 1: The pinned SHA for tauri-cef in app/src-tauri/vendor/tauri-cef
(currently e22ec719...) does not match the recorded expected SHA used by the Pin
Guard (.github/tauri-cef-expected-sha); update the
.github/tauri-cef-expected-sha file in the same PR to the exact pinned commit
(or, if the intent was different, adjust the Pin Guard logic that reads
.github/tauri-cef-expected-sha to accept the new pin) so the pin and guard
remain atomic and the PR becomes mergeable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 25143c12-ffef-4eb6-a7d5-c5abe2699a97
📒 Files selected for processing (3)
.github/tauri-cef-expected-sha.github/workflows/tauri-cef-pin-guard.ymlapp/src-tauri/vendor/tauri-cef
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the latest commit SHA for actions/checkout v5?
💡 Result:
The latest release for actions/checkout v5 is v5.0.1, which corresponds to commit SHA 93cb6ef [1]. While the repository has continued to receive updates and has since moved on to v6, v5.0.1 remains the final tagged release for the v5 series [2][1]. You can verify this by checking the official tags page for the actions/checkout repository [2].
Citations:
- 1: https://redirect.github.com/actions/checkout/releases/tag/v5.0.1
- 2: https://github.com/actions/checkout/tags
🏁 Script executed:
cat -n .github/workflows/tauri-cef-pin-guard.yml | head -40Repository: tinyhumansai/openhuman
Length of output: 2079
🏁 Script executed:
# Check for any documented policies or exceptions about action pinning
find . -type f \( -name "*.md" -o -name "*.txt" \) | xargs grep -l "action.*pin\|mutable.*tag" 2>/dev/null | head -5Repository: tinyhumansai/openhuman
Length of output: 265
🏁 Script executed:
# Check if there are other GitHub actions in the repo and their pinning status
grep -r "uses: " .github/workflows/ 2>/dev/null | head -20Repository: tinyhumansai/openhuman
Length of output: 1500
🏁 Script executed:
cat gitbooks/developing/release-policy.mdRepository: tinyhumansai/openhuman
Length of output: 8450
Pin GitHub Action to commit SHA for supply chain security.
actions/checkout@v5 uses a mutable tag reference. Change to uses: actions/checkout@93cb6ef (v5.0.1) to pin to a specific commit and prevent supply chain attacks if the tag is moved. This is especially important for this workflow, which exists to guard against unintended submodule pin changes.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 28-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tauri-cef-pin-guard.yml at line 29, Replace the mutable
tag reference for the checkout action by pinning to the specific commit SHA:
change the uses entry that currently reads actions/checkout@v5 to
actions/checkout@93cb6ef so the workflow is locked to the exact commit and
prevents supply-chain risks; update the uses line in the tauri-cef-pin-guard.yml
file accordingly.
There was a problem hiding this comment.
Declining the SHA-pin here for consistency: every actions/checkout reference in this repo is unpinned @v5 (41/41 occurrences across all 20 workflows). Pinning only this new file to a commit hash would make it the lone inconsistent workflow. A hash-pinning policy is reasonable but should be applied repo-wide in a dedicated change, not introduced piecemeal in an unrelated submodule-pin fix. Matching the established convention here.
There was a problem hiding this comment.
@sanil-23, that's a fair call — patchy pinning would be more confusing than helpful, and keeping this workflow consistent with the other 20 is the right move for now. I'll record the repo convention so this isn't flagged again on future PRs.
Would you like me to open a follow-up issue to track applying a repo-wide actions/checkout commit-SHA pinning policy as a dedicated change?
(´･ω･`) 🐇
✏️ Learnings added
Learnt from: sanil-23
Repo: tinyhumansai/openhuman PR: 2236
File: .github/workflows/tauri-cef-pin-guard.yml:29-29
Timestamp: 2026-05-19T18:29:31.052Z
Learning: In the tinyhumansai/openhuman repository, all GitHub Actions `actions/checkout` references are intentionally left as unpinned mutable tags (e.g. `v5`) — 41 occurrences across 20 workflows. Do not flag individual workflow files for not pinning `actions/checkout` to a commit SHA; any such policy change should be applied repo-wide in a dedicated PR, not piecemeal.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: senamakel
Repo: tinyhumansai/openhuman PR: 1107
File: .github/workflows/weekly-code-review.yml:29-30
Timestamp: 2026-05-02T20:45:07.741Z
Learning: In this repository, workflows may reference the CI image tag `ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0` using a mutable tag (not a digest). Do not flag this as a security/best-practice issue in future reviews as long as the tag is intentionally used and corresponds to this repo’s documented refresh mechanism (the tag is refreshed by `docker-ci-image.yml` when `.github/Dockerfile` changes), which avoids requiring coordinated multi-workflow PRs and prevents breaking in-flight branches.
…ai#2154 review) Addresses CodeRabbit/zizmor 'artipacked' finding on PR tinyhumansai#2236: the pin-guard only reads files, so credential persistence is unnecessary attack surface. Co-Authored-By: Claude <noreply@anthropic.com>
|
@coderabbitai review All three prior comments are resolved: |
|
✅ Actions performedFull review triggered. |
graycyrus
left a comment
graycyrus
left a comment
There was a problem hiding this comment.
Looks good, nice work!
tinyhumansai#2154) (tinyhumansai#2236) Co-authored-by: Cyrus Gray <cyrus@tinyhumans.ai>
2 participants
Summary
libm.so.6; on Ubuntu 24.x (GLIBC 2.39) it shadows the host libm, NSS fails to load the hostlibsqlite3(nss_error=-5925), and the app crashes on startup (App crashes on startup due to bundled libm.so.6 conflicting with system libsqlite3 #2154) and on the post-login restart (AppImage crashes on Ubuntu 24.04 after login: GLIBC_2.38 not found in bundled libm.so.6 #2088).chore(branding): update all app icons and logos, commit983f2971) reverted theapp/src-tauri/vendor/tauri-cefsubmodule pine22ec719→f75bc21f, undoing the library-exclusion fixes from fix(linux): update tauri-cef submodule to exclude glibc libraries #1996 and fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032.e22ec719and adds a lightweight CI guard so a non-Linux PR can't silently revert it again.Problem
lib4binin the vendored bundler copies everyNEEDEDlib (incl.libm.so.6) into the AppImageshared/lib/. PRs #1996 (exclude glibc libraries) and #2032 (exclude bundled NSS libs) fixed this by pinningtauri-cefto a commit that excludes glibc-core/NSS libs (e22ec719). Commit983f2971— a branding/icons PR (#2110) with no Linux scope — reverted the gitlink to the oldf75bc21f, silently reintroducing the bundled libm and the Ubuntu 24.x crash. The bad pin is still onmain.Solution
app/src-tauri/vendor/tauri-cef→e22ec719034fdac3994c42a3c040fafa10672219(the value set by fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032; was onmainuntil chore(branding): update all app icons and logos to new brand kit #2110). This re-applies fix(linux): update tauri-cef submodule to exclude glibc libraries #1996 + fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032 with a single gitlink change — no bundler/workflow surgery needed..github/tauri-cef-expected-sha+.github/workflows/tauri-cef-pin-guard.yml: a tinypull_requestjob that fails if the committed gitlink no longer matches the recorded SHA, with a message pointing at this exact regression. Intentional future bumps just update the one-line expected-sha file.Why not the workflow strip/repack approach: it would be ~370 lines of fragile post-build AppImage unpack/repack/re-sign with several unverifiable assumptions, to work around a problem whose actual cause is a trivial accidental revert of a known-good pin.
Resolves #2088 automatically — its
tauri-runtime-cef/src/lib.rs:2071panic is the CEF-initassert_eq!(cef::initialize, 1)failing because NSS aborted; with libm no longer shadowed, init succeeds.Submission Checklist
tauri-cef-pin-guardCI job is the regression guard (asserts the pin can't silently revert again; the original fix already shipped its own validation in fix(linux): update tauri-cef submodule to exclude glibc libraries #1996/fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032)N/A: changed lines are a submodule gitlink + CI YAML + a SHA file, not instrumentable bydiff-cover. The pin-guard job is the regression gate.N/A: build-config-only changeN/A: build/packagingN/A: submodule pin restore; Linux launch already in release smokeCloses #NNNImpact
Related
983f2971); restores fix(linux): update tauri-cef submodule to exclude glibc libraries #1996 + fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032.AI Authored PR Metadata
Linear Issue
Commit & Branch
Validation Run
pnpm --filter openhuman-app format:check— N/A: no JS/TS changedpnpm typecheck— N/A: no TS changedtauri-cef-pin-guardjob self-tested locally (expected SHA == committed gitlink → PASS)Validation Blocked
--no-verify; project Rust/TS gates still run in CI on this PR. Linux launch is gated by the existing release/installer smoke + the new pin guard.Behavior Changes
libm.so.6nss_error=-5925)Parity Contract
e22ec719) that shipped in fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032; no new behavior introducedDuplicate / Superseded PR Handling
Co-Authored-By: Claude noreply@anthropic.com
Summary by CodeRabbit