[Bug] AppImage launch failure on Arch Linux/Hyprland: NSS version mismatch and X11 BadWindow errors

The openhuman AppImage (v0.53.x) fails to launch on Arch Linux running the Hyprland compositor. The failure appears to be a combination of bundled library conflicts (NSS/GLIBC) and a window configuration race condition when the "mascot" or UI attempts to initialize X11 properties.

Environment:

OS: Arch Linux (Rolling)
Kernel: 6.x+
Desktop Environment/Compositor: Hyprland (Wayland + XWayland)
Graphics: Intel Kaby Lake-H GT2 [HD Graphics 630]
App Version: 0.53.43 (AppImage)

Steps to Reproduce:

Download the latest Linux AppImage.
Attempt to run via terminal: ./openhuman or /home/ahmed/.local/bin/openhuman.
The application crashes immediately after GTK initialization.

Relevant Logs & Errors:

1. NSS Library Mismatch:
The bundled libnssutil3.so is older than what the host's libsoftokn3.so expects, causing a fatal crash in the crypto initialization:

[ERROR:crypto/nss_util.cc:256] Error initializing NSS with a persistent database (sql:/home/ahmed/.pki/nssdb): 
.../shared/lib/libnssutil3.so: version `NSSUTIL_3.108' not found (required by /usr/lib/libsoftokn3.so)
[FATAL:crypto/nss_util.cc:146] nss_error=-5925, os_error=0

2. X11 BadWindow Error:
The application fails when attempting to configure the window state (likely the "Always on Top" mascot feature) via X11 atoms:

[ERROR:ui/gfx/x/atom_cache.cc:235] Add _NET_WM_STATE_KEEP_ABOVE to kAtomsToCache
X Error of failed request:  BadWindow (invalid Window parameter)
  Major opcode of failed request:  12 (X_ConfigureWindow)
  Resource id in failed request:  0x800001

3. GPU Context Failure:
Hardware acceleration fails to initialize ES 3.0 contexts on Intel integrated graphics:

[ERROR:ui/gl/gl_context_egl.cc:337] eglCreateContext ES 3.0 failed with error EGL_BAD_ATTRIBUTE
[ERROR:gpu/ipc/service/gpu_channel_manager.cc:919] ContextResult::kFatalFailure: Failed to create shared context for virtualization.

Analysis:

Bundling Strategy: On rolling-release distros, bundling core system libraries like libnss or libc in an AppImage often leads to symbol mismatches when those libraries try to interact with host-system plugins (like /usr/lib/libsoftokn3.so).
XWayland Race Condition: The BadWindow error suggests the app is trying to manipulate X11 window properties before the window is successfully mapped by the compositor.
CEF/Tauri Shim: The custom CEF shim appears to have hardcoded logic that triggers a re-exec via execlp, which fails with "No such file or directory" when certain flags like --help are passed.

Proposed Mitigation/Feature Request:

Provide a way to disable the mascot window via a flag (e.g., --no-mascot) to allow the core assistant to run without the complex windowing requirements.
Consider a "System Libs" fallback or a Flatpak build to better handle library isolation on non-Ubuntu distributions.
Allow the data directory to be configurable to avoid the "not yet implemented" errors.

This is the same root cause across #1880, #2001, and #1823 (and likely others on newer distros).

Root Cause

The Linux AppImage is built using a custom Tauri + CEF setup + quick-sharun/lib4bin.

lib4bin only collects libraries that show up as direct/shared-object dependencies during ldd at bundle time.

Chromium’s NSS initialization (crypto/nss_util.cc) does:

NSS_Init("sql:/home/$USER/.pki/nssdb")

This triggers dlopen("libsoftokn3.so") (the PKCS#11 soft token module) at runtime. Because it is not a direct dependency, it is absent from the bundle.

On modern systems (Ubuntu 24.04+, Fedora, Arch, etc.), the host’s libsoftokn3.so gets loaded instead. That version was built against a newer libnssutil3 and requires symbols such as NSSUTIL_3.108. The bundled copy only ships up to NSSUTIL_3.12, producing:

libnssutil3.so: version `NSSUTIL_3.108' not found (required by .../libsoftokn3.so)
FATAL:crypto/nss_util.cc:146  nss_error=-5925

This is why the crash is invisible on the ubuntu-22.04 CI runners but hits users immediately on current distros.

Secondary Issues

The same fragile Linux CEF + sharun path also causes:

X Error: BadWindow when the mascot tries to set _NET_WM_STATE_KEEP_ABOVE (see the atom_cache calls in the logs)
EGL/VAAPI context creation failures on Wayland/XWayland

Disabling the mascot Y4M file (~/.openhuman/cache/fake_camera/mascot-*.y4m) eliminated the X11 crash and let the core run stably.

What a Fix Needs

NSS bundling — After the Linux cargo tauri build step, explicitly ensure a complete, self-consistent NSS set (libsoftokn3.so, libfreebl3.so + libfreeblpriv3.so, libnssckbi.so, etc.) is present in the AppDir under shared/lib/, shared/lib/firefox/, and shared/lib/nss/.

Set NSS_DEFAULT_MODULE_DIR in the generated AppRun/AppRun.lib so the bundled modules are preferred over the host’s.
Mascot / X11 robustness — Make the always-on-top mascot window creation defensive (or add --no-mascot / env var) on Linux.
CI — Add at least one build/test on a newer base (ubuntu-24.04 or equivalent) so this class of packaging regression is caught before release.

Local Workarounds That Worked

sudo mask of host libsoftokn3.so + NSS_DISABLE_DATABASE=1 + NSS_DEFAULT_DB_TYPE=extern
Extracted AppImage + replace bundled glibc bits with host versions + symlink host libsoftokn3.so into shared/lib/ + force X11 + disable GPU
Temporarily moving the mascot Y4M file aside

I can provide the exact patch shape for the workflow + AppRun if maintainers want to take this on.

fix(appimage): exclude NSS/NSPR libraries to prevent dlopen crashes o…

Follow-up note for anyone landing here from search:

PR #2032 closed this by fixing item #1 (the NSS NSSUTIL_3.108 crash). It did not fix:

Item #2 — X_ConfigureWindow BadWindow on _NET_WM_STATE_KEEP_ABOVE. Reproduces on every Wayland session (GNOME, KDE, Hyprland — XWayland is XWayland regardless of compositor), not just Hyprland. Verified on Ubuntu 26.04 GNOME-Wayland.
A latent regression introduced by PR fix(linux): exclude bundled NSS libs so AppImage launches on Arch / rolling distros #2032's chain (fix(appimage): exclude NSS/NSPR libraries to prevent dlopen crashes on rolling distros tauri-cef#15): the NSS exclude list also stripped ld-linux from the AppImage's shared/lib/, leaving sharun unable to bootstrap → Interpreter not found! before chromium even initializes. On hosts with snap-managed apps, the same exclude sweep also missed nested copies of libc.so mirrored into shared/lib/snap/..., breaking GLIBC_2.x lookups.

Three follow-up PRs land the rest:

fix(appimage): keep ld-linux bundled + recurse exclude into nested dirs tauri-cef#16 — keep ld-linux + recurse the exclude sweep
fix(linux): install silent X error handler to fix BadWindow exit on Wayland #2096 — install a silent XSetErrorHandler so XWayland BadWindows can't kill the parent process
chore(deps): bump tauri-cef for AppImage launch fixes #2097 — submodule bump to pull the tauri-cef fix in

After all three merge, items #1 and #2 from the original report are resolved end-to-end and the AppImage launches normally on rolling/newer distros. Item #3 (EGL/VAAPI on Intel iGPUs) is already gated by --disable-gpu per #1697 and not in scope here.

fix(appimage): keep ld-linux bundled + recurse exclude into nested dirs

Navigation Menu

Repository navigation

[Bug] AppImage launch failure on Arch Linux/Hyprland: NSS version mismatch and X11 BadWindow errors #2001

Environment:

Steps to Reproduce:

Relevant Logs & Errors:

Analysis:

Proposed Mitigation/Feature Request:

Root Cause

Secondary Issues

What a Fix Needs

Local Workarounds That Worked

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug] AppImage launch failure on Arch Linux/Hyprland: NSS version mismatch and X11 BadWindow errors #2001

Description

Environment:

Steps to Reproduce:

Relevant Logs & Errors:

Analysis:

Proposed Mitigation/Feature Request:

Activity

aliasocracy commented on May 17, 2026

Root Cause

Secondary Issues

What a Fix Needs

Local Workarounds That Worked

Muscolino96 commented on May 18, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions