[senamakel]

Summary

Extend the AppImage bundler's library-exclude list (added in f9213d5 for glibc) to also drop the bundled NSS/NSPR family from $APPDIR/shared/lib.

On rolling distros (Arch, Fedora rolling, etc.) Chromium/CEF dlopen()s the host's /usr/lib/libsoftokn3.so for PKCS#11. The host's libsoftokn3 requires e.g. NSSUTIL_3.108, which the older bundled libnssutil3.so does not export — the loader sees the bundled lib first via LD_LIBRARY_PATH, can't resolve the version, and the app crashes before any window is shown:

.../shared/lib/libnssutil3.so: version `NSSUTIL_3.108' not found
   (required by /usr/lib/libsoftokn3.so)
[FATAL:crypto/nss_util.cc:146] nss_error=-5925

Reported in tinyhumansai/openhuman#2001.

Verification

Reproduced inside archlinux:latest (linux/amd64) by extracting the v0.53.43 AppImage:

Library	Bundled in AppImage	Host (current Arch)	Required by host libsoftokn3.so
libnssutil3.so defines up to	NSSUTIL_3.94	NSSUTIL_3.117	NSSUTIL_3.108 ❌

dlopen(\"/usr/lib/libsoftokn3.so\") succeeds with no bundled libs in LD_LIBRARY_PATH, and fails (loader aborts the process) once the bundled shared/lib is prepended — confirming the host-symbol vs bundled-NSS mismatch is the launch crash root cause.

Change

Adds these prefixes to exclude_prefixes in sharun_cef.rs:

libnss3.so      libnssutil3.so  libsmime3.so   libssl3.so
libsoftokn3.so  libfreebl3.so   libfreeblpriv3.so
libnspr4.so     libplc4.so      libplds4.so

Same rationale as the glibc-family entries: these libraries cannot safely be bundled because the AppImage runtime mixes them with host libraries loaded at runtime, and a version skew on either side is fatal. Modern desktop Linux always ships an NSS stack (browsers, mail clients depend on it), so deferring to the host is the right trade-off.

Test plan

• cargo check -p tauri-bundler passes locally
• Cut a build with this submodule pointer and re-run the AppImage on the Arch repro container — bundled libnssutil3 should be gone from shared/lib, Chromium crypto init should succeed
• Smoke-test on Ubuntu 22.04 / 24.04 (older but supported targets) to confirm the host NSS path still resolves

Refs tinyhumansai/openhuman#2001

Summary by CodeRabbit

• Chores
  • Refined AppImage bundling configuration to exclude system-level security and cryptography libraries from application packages. Applications will now defer to the host system's implementations instead of including bundled copies, reducing package size and ensuring applications benefit from system security updates without requiring package rebuilds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ffcbec0a-bab0-49a7-b76d-4e96f859506b

📥 Commits

Reviewing files that changed from the base of the PR and between 765886f and e22ec71.

📒 Files selected for processing (1)

• crates/tauri-bundler/src/bundle/linux/appimage/sharun_cef.rs

---

📝 Walkthrough

Walkthrough

The PR expands the AppImage bundler's core system library exclusion logic by updating documentation and adding explicit exclusions for NSS/NSPR-related cryptographic libraries. This prevents the AppImage from bundling outdated versions of these security-sensitive libraries, deferring instead to host-provided versions.

Changes

AppImage NSS/NSPR Exclusions

Layer / File(s)	Summary
NSS/NSPR library exclusions and documentation crates/tauri-bundler/src/bundle/linux/appimage/sharun_cef.rs	The exclude_prefixes documentation is expanded with a multi-paragraph explanation of why core system libraries (glibc, NSS, NSPR) are excluded from bundled AppDir. New exclusion entries are added for NSS/NSPR-related libraries (libnss3, libssl3, libsoftokn3, libfreebl3, libnspr4, libplc4, libplds4) to prevent symbol version mismatches with host-system crypto components.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

• [Bug] AppImage launch failure on Arch Linux/Hyprland: NSS version mismatch and X11 BadWindow errors openhuman#2001: This PR directly addresses the NSS version mismatch crash ("Error initializing NSS with a persistent database") reported in the issue by excluding bundled NSS/NSPR libraries, allowing the AppImage to use the host's crypto components instead.

Possibly related PRs

• tinyhumansai/tauri-cef#14: Both PRs update the same AppImage bundling exclude-list logic in crates/tauri-bundler/src/bundle/linux/appimage/sharun_cef.rs, managing which core system libraries are removed from the AppDir.

Poem

🐰 A bundled libnss caused such grief,
NSS version mismatch beyond belief!
So out went the crypto, the bloat, and the strain,
The host libs shall serve—much cleaner, much sane!
AppImage now lighter, the bundler rings true,
With symbols aligned, the crashes are through! 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: excluding NSS/NSPR libraries from the AppImage to prevent dlopen crashes on rolling distros.
Linked Issues check	✅ Passed	The PR directly addresses the primary coding requirement from issue #2001: eliminating NSS version mismatch by excluding bundled NSS/NSPR libraries from AppImage packaging.
Out of Scope Changes check	✅ Passed	All changes are scoped to the AppImage bundler's library-exclude list in sharun_cef.rs, directly addressing the NSS/NSPR library exclusion requirement with no extraneous modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}