[boggedbrush]

Cause

The v1.3.3 repacking step stored all 11 SquashFS directories as root-owned mode 0700, including the filesystem root, resources, locales, and the Python backend directory. Firejail honors those permissions and cannot access the application. The files themselves have executable/readable permissions; changing only AppRun would not fix it.

Confirmed against the released artifact SHA-256 d692a93b5380c30e7943730f6343917d01059055d145de7ee7601fbe6bed128a using unsquashfs -lln. The extraction-based test missed the stored directory permissions.

Catalog failure: AppImage/appimage.github.io#4940 (comment)

Changes

• Normalize every AppDir directory to 0755 before repacking.
• Validate every stored SquashFS directory before extraction.
• Run the 800×600 smoke test both through Firejail and through extraction.
• Use the catalog's Firejail build and musl runtime, pinned and SHA-256 verified, with the catalog's launch options (--noprofile --net=none --appimage).
• Isolate test configuration and clean up process groups between launches.
• Capture the screenshot from the Firejail run.
• Bump the application version to v1.3.4 and add matching release notes for the stable workflow.

Validation

• New filesystem permission check rejects the released v1.3.3 artifact.
• YAML and modified Bash steps pass syntax checks.
• Linux Build passed on commit 69e933c, including both GUI launch modes, embedded update information, extraction, zsync output, scan, and artifact upload. The first attempt passed the app checks but hit a GitHub API rate limit during the existing VirusTotal CLI lookup; the retry passed.
• Firejail screenshot. The screenshot from the first attempt at this same commit was inspected and shows the main dashboard at 800×600.
• Codex review of the current head found no major issues.
• Linux Build passed on the v1.3.4 metadata commit a307e8e, including the Firejail and extraction GUI tests. The first attempt hit the GitHub API rate limit in the pre-existing VirusTotal CLI lookup; the retry passed.

The application version and release notes now target v1.3.4. The published v1.3.3 remains affected; merge this PR, publish v1.3.4, and request an upstream /retest.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T19:16:50.921992Z	a307e8e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[boggedbrush]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 27ce70adde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[boggedbrush]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 69e933c828

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[boggedbrush]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: a307e8e79f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".