[Bug] AppImage launch failure on Arch Linux/Hyprland: NSS version mismatch and X11 BadWindow errors

[ahmedashrafcds]

The openhuman AppImage (v0.53.x) fails to launch on Arch Linux running the Hyprland compositor. The failure appears to be a combination of bundled library conflicts (NSS/GLIBC) and a window configuration race condition when the "mascot" or UI attempts to initialize X11 properties.

Environment:

• OS: Arch Linux (Rolling)
• Kernel: 6.x+
• Desktop Environment/Compositor: Hyprland (Wayland + XWayland)
• Graphics: Intel Kaby Lake-H GT2 [HD Graphics 630]
• App Version: 0.53.43 (AppImage)

Steps to Reproduce:

1. Download the latest Linux AppImage.
2. Attempt to run via terminal: ./openhuman or /home/ahmed/.local/bin/openhuman.
3. The application crashes immediately after GTK initialization.

Relevant Logs & Errors:

1. NSS Library Mismatch:
The bundled libnssutil3.so is older than what the host's libsoftokn3.so expects, causing a fatal crash in the crypto initialization:

[ERROR:crypto/nss_util.cc:256] Error initializing NSS with a persistent database (sql:/home/ahmed/.pki/nssdb): 
.../shared/lib/libnssutil3.so: version `NSSUTIL_3.108' not found (required by /usr/lib/libsoftokn3.so)
[FATAL:crypto/nss_util.cc:146] nss_error=-5925, os_error=0

2. X11 BadWindow Error:
The application fails when attempting to configure the window state (likely the "Always on Top" mascot feature) via X11 atoms:

[ERROR:ui/gfx/x/atom_cache.cc:235] Add _NET_WM_STATE_KEEP_ABOVE to kAtomsToCache
X Error of failed request:  BadWindow (invalid Window parameter)
  Major opcode of failed request:  12 (X_ConfigureWindow)
  Resource id in failed request:  0x800001

3. GPU Context Failure:
Hardware acceleration fails to initialize ES 3.0 contexts on Intel integrated graphics:

[ERROR:ui/gl/gl_context_egl.cc:337] eglCreateContext ES 3.0 failed with error EGL_BAD_ATTRIBUTE
[ERROR:gpu/ipc/service/gpu_channel_manager.cc:919] ContextResult::kFatalFailure: Failed to create shared context for virtualization.

Analysis:

• Bundling Strategy: On rolling-release distros, bundling core system libraries like libnss or libc in an AppImage often leads to symbol mismatches when those libraries try to interact with host-system plugins (like /usr/lib/libsoftokn3.so).
• XWayland Race Condition: The BadWindow error suggests the app is trying to manipulate X11 window properties before the window is successfully mapped by the compositor.
• CEF/Tauri Shim: The custom CEF shim appears to have hardcoded logic that triggers a re-exec via execlp, which fails with "No such file or directory" when certain flags like --help are passed.

Proposed Mitigation/Feature Request:

• Provide a way to disable the mascot window via a flag (e.g., --no-mascot) to allow the core assistant to run without the complex windowing requirements.
• Consider a "System Libs" fallback or a Flatpak build to better handle library isolation on non-Ubuntu distributions.
• Allow the data directory to be configurable to avoid the "not yet implemented" errors.

[alias8818]

This is the same root cause across #1880, #2001, and #1823 (and likely others on newer distros).

Root Cause

The Linux AppImage is built using a custom Tauri + CEF setup + quick-sharun/lib4bin.

lib4bin only collects libraries that show up as direct/shared-object dependencies during ldd at bundle time.

Chromium’s NSS initialization (crypto/nss_util.cc) does:

NSS_Init("sql:/home/$USER/.pki/nssdb")

This triggers dlopen("libsoftokn3.so") (the PKCS#11 soft token module) at runtime. Because it is not a direct dependency, it is absent from the bundle.

On modern systems (Ubuntu 24.04+, Fedora, Arch, etc.), the host’s libsoftokn3.so gets loaded instead. That version was built against a newer libnssutil3 and requires symbols such as NSSUTIL_3.108. The bundled copy only ships up to NSSUTIL_3.12, producing:

libnssutil3.so: version `NSSUTIL_3.108' not found (required by .../libsoftokn3.so)
FATAL:crypto/nss_util.cc:146  nss_error=-5925

This is why the crash is invisible on the ubuntu-22.04 CI runners but hits users immediately on current distros.

Secondary Issues

The same fragile Linux CEF + sharun path also causes:

• X Error: BadWindow when the mascot tries to set _NET_WM_STATE_KEEP_ABOVE (see the atom_cache calls in the logs)
• EGL/VAAPI context creation failures on Wayland/XWayland

Disabling the mascot Y4M file (~/.openhuman/cache/fake_camera/mascot-*.y4m) eliminated the X11 crash and let the core run stably.

What a Fix Needs

1. NSS bundling — After the Linux cargo tauri build step, explicitly ensure a complete, self-consistent NSS set (libsoftokn3.so, libfreebl3.so + libfreeblpriv3.so, libnssckbi.so, etc.) is present in the AppDir under shared/lib/, shared/lib/firefox/, and shared/lib/nss/.

   Set NSS_DEFAULT_MODULE_DIR in the generated AppRun/AppRun.lib so the bundled modules are preferred over the host’s.

2. Mascot / X11 robustness — Make the always-on-top mascot window creation defensive (or add --no-mascot / env var) on Linux.

3. CI — Add at least one build/test on a newer base (ubuntu-24.04 or equivalent) so this class of packaging regression is caught before release.

Local Workarounds That Worked

• sudo mask of host libsoftokn3.so + NSS_DISABLE_DATABASE=1 + NSS_DEFAULT_DB_TYPE=extern
• Extracted AppImage + replace bundled glibc bits with host versions + symlink host libsoftokn3.so into shared/lib/ + force X11 + disable GPU
• Temporarily moving the mascot Y4M file aside

I can provide the exact patch shape for the workflow + AppRun if maintainers want to take this on.