fix(appimage): bump the Tauri CLI and guard AppDir permissions

[drmowinckels]

Summary

The AppImage catalog retest on 0.0.13 (appimage.github.io#9123) got past .DirIcon — that fix did land — and failed on something worse:

/run/firejail/appimage/AppRun: line 12: /run/firejail/appimage/AppRun.wrapped: Permission denied
ERROR: The application exited within 11 seconds instead of showing a window

AppRun.wrapped is packaged -rwxrwx---. This is tauri-apps/tauri#16155: write_and_make_executable sets 0o770 on every tool the bundler downloads, and fs::copy carries that mode into <AppDir>/AppRun, which linuxdeploy-plugin-gtk renames to AppRun.wrapped.

Scope of the bug, stated precisely: launched the normal way this is invisible, because the runtime's FUSE mount reports the files as owned by whoever started the image, so the owner bits apply. It only bites when root mounts the image and a different user runs it — firejail --appimage, which is exactly how the catalog tests submissions, and some sandboxed launchers. So this is not "the AppImage is broken for everyone"; ordinary double-click and shell launches were fine.

What changed

• @tauri-apps/cli 2.11.5 → 2.12.1. Upstream closed #16155 as completed, and the maintainer's comment says it is "fixed in 2.12 already".
• The preview job's existing Verify AppImage AppDir files step now also asserts AppDir permissions.

The tauri crate deliberately stays on 2.11.1 — the bug is in the bundler, which ships with the CLI, and moving the runtime risks the cold-overlay regressions from #196/#226 for no benefit here.

Why the version bump alone isn't the whole change

I could not verify upstream's claim, and the source contradicts it. On dev HEAD, crates/tauri-bundler/src/bundle/linux/appimage/mod.rs still reads:

fs::set_permissions(path, fs::Permissions::from_mode(0o770))?;

and linuxdeploy.rs still does a plain fs::copy of AppRun-<arch> into the AppDir, which preserves the mode. The bundler CHANGELOG has no entry for it either (newest is 2.10.1). So the bump may well not fix it.

Rather than cut a release to find out, the preview check now asserts the invariant directly, as a general property instead of against AppRun by name:

• every AppDir entry is world-readable;
• every owner-executable file is world-executable.

That is what chmod -R a+rX AppDir would guarantee, and it is what the catalog actually requires. If 2.12.1 does not fix it, this check fails and names the offending paths instead of us shipping a third rejected AppImage.

Verification

I ran audit:workflow-shell (82 steps parse) and actionlint — both clean — plus format:check and audit:spell. The permission assertion itself needs GNU find -printf, so it cannot run on macOS; it is exercised by adding the build:installers label to this PR, which builds a real AppImage on ubuntu-22.04. I am doing that now and will report what the check says.

No tests: this is a toolchain version bump plus a CI assertion, with no application code to exercise.

Next step after this merges

The catalog tests the latest release, so clearing #9123 needs a release built with whatever actually fixes the mode, then /retest on that PR.

🤖 Generated with Claude Code

[github-actions]

🔍 Advisory audit report

These checks don't block merges — they surface drift in dependencies, licensing, and external links.

cargo-deny

⚠️ findings

�[0m�[1m�[38;5;9merror[vulnerability]�[0m�[1m: Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow�[0m
    �[0m�[36m┌─�[0m /home/runner/work/entracte/entracte/src-tauri/Cargo.lock:560:1
    �[0m�[36m│�[0m
�[0m�[36m560�[0m �[0m�[36m│�[0m �[0m�[31mwasmtime 43.0.2 registry+https://github.com/rust-lang/crates.io-index�[0m
    �[0m�[36m│�[0m �[0m�[31m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━�[0m �[0m�[31msecurity vulnerability detected�[0m
    �[0m�[36m│�[0m
    �[0m�[36m├�[0m ID: RUSTSEC-2026-0327
    �[0m�[36m├�[0m Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0327
    �[0m�[36m├�[0m This is an entry in the RustSec database for the Wasmtime security advisory
      located at
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c
      For more information see the GitHub-hosted security advisory.
    �[0m�[36m├�[0m Announcement: https://github.com/bytecodealliance/wasmtime/pull/14471
    �[0m�[36m├�[0m Solution: Upgrade to >=48.0.4, <49.0.0 OR >=49.0.2 (try `cargo update -p wasmtime`)
    �[0m�[36m├�[0m wasmtime v43.0.2
      ├── extism v1.30.0
      │   └── entracte v0.0.13
      ├── wasi-common v43.0.2
      │   └── extism v1.30.0 (*)
      └── wiggle v43.0.2
          ├── extism v1.30.0 (*)
          └── wasi-common v43.0.2 (*)

advisories �[31mFAILED�[0m, bans �[32mok�[0m, licenses �[32mok�[0m, sources �[32mok�[0m

lychee (broken links)

✅ all links resolve

npm audit

⚠️ findings

# npm audit report

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
fix available via `npm audit fix --force`
Will install stylelint@7.7.0, which is a breaking change
node_modules/braces
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/fast-glob
      globby  >=8.0.0
      Depends on vulnerable versions of fast-glob
      node_modules/globby
        stylelint  >=7.7.1
        Depends on vulnerable versions of fast-glob
        Depends on vulnerable versions of globby
        Depends on vulnerable versions of micromatch
        node_modules/stylelint
          stylelint-config-recommended  *
          Depends on vulnerable versions of stylelint
          node_modules/stylelint-config-recommended
            stylelint-config-standard  >=16.0.0
            Depends on vulnerable versions of stylelint
            Depends on vulnerable versions of stylelint-config-recommended
            node_modules/stylelint-config-standard

smol-toml  <=1.8.0
Severity: moderate
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line - https://github.com/advisories/GHSA-r4xh-jqrq-34v2
fix available via `npm audit fix`
node_modules/smol-toml

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js

9 vulnerabilities (1 moderate, 8 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

[github-actions]

📖 Docs preview

✅ Built and deployed for commit 359c7968ec74489f593dbf79cf281baee2a37d18.

Preview URL	https://pr-373--entract.netlify.app
Build logs	https://github.com/drmowinckels/entracte/actions/runs/37449921835

_{Posted by docs-preview.yml — updates in place on every push.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.72%. Comparing base (236f4e7) to head (359c796).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #373      +/-   ##
==========================================
- Coverage   89.72%   89.72%   -0.01%     
==========================================
  Files         148      148              
  Lines       25671    25671              
  Branches      861      861              
==========================================
- Hits        23034    23033       -1     
- Misses       2611     2612       +1     
  Partials       26       26              

Flag	Coverage Δ
frontend	90.39% <ø> (ø)
rust	89.64% <ø> (-0.01%)	⬇️

Components	Coverage Δ
Frontend (TypeScript)	90.39% <ø> (ø)
Backend (Rust)	89.64% <ø> (-0.01%)	⬇️
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.