From aafd237db2a46c95fc0b005e52eb429262c95053 Mon Sep 17 00:00:00 2001
From: Loren Eteval <loren.eteval@proton.me>
Date: Sat, 29 Aug 2026 20:20:06 +0800
Subject: [PATCH] fix: harden Flatpak dependency verification

Signed-off-by: Loren Eteval <loren.eteval@proton.me>
---
 .github/workflows/deploy-pypi.yml | 47 ++++++++++++++++++++++++-------
 Deploy.py                         |  1 +
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy-pypi.yml b/.github/workflows/deploy-pypi.yml
index 4ceb1ac..26fd8a4 100644
--- a/.github/workflows/deploy-pypi.yml
+++ b/.github/workflows/deploy-pypi.yml
@@ -656,33 +656,60 @@ jobs:
 
           trap cleanup EXIT
 
-          flatpak run --user --command=sh com.Furious.Furious -c '
-            set -eu
+          flatpak run --user --command=bash com.Furious.Furious -c '
+            set -uo pipefail
 
             application_root=/app/lib/Furious
             dependency_report=/tmp/furious-flatpak-missing-dependencies
+            failures=0
 
-            test -x "$application_root/Furious.bin"
-            test -f /app/lib/libdouble-conversion.so.3
             : > "$dependency_report"
 
-            find "$application_root" \
-              -type f \
-              \( -name "*.bin" -o -name "*.so" -o -name "*.so.*" \) \
-              -print |
+            if [[ ! -x "$application_root/Furious.bin" ]]; then
+              printf "Packaged application is missing or not executable: %s\n" \
+                "$application_root/Furious.bin" >> "$dependency_report"
+              failures=1
+            fi
+
+            double_conversion="$(
+              find /app/lib -type f -name "libdouble-conversion.so.*" \
+                -print -quit 2>> "$dependency_report"
+            )"
+
+            if [[ -z "$double_conversion" ]]; then
+              printf "Bundled libdouble-conversion.so.3 was not found below /app/lib\n" \
+                >> "$dependency_report"
+              failures=1
+            else
+              printf "Bundled double-conversion library: %s\n" "$double_conversion"
+            fi
+
+            if ! command -v ldd >/dev/null; then
+              printf "The Flatpak runtime does not provide ldd\n" \
+                >> "$dependency_report"
+              failures=1
+            else
               while IFS= read -r binary; do
                 if ! dependencies="$(ldd "$binary" 2>&1)"; then
                   printf "%s\n%s\n\n" \
                     "Failed to inspect $binary:" \
                     "$dependencies" >> "$dependency_report"
+                  failures=1
                 elif printf "%s\n" "$dependencies" | grep -Fq "not found"; then
                   printf "%s\n%s\n\n" \
                     "Missing dependencies for $binary:" \
                     "$dependencies" >> "$dependency_report"
+                  failures=1
                 fi
-              done
+              done < <(
+                find "$application_root" \
+                  -type f \
+                  \( -name "*.bin" -o -name "*.so" -o -name "*.so.*" \) \
+                  -print
+              )
+            fi
 
-            if test -s "$dependency_report"; then
+            if ((failures)); then
               cat "$dependency_report"
               exit 1
             fi
diff --git a/Deploy.py b/Deploy.py
index 2238ca5..e7b987b 100644
--- a/Deploy.py
+++ b/Deploy.py
@@ -1052,6 +1052,7 @@ def main():
                     f'    config-opts:\n'
                     f'      - -DBUILD_SHARED_LIBS=ON\n'
                     f'      - -DBUILD_TESTING=OFF\n'
+                    f'      - -DCMAKE_INSTALL_LIBDIR=lib\n'
                     f'    sources:\n'
                     f'      - type: archive\n'
                     f'        url: https://github.com/google/double-conversion/archive/refs/tags/v3.3.1.tar.gz\n'