AppImageUpdate and appimageupdatetool not working out of the box on opensuse tumbleweed

[gagahpangeran]

Basically I got this error message every time I try to update some AppImage using AppImageUpdate or appimageupdatetool from this repo. For simplicity I run appimageupdatetool with self update flag.

$ ./appimageupdatetool-x86_64.AppImage --self-update
Checking for updates...
Fetching release information for tag "continuous" from GitHub API.
GitHub API request failed!
Could not find any artifacts in release data. Please contact the author of the AppImage and tell them the files are missing on the releases page.
ZSync URL not available. See previous messages for details.
Update check failed, exiting!

Try running with CURLOPT_VERBOSE=1 but the error still the same.

---

I try to get some hint by adding this line of code.

diff --git a/src/updater.cpp b/src/updater.cpp
index 3c47704..4dc313a 100644
--- a/src/updater.cpp
+++ b/src/updater.cpp
@@ -346,6 +346,8 @@ namespace appimage {
                             int downloadUrlLines = 0;
                             int matchingUrls = 0;
 
+                           issueStatusMessage(response.error.message);
+
                             // continue only if HTTP status is good
                             if (response.status_code >= 200 && response.status_code < 300) {
                                 // in contrary to the original implementation, instead of converting wildcards into

Then I build using docker.

env ARCH=x86_64 DIST=xenial bash -ex ci/build-in-docker.sh

I try to run the appimageupdatetool again and get this new error.

$ ./appimageupdatetool-x86_64.AppImage ~/osu/osu.AppImage
Checking for updates...
Fetching latest release information from GitHub API
error setting certificate verify locations:
  CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
GitHub API request failed!
Could not find any artifacts in release data. Please contact the author of the AppImage and tell them the files are missing on the releases page.
ZSync URL not available. See previous messages for details.
Update check failed, exiting!

You can see I got new error

error setting certificate verify locations:
  CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs

After some investigation, this happen because this tools is using CPR to perform request and CPR itself using local ssl certificate to fetch https request.

Because the appimage is built using ubuntu image, CPR assume the location of certificate is in that location. While opensuse using different ssl certificate location.

I worked around this issue by symlink my local certificate.

sudo ln -s /var/lib/ca-certificates/ca-bundle.pem /etc/ssl/certs/ca-certificates.crt

Now I run appimageupdatetool again and it's working.

appimageupdatool local build

$ ./appimageupdatetool-x86_64.AppImage --self-update
Checking for updates...
Fetching release information for tag "continuous" from GitHub API.

... done!
Starting update...

Fetching release information for tag "continuous" from GitHub API.
0% done

Updating from GitHub Releases via ZSync
0% done
zsync2: /home/gpr/gitgud/AppImageUpdate/appimageupdatetool-x86_64.AppImage found, using as seed file
zsync2: Target file: /home/gpr/gitgud/AppImageUpdate/appimageupdatetool-x86_64.AppImage
zsync2: Reading seed file: /home/gpr/gitgud/AppImageUpdate/appimageupdatetool-x86_64.AppImage
zsync2: Usable data from seed files: 72.583105%
zsync2: Renaming temp file
zsync2: Fetching remaining blocks
72.58% done (4.65 of 6.40 MiB)...
zsync2: Downloading from https://objects.githubusercontent.com/github-production-release-asset-2e65be/84325774/f3797ada-8143-499c-ae10-2aac8be1fb3e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20211116%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20211116T084739Z&X-Amz-Expires=300&X-Amz-Signature=249bc72c9a71f6b92b90b600c16bb5c01a627698df55c137e5dc94d091284434&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=84325774&response-content-disposition=attachment%3B%20filename%3Dappimageupdatetool-x86_64.AppImage&response-content-type=application%2Foctet-stream
zsync2: optimized ranges, old requests count 7, new requests count 3

99.91% done (6.40 of 6.40 MiB)...
zsync2: Verifying downloaded file
100.00% done (6.40 of 6.40 MiB)...
zsync2: checksum matches OK
zsync2: used 4874240 local, fetched 1903808
100.00% done (6.40 of 6.40 MiB)...
Validation warning: AppImage not signed
Update successful. New file created: /home/gpr/gitgud/AppImageUpdate/appimageupdatetool-x86_64.AppImage

appimageupdatool from this repo

$ ./appimageupdatetool-x86_64.AppImage --self-update
Checking for updates...
Fetching release information for tag "continuous" from GitHub API.
... done!
Update not required, exiting.

Probably this is also the reason of some update failed in other distro because their ssl certificate is located in different location.

---

From openssl/openssl#7481 (comment), these are some location of certificate on different distro.

"/etc/ssl/certs/ca-certificates.crt",     // Debian/Ubuntu/Gentoo etc.
"/etc/pki/tls/certs/ca-bundle.crt",       // Fedora/RHEL
"/etc/ssl/ca-bundle.pem",                 // OpenSUSE
"/etc/pki/tls/cacert.pem",                // OpenELEC
"/etc/ssl/certs",                         // SLES10/SLES11, https://golang.org/issue/12139
"/usr/share/ca-certs/.prebuilt-store/"    // Clear Linux OS; https://github.com/knapsu/plex-media-player-appimage/issues/17#issuecomment-437710032
"/system/etc/security/cacerts"            // Android

Also in that issue also discuss how to handle different certificate location when using AppImage.

Of course this problem is not directly AppImage update issue, but more like CPR issue. From CPR repo, there's this issue libcpr/cpr#445 but I don't know if they will handle distro specific certificate or not in the future.

Also this project is using it's own CPR fork from zsync2 to submodule. Maybe it's easier to add some patch to that fork for this issue 🤔

---

tl;dr: AppImageUpdate and appimageupdatetool from this repo is not working on opensuse tumbleweed (and probably on some other distro) because of ssl certificate location issue.

Workaround for opensuse tumbleweed

sudo ln -s /var/lib/ca-certificates/ca-bundle.pem /etc/ssl/certs/ca-certificates.crt

For other distro, try symlink your distro ssl certificate to /etc/ssl/certs/ca-certificates.crt or built the AppImageUpdate locally in your machine.

---

I hope this issue can be resolved because my expectation when running AppImage is it will run out of the box on any distro and sorry for the long post.

Thank you! 😄

[nemith]

This was my exact problem with Fedora, thanks for the workaround.