Skip to content

Fixed Ubuntu 22x and Fedora 39x build support #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rvsoni wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Fixed Ubuntu 22x and Fedora 39x build support #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
82d6256
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
96fa186
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
c5ce383
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
abb134a
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
94d1a2f
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
dcd5b3f
Added support of Ubumtu 22+, Fedora 39+
Jul 21, 2026
e1fe667
Added support of Ubumtu 22+, Fedora 39+
Jul 22, 2026
b9c3ba3
Added support of Ubumtu 22+, Fedora 39+
Jul 22, 2026
15a63b2
Added support of Ubumtu 22+, Fedora 39+
Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 114 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
- master
pull_request:

env:
APPIMAGE_EXTRACT_AND_RUN: "1"

jobs:
build-qtwebengine:
runs-on: ubuntu-24.04
Expand Down Expand Up @@ -109,3 +112,114 @@ jobs:
ldd artifacts/webkitgtk/safe-exam-browser | grep -q 'libwebkit2gtk-4.1'
! ldd artifacts/webkitgtk/safe-exam-browser | grep -q 'libQt6WebEngine'
artifacts/webkitgtk/safe-exam-browser --version

# Portable AppImages are built on Ubuntu 22.04 (glibc 2.35) for Ubuntu 22.04+ / Fedora 39+.
# Full AppImage packaging is heavy; run on main/master pushes (not every PR).
build-appimage:
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
runs-on: ubuntu-latest
container:
image: ubuntu:22.04
steps:
- name: Bootstrap container packages
run: |
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
ca-certificates \
git \
wget \
sudo \
binutils

- uses: actions/checkout@v7

- name: Build AppImage artifacts
run: |
chmod +x scripts/build-release.sh
scripts/build-release.sh "0.0.0-ci"

- name: Upload AppImage artifacts
uses: actions/upload-artifact@v7
with:
name: safe-exam-browser-appimage
path: |
dist/*.AppImage
if-no-files-found: error

appimage-smoke-ubuntu:
needs:
- build-appimage
runs-on: ubuntu-24.04
steps:
- name: Install AppImage host runtime libs
run: |
# GL/EGL/OpenGL stay on the host (not bundled). Fonts/GTK bits help the WebKit AppImage.
# AppImages only ship the xcb Qt plugin, so smoke under Xvfb.
sudo apt-get update
sudo apt-get install -y \
libegl1 \
libgl1 \
libgles2 \
libopengl0 \
libfreetype6 \
fontconfig \
libxkbcommon0 \
libgtk-3-0t64 \
libwebkit2gtk-4.1-0 \
xvfb

- name: Download AppImage artifacts
uses: actions/download-artifact@v8
with:
name: safe-exam-browser-appimage
path: dist

- name: Smoke-test AppImages on Ubuntu
env:
QT_QPA_PLATFORM: xcb
APPIMAGE_EXTRACT_AND_RUN: "1"
run: |
chmod +x dist/*.AppImage
for appimage in dist/*.AppImage; do
echo "Running ${appimage} --version"
xvfb-run -a "${appimage}" --version
done

appimage-smoke-fedora:
needs:
- build-appimage
runs-on: ubuntu-latest
container:
image: fedora:latest

@coderabbitai coderabbitai Bot Aug 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Tracked workflow files:\n'
git ls-files .github/workflows || true

printf '\nWorkflow lines around image references:\n'
sed -n '112,128p' .github/workflows/ci.yml || true
sed -n '185,200p' .github/workflows/ci.yml || true
sed -n '18,30p' .github/workflows/release.yml || true

printf '\nFull image references in workflows:\n'
rg -n 'image:\s*[^[:space:]]+' .github/workflows || true

Repository: Jvr2022/seb-linux

Length of output: 1975

🌐 Web query:

Docker content trust immutable image digests best practice tag digest documentation

💡 Result:

As of August 2026, Docker Content Trust (DCT) is being retired [1]. It is recommended to migrate from DCT to more modern, industry-standard signing tools such as Sigstore (Cosign) or Notation [1]. Best Practices for Image Integrity and Reproducibility: 1. Use Immutable Image Digests: Always reference container images by their SHA-256 digest (e.g., image@sha256:abcdef...) rather than mutable tags like latest, stable, or version numbers [1][2][3]. Tags can be overwritten or moved to point to different content, whereas digests are unique, immutable, and cryptographically linked to the image content [1][3][4]. 2. Implement a Multi-Layer Integrity Pipeline: To ensure secure and reproducible deployments, adopt a three-layer integrity approach [5]: - Layer 1 (Build): Generate a Software Bill of Materials (SBOM) and sign the image digest using tools like Cosign or Notation [5]. - Layer 2 (Registry): Enable immutable tags (preventing tag overwrites) and restrict push access to authorized CI/CD roles only [5]. - Layer 3 (Deploy): Use admission controllers (e.g., Kyverno, OPA Gatekeeper) or deployment scripts to verify the image's signature and digest before allowing it to run in your environment [5]. 3. Why Move Beyond DCT: DCT was designed for tag-level verification [6]. However, it is tied to specific legacy infrastructure (Notary) and has become limited compared to modern OCI-native signing solutions [1][7]. Modern tools like Cosign store signatures as OCI artifacts directly within the registry, providing better compatibility, improved performance, and support for advanced features like provenance attestations and SBOMs [1][5]. If you currently rely on DCT for base image verification, consider switching to Docker Hardened Images (DHI), which come with pre-built cryptographic signatures, attestations, and SBOMs [1]. If you are a publisher who was using DCT, you should adopt Cosign or Notation to maintain your own image signing workflows [1].

Citations:

Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Reachability: External

Pin job container images to reviewed digests.

GitHub Actions runs container steps with tag-only images such as ubuntu:22.04 and fedora:latest. Replace these tag-only references with immutable image digests, and use the same Ubuntu 22.04 digest across CI and release workflows.

🧰 Tools
🪛 zizmor (1.28.0)

[error] 193-193: unpinned image references (unpinned-images): container image is pinned to latest

(unpinned-images)

📍 Affects 2 files
  • .github/workflows/ci.yml#L193-L193 (this comment)
  • .github/workflows/ci.yml#L122-L122
  • .github/workflows/release.yml#L24-L24
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 193, Replace the tag-only container images
at .github/workflows/ci.yml:122, .github/workflows/ci.yml:193, and
.github/workflows/release.yml:24 with reviewed immutable digests; use a
consistent Ubuntu 22.04 digest at the Ubuntu sites and pin the Fedora image at
the Fedora site.

Source: Linters/SAST tools

steps:
- name: Install AppImage host runtime libs
run: |
dnf install -y \
libglvnd-egl \
libglvnd-glx \
libglvnd-opengl \
mesa-libEGL \
mesa-libGL \
freetype \
fontconfig \
libxkbcommon \
gtk3 \
webkit2gtk4.1 \
xorg-x11-server-Xvfb

- name: Download AppImage artifacts
uses: actions/download-artifact@v8
with:
name: safe-exam-browser-appimage
path: dist

- name: Smoke-test AppImages on Fedora
env:
QT_QPA_PLATFORM: xcb
APPIMAGE_EXTRACT_AND_RUN: "1"
run: |
chmod +x dist/*.AppImage
for appimage in dist/*.AppImage; do
echo "Running ${appimage} --version"
xvfb-run -a "${appimage}" --version
done
18 changes: 17 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,24 @@ on:
permissions:
contents: write

env:
APPIMAGE_EXTRACT_AND_RUN: "1"

jobs:
build-linux:
runs-on: ubuntu-24.04
runs-on: ubuntu-latest
container:
image: ubuntu:22.04
steps:
- name: Bootstrap container packages
run: |
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
ca-certificates \
git \
wget \
sudo

- uses: actions/checkout@v7

- name: Resolve release version
Expand Down Expand Up @@ -53,6 +67,8 @@ jobs:
body: |
Thanks to everyone who contributed to this release.

Supported targets: Ubuntu 22.04+, Fedora 39+ (x86_64), glibc >= 2.35.

GitHub generated release notes below include the commit summary and new contributors automatically.
files: |
dist/*.AppImage
15 changes: 9 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,11 @@ so you can just focus on your exam.
### Running Everywhere

Safe Exam Browser has options for QtWebEngine and WebKitGTK.
We've also packaged all of the dependencies inside AppImage files so
Safe Exam Browser for Linux really can run anywhere.
We've also packaged dependencies inside AppImage files for portable installs.

**Supported AppImage targets (x86_64):** Ubuntu 22.04+, Fedora 39+, and other
distributions with **glibc ≥ 2.35**. Release AppImages are built on Ubuntu 22.04
so they stay compatible across those systems.

## Getting Started

Expand All @@ -35,10 +38,10 @@ and `libgtk-3-dev` installed so we can use the fallback engine.

### How to Build

Note: This is for binary builds, for AppImage builds you can use
prebuilt images or utilize `./scripts/build-release.sh`, the dependencies should
be installed automatically on debian systems. It is recommended to build inside
of a debian system or a debian container.
Note: This is for binary builds. For AppImage builds use prebuilt releases or
`./scripts/build-release.sh` (dependencies install automatically on Debian/Ubuntu).
Build AppImages on **Ubuntu 22.04** (or an Ubuntu 22.04 container) so the glibc
floor stays at 2.35 and the result runs on Ubuntu 22.04+ and Fedora 39+.

For binary builds, it's pretty simple:

Expand Down
Loading