[Linux/AppImage] beta.13 cannot provision runtime: runtime manifest is rejected as non-canonical #362

Summary

CompozyOS_0.3.0-beta.13_amd64.AppImage opens its boot window on Linux, but it cannot provision/start the Compozy runtime. The UI ends with:

The runtime package could not be verified or installed.

This also happens with a completely fresh COMPOZY_HOME, so it is not caused by existing user state.

Environment

• CompozyOS: 0.3.0-beta.13
• Host: Bluefin 42.20251024.1 (Fedora/Silverblue-based)
• Kernel: 6.16.8-200.fc42.x86_64
• Architecture: x86_64
• Desktop session: GNOME / Wayland (the AppImage forces GDK_BACKEND=x11)
• AppImage SHA256: c39c9a39c495c796c731f459811037870a3d5ecce4201c4d5cfba157a1a838be

Reproduction

1. Download the beta.13 Linux AppImage from the official release feed.
2. Make it executable and run it.
3. Alternatively, force a fresh home:

fresh_home="$(mktemp -d)"
COMPOZY_HOME="$fresh_home" ./CompozyOS_0.3.0-beta.13_amd64.AppImage

4. The boot window reports The runtime package could not be verified or installed.

The resulting app.json contains:

{
  "state": "error",
  "error": {
    "code": "runtime_start_failed",
    "safe_message": "The runtime package could not be verified or installed."
  }
}

Checks performed

• The local AppImage is byte-for-byte identical to the artifact published in latest.json.
• The AppImage is a valid x86-64 AppImage type 2 and launches/extracts successfully.
• File permissions are 0755.
• libfuse3, fusermount3, and fusermount are installed.
• The host is x86-64 with sufficient disk space; /tmp and the home filesystem are writable/executable.
• https://releases.compozy.com/desktop/beta/runtime.json responds with HTTP 200.
• runtime.json.minisig responds with HTTP 200.
• The Linux runtime archive responds with HTTP 200 and matches the manifest exactly:
  • declared size: 51502330
  • downloaded size: 51502330
  • declared SHA256: 150b8973d4f990aa5b0fdc85dbe58b3fe3c93310a8b62db2a74625b33fc17330
  • downloaded SHA256: 150b8973d4f990aa5b0fdc85dbe58b3fe3c93310a8b62db2a74625b33fc17330
• The extracted compozy binary runs independently (compozy --help).
• No runtime binary is installed in the fresh COMPOZY_HOME/bin/.
• desktop.log remains empty and compozy.log is not created, indicating failure before runtime startup.

Suspected cause

The desktop verifier in desktop/src-tauri/src/runtime/artifacts.rs recursively sorts JSON object keys using a BTreeMap, then rejects the manifest when the sorted bytes differ from the downloaded bytes.

The release generator in internal/desktoprelease/manifest.go calls Go's json.Marshal in writeCanonicalJSON. That preserves Go struct field order; it does not sort keys recursively.

The currently published manifest starts in this order:

{"schema_version":1,"version":"0.3.0-beta.13","platforms":...,"schema_heads":...}

The Rust verifier's sorted representation starts with:

{"platforms":...,"schema_heads":...,"schema_version":1,"version":"0.3.0-beta.13"}

Nested platform objects also have a different key order. Therefore the public runtime.json is not canonical according to the verifier shipped in the AppImage, which would produce the generic runtime_start_failed error before the runtime can be installed.

Suggested fix

• Make the producer and consumer use the same canonical JSON scheme (or remove the incompatible canonical-byte check).
• Regenerate and re-sign the runtime manifest, then republish the Linux release or publish a corrected patch version.
• Add a release smoke test that downloads the public runtime.json and verifies it with the exact desktop verifier before publishing.
• Include the underlying provisioning error in the diagnostic log/UI; currently both logs provide no actionable detail.

Official feed: https://releases.compozy.com/desktop/beta/latest.json