emrg: the Linux release legs fail because appimagetool now refuses 0700 AppDir permissions #2689

What happened

The v0.3.34 release build failed on both Linux legs. Run 41625081155 (tag v0.3.34): macos-15 and windows-2025 succeeded, ubuntu-24.04 and ubuntu-24.04-arm failed, so the release job was skipped and no release was published.

The cause, read from the log

packaging/make-installer.sh calls packaging/make-appimage-updatable.sh, which extracts the AppImage into an AppDir and repacks it with appimagetool -n -u. The step ended with 426 compliance problems of one shape:

Problem 420/426: .../squashfs-root/usr/lib
Problem: this directory has mode 0700 (rwx------), so some users (group and/or others)
         cannot read and execute it. ... It needs at least mode 0755 (rwxr-xr-x)
##[error]Process completed with exit code 1.

appimagetool was invoked with -n, which suppresses AppStream validation only. The permissions check is not suppressed and now fails the run instead of warning.

Why it started failing without a code change

The workflow installs the floating continuous build:

https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$(uname -m).AppImage

Measured from the two runs' own logs:

Same script, same AppDir, same modes; the tool changed the verdict on them. Nothing in this repository regressed.

What the fix must satisfy

• The repackaged AppImage is readable and executable by the user who runs it, not only by the user who packaged it. appimagetool's own remedy is chmod -R a+rX on the AppDir before packaging, and a+rX only adds execute where a directory or an already-executable file needs it, so file modes that matter are preserved.
• The change belongs in packaging/make-appimage-updatable.sh, right after the extraction produces the AppDir and before the repack — not in the workflow, because a host running the script by hand (the recipe in the script's own comment block) hits the same check.
• The two artefacts the step exists for are unchanged: the AppImage with update information embedded, and the .zsync beside it.
• No new test: the host's standing instruction is that a fix is the fix, and the existing execution-level guard for this step (tests/test_appimage_update_info.py) already runs the script for real.