[w3irdrobot]

Summary

Extract the small runtime-dependency fix from #1305 so it can be reviewed independently from side-by-side Dev packaging.

• Declare the WebKitGTK runtime requirement in the RPM configuration.
• Preserve explicit bundle.linux.rpm.depends when the release pipeline rebuilds an RPM from the normalized DEB payload with automatic dependency generation disabled.
• Reject final RPMs missing the WebKitGTK requirement.
• Add focused spec, package-header, and failure-path tests.

No app renaming, Dev profile, endpoint/auth/storage, updater, AppImage extraction, or native runtime changes are included.

Cross-distro capability

Production now requires libwebkit2gtk-4.1.so.0()(64bit) instead of Fedora's package name. The verifier checks that exact capability; tests reject distro package names, the wrong ABI, and a missing 64-bit suffix.

Validation — x86_64 Linux, 2026-10-28

• Rebased onto master 02adadbd; branch contains two SSH-signed commits and no merge commit. Head: 06f7021b.
• 13 RPM-packaging tests, 10 Dev-profile tests, five bundle-marker tests, Bash syntax, and diff checks passed.
• CARGO_BUILD_JOBS=2 nix develop .#ci --no-update-lock-file --command bash -euo pipefail -c 'just lane repo; just lane research-desktop-linux' passed after rebase. The complete Linux packaging lane built and verified AppImage, DEB, and production RPM, plus ephemeral fake-updater signature tests. No release keys were used.
• The earlier AppImage security.selinux extraction failure is resolved by the fix already merged in Add independent side-by-side Linux Research Dev packages #1305; no additional extraction change is needed in this PR.
• Fresh rebased RPM SHA-256: a20444f3ad46771ad9f72cc4acf2c268799e53768326033a4478697223879d7a.
• Before rebase, installed the real production-identity RPM on fresh Lima/QEMU Fedora 44 and openSUSE Leap 16.0 VMs. Both began without WebKitGTK. dnf selected webkit2gtk4.1-2.54.2-1.fc44; zypper selected libwebkit2gtk-4_1-0-2.54.1-160000.1.1. Both completed and RPM queries confirmed Maple and the capability provider. That tested RPM SHA-256 was bba8dc7a126e8f9b68de8d66e918368172eb46f0665fc9a26136798ec6ec0d84; the fresh post-rebase artifact has not been reinstalled in those VMs.
• VMs ran sequentially at one CPU / 1 GiB RAM / 8 GiB sparse disk, with weak/recommended dependencies disabled. Repository signature verification stayed enabled; only the unsigned local Maple RPM was exempted. All test VMs are stopped.
• PR builds use production identity/config with fixed hosted Dev endpoints. No GUI launch, login, production-service interaction, release signing, publication, or deployment. Runtime smoke and other distros/architectures remain unverified.

The dependency-name hold and local AppImage extraction blocker are resolved. Ready for review; hosted CI on the rebased head is still running.

#1305 was independently reviewed and has now merged to master. This PR is rebased onto current master and changes only production RPM dependency policy; Dev keeps its own declaration and verifier. No publication or deployment is authorized by this PR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Maple development preview: https://c9521c56.maple-ca8.pages.dev

Commit: 06f7021b94c3b361ff06205042ca98f6306d97dd

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[w3irdrobot]

Cross-distro dependency research

The concern from #1305 is valid: RPM package names differ, but the runtime-library capability is shared.

Distribution	Runtime package	RPM capability
Fedora	webkit2gtk4.1	libwebkit2gtk-4.1.so.0()(64bit)
openSUSE Tumbleweed / Leap metadata	libwebkit2gtk-4_1-0	libwebkit2gtk-4.1.so.0()(64bit)

Recommendation: declare libwebkit2gtk-4.1.so.0()(64bit) in bundle.linux.rpm.depends instead of either distro-specific package name. Update the verifier/tests to require that capability and reject a Fedora-name-only requirement. Our RPM architecture helper currently permits only x86_64 and aarch64, both 64-bit; adding 32-bit packages would need a different suffix. A growing (fedora-name or suse-name ...) list is unnecessary.

Evidence

• Fedora official package metadata lists the capability under Provides.
• openSUSE RPM metadata mirror lists the differently named package and the same capability; provider index also lists Leap and aarch64 packages. The official openSUSE web/source endpoints returned HTTP 403 here, so this is mirrored metadata, not a direct official-package inspection.
• RPM dependency documentation describes SONAME capabilities as virtual Provides/Requires, independent of package names.
• Tauri CLI v2.11.1 RPM bundler source passes configured dependency strings through Dependency::any; it does not require a distro package name. Tauri also documents Fedora prerequisites and RPM distribution, which is not the same as Maple certifying every Fedora version.

Local experiment (not a distro smoke test)

Using the pinned Nix CI shell and the real Maple RPM builder, I created a synthetic consumer requiring the SONAME capability. rpm -qp --requires preserved it exactly. In isolated temporary RPM databases, test-only transactions accepted synthetic providers named either webkit2gtk4.1 or libwebkit2gtk-4_1-0 when they advertised that capability. A provider without the capability was rejected. No system packages were installed and no third-party RPM payloads were executed.

Before merging: implement the capability declaration and tests, build the real Maple RPM, and validate dependency resolution/install/launch on clean Fedora and openSUSE. This addresses the WebKitGTK dependency only, not complete dependency coverage, glibc baselines, or universal distro support. The split PR intentionally still contains the original Fedora-name declaration; the recommended change is not implemented yet.