From f9089b02024dd26a676a781fe8367424652efb78 Mon Sep 17 00:00:00 2001
From: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
Date: Tue, 26 May 2026 23:44:30 +0900
Subject: [PATCH] Linux: improve AppImage portability

Bundle the FUSE2 userspace library inside the AppImage AppDir and make AppRun prefer APPDIR/usr/lib. This lets the bundled VeraCrypt binary resolve libfuse.so.2 on systems where FUSE2 userspace packages are no longer installed by default.

Name AppImage artifacts according to the GTK backend detected during the build. GTK3 builds keep the default VeraCrypt-<version>-<arch>.AppImage name, while GTK2 builds use a gtk2-legacy suffix to distinguish the legacy compatibility artifact.

Include immintrin.h in the Argon2 AVX2 implementation so GCC toolchains such as the one on CentOS 7 see the AVX2 intrinsic types when compiling with -mavx2.

Refs: https://github.com/veracrypt/VeraCrypt/issues/1595
---
 src/Crypto/Argon2/src/opt_avx2.c        |  2 ++
 src/Main/Main.make                      | 28 ++++++++++++++++++++++++-
 src/Setup/Linux/veracrypt.AppDir/AppRun | 11 ++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/src/Crypto/Argon2/src/opt_avx2.c b/src/Crypto/Argon2/src/opt_avx2.c
index 574d8bee..3d788419 100644
--- a/src/Crypto/Argon2/src/opt_avx2.c
+++ b/src/Crypto/Argon2/src/opt_avx2.c
@@ -26,6 +26,8 @@
 
 #if defined(__AVX2__)
 
+#include <immintrin.h>
+
 #include "blake2/blake2b.h"
 #include "blake2/blamka-round-opt.h"
 
diff --git a/src/Main/Main.make b/src/Main/Main.make
index c0463dbf..043c157f 100755
--- a/src/Main/Main.make
+++ b/src/Main/Main.make
@@ -328,6 +328,7 @@ INSTALL_DESKTOP ?= 1
 INSTALL_MIME ?= 1
 INSTALL_ICONS ?= 1
 INSTALL_APPIMAGE_FILES ?= 1
+APPIMAGE_BUNDLE_FUSE2 ?= 1
 
 # These override values are appended below usr and used in shell recipes.
 # Keep command-line/environment overrides literal and path-like.
@@ -426,6 +427,27 @@ endif
 ifneq "$(INSTALL_APPIMAGE_FILES)" "0"
 	rm -fr $(BASE_DIR)/Setup/Linux/veracrypt.AppDir/usr
 	cp -r $(BASE_DIR)/Setup/Linux/usr $(BASE_DIR)/Setup/Linux/veracrypt.AppDir/.
+ifneq "$(APPIMAGE_BUNDLE_FUSE2)" "0"
+	@set -e; \
+	_appdir="$(BASE_DIR)/Setup/Linux/veracrypt.AppDir"; \
+	_fuse_lib="$$( (ldconfig -p 2>/dev/null || /sbin/ldconfig -p 2>/dev/null || true) | awk '/libfuse\.so\.2[[:space:]]/ { print $$NF; exit }')"; \
+	if [ -z "$$_fuse_lib" ]; then \
+		for _candidate in /lib64/libfuse.so.2 /usr/lib64/libfuse.so.2 /lib/libfuse.so.2 /usr/lib/libfuse.so.2 /lib/*/libfuse.so.2 /usr/lib/*/libfuse.so.2; do \
+			if [ -e "$$_candidate" ]; then _fuse_lib="$$_candidate"; break; fi; \
+		done; \
+	fi; \
+	if [ -n "$$_fuse_lib" ]; then \
+		echo "Bundling AppImage FUSE2 userspace library: $$_fuse_lib"; \
+		mkdir -p "$$_appdir/usr/lib"; \
+		cp -P "$$_fuse_lib" "$$_appdir/usr/lib/"; \
+		_fuse_real="$$(readlink -f "$$_fuse_lib" 2>/dev/null || true)"; \
+		if [ -n "$$_fuse_real" ] && [ "$$_fuse_real" != "$$_fuse_lib" ]; then \
+			cp "$$_fuse_real" "$$_appdir/usr/lib/"; \
+		fi; \
+	else \
+		echo "Warning: libfuse.so.2 not found; AppImage will rely on a host FUSE2 userspace library"; \
+	fi
+endif
 ifneq "$(INSTALL_ICONS)" "0"
 	ln -sf usr/share/icons/hicolor/1024x1024/apps/$(APPNAME).png $(BASE_DIR)/Setup/Linux/veracrypt.AppDir/$(APPNAME).png
 endif
@@ -550,7 +572,11 @@ appimage: prepare
 	_appimagetool_executable_name="appimagetool-$${_appimagetool_arch_suffix}.AppImage"; \
 	_appimagetool_executable_path="$(BASE_DIR)/Setup/Linux/$${_appimagetool_executable_name}"; \
 	_appimagetool_url="https://github.com/AppImage/appimagetool/releases/download/continuous/$${_appimagetool_executable_name}"; \
-	_final_appimage_filename="VeraCrypt-$(TC_VERSION)-$${_final_appimage_arch_suffix}.AppImage"; \
+	_final_appimage_gtk_suffix=""; \
+	if [ "$(GTK_VERSION)" = "2" ]; then \
+		_final_appimage_gtk_suffix="-gtk2-legacy"; \
+	fi; \
+	_final_appimage_filename="VeraCrypt-$(TC_VERSION)$${_final_appimage_gtk_suffix}-$${_final_appimage_arch_suffix}.AppImage"; \
 	_final_appimage_path="$(BASE_DIR)/Setup/Linux/$${_final_appimage_filename}"; \
 	\
 	echo "Preparing AppImage for $(CPU_ARCH) (using $${_appimagetool_arch_suffix})..."; \
diff --git a/src/Setup/Linux/veracrypt.AppDir/AppRun b/src/Setup/Linux/veracrypt.AppDir/AppRun
index 5e37db14..d76ea136 100755
--- a/src/Setup/Linux/veracrypt.AppDir/AppRun
+++ b/src/Setup/Linux/veracrypt.AppDir/AppRun
@@ -2,5 +2,16 @@
 # Get the directory where AppRun is located
 APPDIR=$(dirname "$(readlink -f "$0")")
 
+# Prefer libraries bundled inside the AppImage. This lets the official
+# AppImage carry its private FUSE2 userspace library on systems where
+# libfuse.so.2 is no longer installed by default.
+if [ -d "${APPDIR}/usr/lib" ]; then
+    if [ -n "${LD_LIBRARY_PATH:-}" ]; then
+        export LD_LIBRARY_PATH="${APPDIR}/usr/lib:${LD_LIBRARY_PATH}"
+    else
+        export LD_LIBRARY_PATH="${APPDIR}/usr/lib"
+    fi
+fi
+
 # Execute the main VeraCrypt application
 exec "${APPDIR}/usr/bin/veracrypt" "$@"