From f4cff765ed941d4a5a3986c1a282a2bae700d0e0 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Thu, 18 Jun 2026 23:03:39 +0000 Subject: [PATCH] fix(decky): scrub PyInstaller LD_LIBRARY_PATH before spawning system flatpak Decky Loader is a PyInstaller binary; it puts its bundled (older) libssl/libcrypto on LD_LIBRARY_PATH via its /tmp/_MEI* unpack dir, and that env leaked into the backend's `flatpak run`/`flatpak kill` subprocess. The SYSTEM flatpak's libcurl + libostree need newer OPENSSL symbols (3.2/3.3/3.4), so pairing failed with "libssl.so.3: version OPENSSL_3.3.0 not found". _flatpak_env() now restores each LD_*_ORIG PyInstaller saved, or drops the var, so the system loader uses system libs. Reproduced + verified on the Deck (SteamOS 3.8.10, Flatpak 1.16.6). Co-Authored-By: Claude Opus 4.8 (1M context) --- clients/decky/main.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/clients/decky/main.py b/clients/decky/main.py index 5c19c45..81d78d0 100644 --- a/clients/decky/main.py +++ b/clients/decky/main.py @@ -64,6 +64,17 @@ def _flatpak_env() -> dict: pairing). Reconstruct the user-session bits flatpak wants; the backend may not inherit them. Harmless if some are already set.""" env = dict(os.environ) + # Decky Loader is a PyInstaller binary: it prepends its bundled libs (an older libssl) to + # LD_LIBRARY_PATH (its /tmp/_MEI* unpack dir), and that env leaks into our subprocess. The + # SYSTEM flatpak's libcurl needs OPENSSL_3.3.0 from the SYSTEM libssl, so the bundled libssl + # breaks it ("libssl.so.3: version OPENSSL_3.3.0 not found"). Restore the pre-bundle value + # PyInstaller saved as _ORIG, or drop the var so the dynamic loader uses system libraries. + for var in ("LD_LIBRARY_PATH", "LD_PRELOAD"): + orig = env.pop(f"{var}_ORIG", None) + if orig: + env[var] = orig + else: + env.pop(var, None) env.setdefault("HOME", decky.DECKY_USER_HOME) uid = os.environ.get("PF_UID") or "1000" env.setdefault("XDG_RUNTIME_DIR", f"/run/user/{uid}")