Description
On openSUSE Tumbleweed, the Linux AppImage cannot connect to an HTTPS Foundry VTT instance that works normally in a browser and with curl.
Launching FLC from a terminal prints:
GLib-Net-WARNING: Failed to load TLS database: System trust contains zero trusted certificates; please investigate your GnuTLS configuration
The host system trust store is not empty: trust list --filter=ca-anchors returns installed CA anchors. This appears to be an incompatibility between the AppImage's bundled WebKitGTK/GnuTLS/p11-kit libraries and openSUSE's system trust-store layout.
Environment
- OS: openSUSE Tumbleweed 20260907
- Desktop: KDE Plasma
- Package: x86_64 AppImage
- AppImage size: 82,659,832 bytes
- AppImage SHA-256:
84847e28c7e6cec5e16036d3261f4a2a926294a50c596a1b0edb1dc4618f30a4
The extracted AppImage includes bundled copies of:
usr/lib/libgnutls.so.30usr/lib/libp11-kit.so.0usr/lib/x86_64-linux-gnu/gio/modules/libgiognutls.so- WebKitGTK and libsoup
The host provides its native libraries at:
/usr/lib64/libgnutls.so.30/usr/lib64/libp11-kit.so.0
Steps to reproduce
- Run the AppImage on openSUSE Tumbleweed.
- Add a Foundry server using a valid public HTTPS URL.
- Attempt to connect.
- Observe that FLC cannot connect and prints the GLib-Net warning above.
Expected behavior
FLC should load the operating system's trusted CA certificates and connect to the valid HTTPS server.
Server checks
The server is reachable outside FLC:
- DNS resolves successfully.
- The HTTPS endpoint redirects to
/join, which returns 200 OK.
- The server presents a currently valid certificate issued by Let's Encrypt.
- The same URL works in a normal browser.
Possible workaround
Forcing the AppImage to use the host's native trust-related libraries may work around the problem:
LD_PRELOAD="/usr/lib64/libp11-kit.so.0:/usr/lib64/libgnutls.so.30" \
./flc.appimage
This suggests that the AppImage may need to avoid bundling these libraries, or configure its bundled p11-kit/GnuTLS stack so it can find the host trust anchors.
Description
On openSUSE Tumbleweed, the Linux AppImage cannot connect to an HTTPS Foundry VTT instance that works normally in a browser and with
curl.Launching FLC from a terminal prints:
The host system trust store is not empty:
trust list --filter=ca-anchorsreturns installed CA anchors. This appears to be an incompatibility between the AppImage's bundled WebKitGTK/GnuTLS/p11-kit libraries and openSUSE's system trust-store layout.Environment
84847e28c7e6cec5e16036d3261f4a2a926294a50c596a1b0edb1dc4618f30a4The extracted AppImage includes bundled copies of:
usr/lib/libgnutls.so.30usr/lib/libp11-kit.so.0usr/lib/x86_64-linux-gnu/gio/modules/libgiognutls.soThe host provides its native libraries at:
/usr/lib64/libgnutls.so.30/usr/lib64/libp11-kit.so.0Steps to reproduce
Expected behavior
FLC should load the operating system's trusted CA certificates and connect to the valid HTTPS server.
Server checks
The server is reachable outside FLC:
/join, which returns200 OK.Possible workaround
Forcing the AppImage to use the host's native trust-related libraries may work around the problem:
LD_PRELOAD="/usr/lib64/libp11-kit.so.0:/usr/lib64/libgnutls.so.30" \ ./flc.appimageThis suggests that the AppImage may need to avoid bundling these libraries, or configure its bundled p11-kit/GnuTLS stack so it can find the host trust anchors.