docuseal: use DocuSeal's patched PDFium build to fix service start

DocuSeal switched to its own PDFium fork (upstream commit "adjust pdfium", 2026-08-15) and now attaches functions that only exist in that build, e.g. FPDFPage_GetAnnotCountRaw from the added fpdf_annots_raw.h. The generic bblanchon/pdfium-binaries library the script installed does not export them, so lib/pdfium.rb raises FFI::NotFoundError while Rails eager-loads and both docuseal.service and docuseal-sidekiq.service fail to start: Unable to load application: FFI::NotFoundError: Function 'FPDFPage_GetAnnotCountRaw' not found in [libpdfium.so] Install the library from docusealco/pdfium-binaries instead, matching the upstream Dockerfile. It is only published as a musl build (DocuSeal's image is Alpine based), so the musl runtime is installed and its library directory is added to the loader search path - the shared object needs "libc.so" (musl) at dlopen time. Verified on glibc: the library loads, resolves the raw annotation functions and renders pages correctly. The update path now refreshes PDFium too, so existing containers are repaired by running "update" even when DocuSeal itself is already up to date.
2026-08-22 12:32:42 +02:00 · 2026-08-21 19:41:22 +00:00
2 changed files with 7 additions and 12 deletions
@@ -30,17 +30,15 @@ function update_script() {
    exit
  fi

-  # DocuSeal moved to its own patched PDFium build (FPDFPage_GetAnnotCountRaw & co.),
-  # which is only published as a musl binary, so existing installs need it swapped in.
  ensure_dependencies musl
  [[ -f /opt/pdfium/lib/libpdfium.so ]] || rm -f "$HOME/.pdfium"
-  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(uname -m).zip"
+  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
  if ! cmp -s /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so; then
    msg_info "Updating PDFium"
    install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-    echo "/usr/lib/$(uname -m)-linux-musl" >/etc/ld.so.conf.d/musl.conf
-    $STD ldconfig
-    systemctl restart docuseal docuseal-sidekiq 2>/dev/null || true
+    echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+    ldconfig
+    systemctl restart docuseal docuseal-sidekiq
    msg_ok "Updated PDFium"
  fi

@@ -50,15 +50,12 @@ ln -sf /opt/fonts/GoNotoKurrent-Bold.ttf /usr/share/fonts/noto/
 $STD fc-cache -f
 msg_ok "Downloaded Fonts"

-# DocuSeal calls PDFium functions that only exist in its own patched build
-# (FPDFPage_GetAnnotCountRaw & co.), so the upstream binaries are used. They are
-# only published as musl builds, which need the musl runtime to be loadable.
-fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(uname -m).zip"
+fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"

 msg_info "Installing PDFium"
 install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-echo "/usr/lib/$(uname -m)-linux-musl" >/etc/ld.so.conf.d/musl.conf
-$STD ldconfig
+echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+ldconfig
 msg_ok "Installed PDFium"

 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"