run.sh

#!/bin/bash
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )

args=()
shopt -s dotglob
for d in /etc/*; do
  if [[ $d == /etc/os-release ]] || \
     [[ $d == /etc/grub2.cfg ]] || \
     [[ $d == /etc/grub2-efi.cfg ]]
  then
    continue
  fi
  args+=("--ro-bind" "$d" "$d")
done
APP_NAME=wechat
APPDIR=/run/user/1000/app/$APP_NAME
if ( ss -xl|grep $APPDIR/bus ); then
  echo "Another instance of WeChat is already running" >&2
  exit
fi

exec {fd}<> <(:)

set_up_dbus_proxy() {
  mkdir -p $APPDIR
  touch $APPDIR/buslock
  trap "rm -rf $APPDIR" EXIT
  bwrap \
    --new-session \
    --symlink /usr/lib64 /lib64 \
    --ro-bind /usr/lib /usr/lib \
    --ro-bind /usr/lib64 /usr/lib64 \
    --ro-bind /usr/bin /usr/bin \
    --bind "$XDG_RUNTIME_DIR" "$XDG_RUNTIME_DIR" \
    --lock-file $APPDIR/buslock \
    --die-with-parent \
    -- \
    env -i xdg-dbus-proxy $DBUS_SESSION_BUS_ADDRESS $APPDIR/bus --fd=$fd --filter \
    --call=org.freedesktop.portal.*=* \
    --broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*
}

export GTK_USE_PORTAL=1
set_up_dbus_proxy | \
( read -u $fd -n 1 a && exec bwrap \
    --ro-bind /usr /usr \
    --tmpfs /tmp \
    --bind $SCRIPT_DIR/usr/lib /usr/lib \
    --bind /usr/lib/fontconfig /usr/lib/fontconfig \
    "${args[@]}" \
    --bind $SCRIPT_DIR/etc/lsb-release /etc/lsb-release \
    --bind $SCRIPT_DIR/etc/os-release /etc/os-release \
    --bind $SCRIPT_DIR/var /var \
    --bind $SCRIPT_DIR/opt /opt \
    --bind $SCRIPT_DIR/lib /var/usrlocal/lib64 \
    --ro-bind /usr/lib64/libbz2.so.1.0.8 /var/usrlocal/lib64/libbz2.so.1.0 \
    --ro-bind /tmp/.X11-unix/X0 /tmp/.X11-unix/X0 \
    --ro-bind $XAUTHORITY $XAUTHORITY \
    --ro-bind /run/user/1000/pulse /run/user/1000/pulse \
    --ro-bind $APPDIR/bus /run/user/1000/bus \
    --ro-bind $SCRIPT_DIR/xdg-utils/usr/bin/flatpak-xdg-open /usr/bin/xdg-open \
    --dev /dev \
    --dev-bind /dev/dri /dev/dri \
    --ro-bind /sys /sys \
    --tmpfs /sys/dev/block \
    --proc /proc \
    --symlink usr/lib /lib \
    --symlink usr/lib64 /lib64 \
    --symlink usr/bin /bin \
    --symlink usr/bin /sbin \
    --symlink var/home /home \
    --setenv GTK_USE_PORTAL 1 \
    --setenv QT_QPA_PLATFORM xcb \
    --setenv LD_LIBRARY_PATH /usr/local/lib64:/opt/wechat-beta \
    --die-with-parent \
    --unshare-all \
    --share-net \
    /opt/wechat-beta/wechat "$@"
)

我是把:

• 微信的deb
• https://aur.archlinux.org/cgit/aur.git/tree/license.tar.gz?h=wechat-uos
• https://home-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.weixin/com.tencent.weixin_2.1.5_amd64.deb 里面的 usr/lib/license/libuosdevicea.so

保留目录结构解压到同一个目录然后把 run.sh 放进去的。

我的系统目录结构是 silverblue 的结构，很多东西和传统 FHS 不完全一样，可能得相应修改。