Desktop packages and the update process

Package sources, user copy, conflicts and signed update channel setup.

Four packages, one version set

• windoesnot-desktop: interface code and new user defaults.
• windoesnot-tools: session and helper tools.
• windoesnot-plugins: Hyprland plugins built to match.
• windoesnot-components: native terminal module and window switcher.

From package to user session

The package sources live in /usr/share/windoesnot/. Before the session starts, a tool reconciles the managed copy in ~/.config. Unmodified code is updated, modified code is kept and reported as a conflict. Personal settings and state files are not replaced by project defaults.

The sync keeps its inventory in ~/.local/state/windoesnot/desktop-files.json. Conflict reports are in last-sync.json, backups of replaced managed files in backups/ in the same state directory.

Public channel

Since 0.1.0-19 there is a signed public update channel for the four desktop packages. Existing 0.1.0-18 installs (including the 0.1.0-18 ISO) need a one-time setup. The release signing key's primary fingerprint is:

ED9530A990C6D39EB7D4BA8F9BDCA578FBF1DDB0

Compare it against the public key in the project repository, not only against what the package server itself serves. In a new working directory as your normal user:

curl -fLO https://raw.githubusercontent.com/Bennch/windoesnot/main/packaging/release-key/RELEASE-KEY.asc
curl -fLO https://download.windoesnot.me/repo/bootstrap/windoesnot-update-client-0.1.0-19.tar.gz
curl -fLO https://download.windoesnot.me/repo/bootstrap/windoesnot-update-client-0.1.0-19.tar.gz.sig
gpg --show-keys --with-fingerprint RELEASE-KEY.asc
gpg --dearmor --output windoesnot-release.gpg RELEASE-KEY.asc
gpgv --keyring "$PWD/windoesnot-release.gpg" windoesnot-update-client-0.1.0-19.tar.gz.sig windoesnot-update-client-0.1.0-19.tar.gz

Only continue after a successful verification and backing up your own data, then:

tar -xzf windoesnot-update-client-0.1.0-19.tar.gz
cd windoesnot-update-client-0.1.0-19
sudo ./bootstrap.sh
sudo pacman -Syu

The bootstrap script only adds the project's own key and repository configuration, backs up /etc/pacman.conf first, and leaves the existing distribution repositories untouched. Log out and back in afterwards. To disable it again: restore the printed pacman.conf.before-windoesnot-… backup, as long as nothing else changed that file since.

Honest caveat: the channel is fresh. So far exactly one real update run (0.1.0-18 → 0.1.0-19) has been verified in a VM, including correctly rejecting missing or wrong signatures. Real hardware has not been tested with it yet.

When a dependency blocks an update

Wait for a matching package set, or rebuild the native components against the target versions. Permanent package holds, ignored dependencies or partial upgrades are not an intended solution. Published binaries need a new package version or a higher release number when they are rebuilt.