change: drop the self-update mechanism #46

Merged

mysticalsoap merged 1 commit from mysticalsoap/change/drop-self-update into trunk

2026-08-18 19:53:30 -04:00

AGit

mysticalsoap commented

2026-08-18 19:18:18 -04:00

Owner

Problem

#19: the root service exposes update_aqomui over D-Bus. It downloads a .deb/.rpm/zip from the dead upstream repo (github.com/corrad1nho/aqomui, inactive since 2019) and installs it as root via dpkg -i, rpm -i, or pip install --force-reinstall — no checksum, no signature. The caller controls the version string interpolated into the download URL, and with the current open D-Bus policy (#18) any local user can trigger it. The GUI also phones home to that repo's releases API on every start.

Fix

Pure deletion — distribution packages (pacman/AUR) are the update channel:

aqomui_service.py: the update_aqomui method, update_thread, the updated signal, and the imports only they used
update.py: UpdateCheck (the GitHub releases poll)
aqomui_gui.py: the check/notify flow (check_update/release_compare/update_aqomui), the upgrade button, the post-upgrade restart prompt, the packetmanager plumbing (it only existed to pick an install method), and the upgrade progress-bar branches. The homepage label now points at this repo instead of upstream.

Kept: the provider auto-update option (server lists, unrelated) and the GUI/service version-discrepancy check (local VERSION file only, no network).

Verification

python -W error::SyntaxWarning -m compileall aqomui/ clean; aqomui.update and aqomui.aqomui_gui import cleanly from the checkout; pytest/ruff run in CI
Grepped for stale references: no updateAqomuiBt/packetmanager/UpdateCheck/update_aqomui left; showActive.check_update → update_check is the unrelated server-list refresh and stays

Closes #19

Assisted-by: claude-fable-5

## Problem [#19](https://git.mysticalsoap.com/mysticalsoap/aqomui/issues/19): the root service exposes `update_aqomui` over D-Bus. It downloads a `.deb`/`.rpm`/zip from the dead upstream repo (`github.com/corrad1nho/aqomui`, inactive since 2019) and installs it as root via `dpkg -i`, `rpm -i`, or `pip install --force-reinstall` — no checksum, no signature. The caller controls the `version` string interpolated into the download URL, and with the current open D-Bus policy (#18) any local user can trigger it. The GUI also phones home to that repo's releases API on every start. ## Fix Pure deletion — distribution packages (pacman/AUR) are the update channel: - `aqomui_service.py`: the `update_aqomui` method, `update_thread`, the `updated` signal, and the imports only they used - `update.py`: `UpdateCheck` (the GitHub releases poll) - `aqomui_gui.py`: the check/notify flow (`check_update`/`release_compare`/`update_aqomui`), the upgrade button, the post-upgrade restart prompt, the `packetmanager` plumbing (it only existed to pick an install method), and the `upgrade` progress-bar branches. The homepage label now points at this repo instead of upstream. Kept: the provider auto-update option (server lists, unrelated) and the GUI/service version-discrepancy check (local `VERSION` file only, no network). ## Verification - `python -W error::SyntaxWarning -m compileall aqomui/` clean; `aqomui.update` and `aqomui.aqomui_gui` import cleanly from the checkout; pytest/ruff run in CI - Grepped for stale references: no `updateAqomuiBt`/`packetmanager`/`UpdateCheck`/`update_aqomui` left; `showActive.check_update` → `update_check` is the unrelated server-list refresh and stays Closes #19 Assisted-by: claude-fable-5

mysticalsoap added 1 commit

2026-08-18 19:18:18 -04:00

change: drop the self-update mechanism

ci / test (pull_request) Successful in 29s

Details

b238ffdbdf

The root service exposed update_aqomui over D-Bus, which downloaded a
package from the dead upstream repository and installed it as root with
no verification. Distribution packages are the update channel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

~~mysticalsoap referenced this pull request 2026-08-18 19:26:40 -04:00~~

fix: authorize service calls through polkit #47

mysticalsoap referenced this pull request

2026-08-18 19:26:40 -04:00

Update-available notification (check-only, no installer) #48

mysticalsoap merged commit ba37ffb4b9 into trunk

2026-08-18 19:53:30 -04:00