uun v0.1.1

Bug-fix release for uun. It fixes the problems reported with v0.1.0 on Ubuntu 24.04. If you're on v0.1.0, upgrading is recommended.

Fixes

• uun now exits immediately when you quit. In v0.1.0 the screen closed on q, but the process kept running until background checks (apt, snap, npm, network) finished, often requiring Ctrl+C. Quitting now stops those read-only checks, including helper processes they started, and exits at once. A running package update is never interrupted: quitting is refused until it finishes, since stopping apt or dnf mid-install can damage the system. (#10)
• The daily EoL refresh timer now works. Under the systemd user manager, two sandbox options in the v0.1.0 unit made root-owned files appear to be owned by nobody, so uun's file-ownership safety check refused to run and the refresh failed every day. The unit now uses hardening that works in per-user services (syscall filtering, no new privileges, no namespaces or SUID, private umask), and the ownership check is unchanged. This is verified by a new CI job that enables and runs the timer as a normal user on Ubuntu 24.04. (#10)
• Clear instructions for enabling the timer. It's a per-user unit, so run systemctl --user … as yourself. sudo systemctl --user … fails with Failed to connect to bus. The install message and README now say so and cover headless servers (loginctl enable-linger). (#10)
• No crash when closing on slow machines. On slower hardware (caught on emulated Raspberry Pi armhf), the once-a-second clock or a finishing scan could try to update the screen while it was being torn down, printing a NoMatches traceback on exit. Screen updates now stop cleanly at shutdown. (#12)
• Clear errors instead of tracebacks when XDG_CONFIG_HOME / XDG_CACHE_HOME point at a directory uun can't access, or when a config file has a syntax error. An unreadable config is reported, never silently ignored, so settings like use_sudo = false can't be dropped. (#7)

Upgrading

sha256sum -c SHA256SUMS --ignore-missing
sudo apt install ./uun_0.1.1-1_all.deb            # Ubuntu / Debian / Raspberry Pi OS
sudo dnf install ./uun-0.1.1-1.noarch.rpm         # Fedora / RHEL / Rocky / Alma
sudo zypper install --allow-unsigned-rpm ./uun-0.1.1-1.noarch.rpm   # openSUSE Leap

# as your normal user (no sudo):
systemctl --user daemon-reload                         # pick up the fixed timer unit
systemctl --user enable --now uun-eol-refresh.timer
systemctl --user start uun-eol-refresh.service && uun --report   # optional: refresh now

If you installed from source with install.sh, re-run it to get the fixed unit.

Packages

File	For
uun_0.1.1-1_all.deb	Ubuntu 24.04+, Debian 12 / 13, Raspberry Pi OS bookworm+ (arm64 and armhf)
uun-0.1.1-1.noarch.rpm	Fedora, RHEL / Rocky / Alma 9 (installs python3.11+ automatically), openSUSE Leap 15.6
uun-0.1.1-py3-none-any.whl, uun-0.1.1.tar.gz	pipx install / pip on any Linux with Python ≥ 3.11
SHA256SUMS	checksums for all of the above

Each package was install-tested in clean environments for every distro listed. The tests ran as an unprivileged user, used live end-of-life data, and removed the package cleanly afterwards. Requirements and limitations are unchanged from v0.1.0: Python ≥ 3.11, and the packages aren't GPG-signed (check them against SHA256SUMS).

Full changes: v0.1.0...v0.1.1

uun v0.1.0

First release of uun, a universal update notifier. It's a terminal UI that runs updates across all your package managers and keeps track of when the software on your system reaches end-of-life.

Highlights

• One place for updates: apt, dnf/yum, zypper, pacman, flatpak, snap, Homebrew, pip (user/venv only), pipx, cargo, rustup and npm, with pending and security update counts. Every update shows the exact commands for you to confirm before anything runs.
• End-of-life tracking: the OS, kernel, runtimes, databases and web servers, checked against endoflife.date data that's refreshed daily by a systemd user timer.
• Alternatives when software reaches end-of-life with no fix on the way: for example MySQL → MariaDB, Redis → Valkey, CentOS → Rocky/Alma, Terraform → OpenTofu, with install hints for your distro.
• tmux-style themes (set -g status-style …, bind-key, source-file); 6 bundled, switchable live with t. Upper-right ISO 8601 clock.
• Report mode for cron and CI: uun --report [--json]. Exit codes: 0 = all OK, 1 = something needs attention, 2 = something is past end-of-life.

Security

This release includes the fixes from a pre-release security audit. All findings scoring CVSS 3.1 ≥ 4.0 are fixed, as are the lower-scored ones. Details are in SECURITY.md (#1).

• Child processes run with cwd=/, so a hostile folder you launch uun from can't inject code.
• Programs are only taken from trusted PATH directories, and sudo must be a root-owned setuid binary.
• Config files that define commands run with sudo are checked for safe ownership and permissions before they're read, in a way that can't be raced.
• EoL data is strictly validated, and anything displayed is stripped of control characters and shown as plain text.
• Bundled dependencies are pinned by hash and pip-audited, with no known CVEs.

Packages

File	For
uun_0.1.0-1_all.deb	Ubuntu 24.04+, Debian 12 / 13, Raspberry Pi OS bookworm+ (arm64 and armhf)
uun-0.1.0-1.noarch.rpm	Fedora, RHEL / Rocky / Alma 9 (installs python3.11+ automatically), openSUSE Leap 15.6
uun-0.1.0-py3-none-any.whl, uun-0.1.0.tar.gz	pipx install / pip on any Linux with Python ≥ 3.11
SHA256SUMS	checksums for all of the above

Each package was install-tested in clean containers of every distro listed above, including arm64 and armhf (Raspberry Pi) under emulation. The tests ran as an unprivileged user, used the live end-of-life data, and removed the package cleanly afterwards.

sha256sum -c SHA256SUMS --ignore-missing

# Ubuntu / Debian / Raspberry Pi OS
sudo apt install ./uun_0.1.0-1_all.deb
# Fedora / RHEL / Rocky / Alma
sudo dnf install ./uun-0.1.0-1.noarch.rpm
# openSUSE Leap
sudo zypper install --allow-unsigned-rpm ./uun-0.1.0-1.noarch.rpm

systemctl --user enable --now uun-eol-refresh.timer   # daily end-of-life data refresh
uun --demo                                            # safe preview on sample data
uun

Requirements and known limitations

• Python 3.11 or newer. Ubuntu 22.04 and Raspberry Pi OS bullseye ship 3.10 and 3.9; there, use pipx with a newer Python.
• Packages aren't GPG-signed yet. Check them against SHA256SUMS from this release page.
• Builds are reproducible: packaging/build.sh rebuilds byte-identical packages from the same tag.