Skip to content

Dendro 2.11.0 — DNF5 daemon transactions and repository hardening

Choose a tag to compare

View all tags
@xyasharx xyasharx released this 16 Oct 11:54
· 39 commits to main since this release
v2.11.0
83c4d97
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Dendro 2.11.0 moves package-changing operations to Fedora's DNF5 system daemon
and documents the runtime contract required for updates and repository
management.

Changed

  • Package install, removal, and upgrade requests are resolved through
    dnf5daemon-server on org.rpm.dnf.v0.
  • Dendro displays the daemon-resolved transaction plan before authorization and
    executes that retained plan after confirmation.
  • DNF5 owns RPM transaction locking and requests Polkit authorization. Dendro
    no longer uses a generic privileged dnf command runner for package
    transactions.
  • Update checks, repository state changes, and cache cleanup use the DNF5
    daemon API.
  • Repository file deletion remains a separate, constrained operation on RPM
    installations because the DNF5 daemon does not expose a repository-file
    deletion API.

Repository safety

  • Repository origin classification now parses repository baseurl values and
    compares normalized hostnames using exact or domain-boundary matches.
  • A trusted domain appearing in a URL path, query string, user-info field, or
    lookalike hostname is not classified as a Fedora, COPR, or RPM Fusion origin.
  • Malformed repository URLs are handled as untrusted origins.

Packaging and runtime

  • The Fedora RPM requires dnf5daemon-server,
    dnf5daemon-server-polkit, Polkit, and the required PyQt6 and RPM bindings.
  • Source checkouts and AppImages remain unprivileged clients of the Fedora host
    DNF5 daemon; they do not bundle a package-management service.
  • The Flatpak is limited to the typed org.rpm.dnf.v0 system-bus service. It
    does not receive a generic host-command or host-filesystem escape.

Important deployment note

Dendro package-management features require a Fedora system with a usable system
D-Bus, dnf5daemon-server, and a Polkit authentication agent.

Desktop-only containers such as lscr.io/linuxserver/webtop:fedora-kde are not
supported package-management targets unless they deliberately provide that full
system service contract. Do not mount the host D-Bus socket, RPM database, or
host filesystem into a desktop container to work around a missing daemon.

Upgrade

Fedora RPM users can upgrade with:

sudo dnf upgrade --refresh dendro

**Full Changelog**: https://github.com/xyasharx/Dendro/compare/v2.10.1...v2.11.0
Assets 7
Loading