Revert server auto-update (single identity can't split streams); keep update feedback

The v0.1.15 attempt gave the headless build its own update stream via a
separate rsupd project, but the dist model makes that unworkable with one
signing identity: the manifest URL is keyed by (fingerprint, channel) and
release uniqueness by (fingerprint, version), so two variants can't
publish the same version — and pointing the shared MANIFEST-master at a
decryptd-server manifest would break GUI auto-update (project mismatch).
That release was cancelled before any publish; MANIFEST-master is intact.

- Server build reverts to download-only (updater gated to the gui
  feature again; publish-server job removed). Master publish is a single,
  conflict-free upload again.
- Kept the important fix: the GUI "Check for Updates" now reports its
  outcome via desktop notification (up-to-date / updating / error) so the
  Windows failure stops being invisible.

An independent server update stream would need a second signing identity;
deferred pending that.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

.github/workflows/release.yml

@@ -56,36 +56,3 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           RSUPD_IDENTITY: ${{ secrets.RSUPD_IDENTITY }}
         run: rsupd publish --ci --run ${{ github.run_id }} --channel master --yes
-
-  # The headless -server build updates from its own rsupd project `decryptd-server`
-  # (the backend keys releases by project+version, so the GUI and server binaries —
-  # same version, same os_arch — can't share the `decryptd` project). Its binary
-  # isn't a triple-named CI artifact, so `--ci` can't stage it; instead we drop it
-  # into target/<triple>/release/ and publish in local mode with an explicit
-  # --project (rsupd packages the existing binary — no recompile). Independent of
-  # the master publish, so a failure here never blocks GUI updates.
-  publish-server:
-    name: Sign & publish server update
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: read
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: Install rsupd CLI
-        run: cargo install rsupd --locked --features _cli
-      - name: Stage the headless server binary at its target path
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh run download ${{ github.run_id }} -n decryptd-linux-x86_64-server.tar.gz -D srv
-          mkdir -p target/x86_64-unknown-linux-gnu/release
-          tar -xzf srv/decryptd-linux-x86_64-server.tar.gz \
-            -C target/x86_64-unknown-linux-gnu/release decryptd
-      - name: Sign & publish the decryptd-server project
-        env:
-          RSUPD_IDENTITY: ${{ secrets.RSUPD_IDENTITY }}
-        run: rsupd publish --project decryptd-server --target x86_64-unknown-linux-gnu --channel master --yes

src/main.rs

@@ -921,27 +921,22 @@ fn upload_loop(ctx: RestContext, inflight: InFlight, done: Arc<Mutex<Receiver<Fi
 /// Trust anchor for self-updates: the SHA-256 fingerprint of the decryptd
 /// release signing key (`rsupd id export`). It's a hash of a public key, so it's
 /// safe to embed; the updater refuses any manifest not signed by the matching
-/// private identity.
+/// private identity. GUI-build only — the console `-server` build has no updater.
+#[cfg(feature = "gui")]
 const RSUPD_FINGERPRINT: &str = "80b9edc7e6eaebf10b2a25bb10556b9b7fa6abc9fbe556706a2b680cefa4a0fc";
 
-/// The rsupd project this build updates from. The dist backend keys releases by
-/// (project, version), so the GUI and headless builds — same version, same
-/// os_arch, different binary — must live under different projects, not just
-/// different channels. The GUI build is `decryptd`; the headless build is
-/// `decryptd-server`, published from the no-GUI binary. Both are signed by the
-/// same identity/fingerprint. A console worker thus updates to another console
-/// build, never the GTK-linked GUI one (which wouldn't start on a headless box).
+/// Build the signed auto-updater. The transport (dist-go over rsurl) and channel
+/// (`master`) default from the fingerprint, so the anchor is the only required
+/// input. The git stamps from `build.rs` let it also spot a newer build of the
+/// same version (and never reinstall the identical build).
+///
+/// GUI-build only. The dist backend keys releases by `(fingerprint, version)`, so
+/// with a single signing identity two variants can't publish the same version;
+/// the headless build therefore ships without an updater (download-only). Giving
+/// the server its own auto-update stream would need a second signing identity.
 #[cfg(feature = "gui")]
-const UPDATE_PROJECT: &str = "decryptd";
-#[cfg(not(feature = "gui"))]
-const UPDATE_PROJECT: &str = "decryptd-server";
-
-/// Build the signed auto-updater. The transport (dist-go over rsurl) defaults from
-/// the fingerprint, so the anchor + project are the only required inputs. The git
-/// stamps from `build.rs` let it also spot a newer build of the same version (and
-/// never reinstall the identical build).
 fn build_updater() -> rsupd::Result<rsupd::Updater> {
-    rsupd::Updater::builder(UPDATE_PROJECT, env!("CARGO_PKG_VERSION"))
+    rsupd::Updater::builder(env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION"))
         .fingerprint_hex(RSUPD_FINGERPRINT)
         .git_tag(env!("RSUPD_GIT_TAG"))
         .date_tag(rsupd::date_tag_from_unix(env!("RSUPD_BUILD_UNIX")))
@@ -955,12 +950,12 @@ fn main() -> Result<()> {
     let args = RunArgs::parse();
     let status = Status::default();
 
-    // Long-lived workers keep themselves current: check hourly in the background
-    // and restart into each new signed build. Each variant tracks its own update
-    // channel (see `build_updater`) — the GUI build on `master`, the headless
-    // `-server` build on `server` — so a console worker never pulls the GTK-linked
-    // GUI binary, which wouldn't start on a display-less box. `--once` is
-    // short-lived, so it skips the updater.
+    // Self-update is a GUI-build feature only (see `build_updater`): with one
+    // signing identity the headless build can't have an independent update stream,
+    // so it ships download-only. Long-lived GUI workers keep themselves current:
+    // check hourly in the background and restart into each new signed build.
+    // `--once` is short-lived, so it skips the updater.
+    #[cfg(feature = "gui")]
     if !args.once {
         match build_updater() {
             Ok(updater) => {