Make "Check for Updates" report its outcome; fix master publish

Windows users reported "Check for Updates" doing nothing and staying on
0.1.10. Diagnosis: the master channel serves 0.1.13 with a reachable,
signature-valid windows_amd64 artifact, and the update path works end to
end on Linux from a simulated old version — so the server side is fine.
The failure is Windows-client-specific and *invisible*: the GUI build has
no console, so update() errors (or a silent no-op) never reach the user.

- trigger_update_check now checks first, then reports every outcome via a
  desktop notification — "up to date", "Updating to vX…", or the actual
  error. No more silent "nothing happens"; the next attempt reveals the
  real Windows cause (likely unsigned-exe/SmartScreen or an rsurl issue).

- Fix the master publish that 0.1.14 broke: the dist backend keys releases
  by (project, version), so GUI + server can't share project `decryptd`
  at one version — the concurrent server publish won and master was
  rejected as "already published". The server build now updates from its
  own project `decryptd-server` (separate namespace, same signing
  identity); publish-server uses `--project decryptd-server`. The two
  publishes are independent, so a server failure can't block GUI updates.

Both feature sets + docs build clean; workflow YAML validated. Bump to
0.1.15.

Note: stuck 0.1.10 Windows users need a one-time manual reinstall of
0.1.15 (release zip); after that "Check for Updates" shows the real
result.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

.github/workflows/release.yml

@@ -57,11 +57,13 @@ jobs:
           RSUPD_IDENTITY: ${{ secrets.RSUPD_IDENTITY }}
         run: rsupd publish --ci --run ${{ github.run_id }} --channel master --yes
 
-  # The headless -server build tracks its own `server` channel so console workers
-  # auto-update to another console build, never the GTK-linked GUI binary on
-  # `master`. Its binary isn't a triple-named CI artifact, so `--ci` can't stage it;
-  # instead we drop it into target/<triple>/release/ and publish in local mode
-  # (rsupd packages the existing binary — no recompile).
+  # The headless -server build updates from its own rsupd project `decryptd-server`
+  # (the backend keys releases by project+version, so the GUI and server binaries —
+  # same version, same os_arch — can't share the `decryptd` project). Its binary
+  # isn't a triple-named CI artifact, so `--ci` can't stage it; instead we drop it
+  # into target/<triple>/release/ and publish in local mode with an explicit
+  # --project (rsupd packages the existing binary — no recompile). Independent of
+  # the master publish, so a failure here never blocks GUI updates.
   publish-server:
     name: Sign & publish server update
     needs: build
@@ -83,7 +85,7 @@ jobs:
           mkdir -p target/x86_64-unknown-linux-gnu/release
           tar -xzf srv/decryptd-linux-x86_64-server.tar.gz \
             -C target/x86_64-unknown-linux-gnu/release decryptd
-      - name: Sign & publish to the `server` channel
+      - name: Sign & publish the decryptd-server project
         env:
           RSUPD_IDENTITY: ${{ secrets.RSUPD_IDENTITY }}
-        run: rsupd publish --target x86_64-unknown-linux-gnu --channel server --yes
+        run: rsupd publish --project decryptd-server --target x86_64-unknown-linux-gnu --channel master --yes

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "decryptd"
-version = "0.1.14"
+version = "0.1.15"
 edition = "2024"
 license = "Proprietary"
 authors = ["Karpeles Lab Inc"]

Cargo.toml

@@ -184,20 +184,42 @@ fn notify_error(msg: &str) {
         .show();
 }
 
-/// Kick off a one-shot self-update from the tray. Reuses [`crate::build_updater`]
-/// — the same signed updater the hourly background task uses — so it shares the
-/// trust anchor and transport; `update()` fetches the latest signed manifest,
-/// installs it if it's a genuinely newer build, and re-execs into it. Runs on
-/// its own thread so a slow network never freezes the menu, and is a no-op (bar
-/// a log line) when we're already current.
+/// Desktop notification about an update-check outcome.
+fn notify_update(body: &str) {
+    let _ = notify_rust::Notification::new()
+        .summary(&format!("decryptd v{VERSION} — updates"))
+        .body(body)
+        .show();
+}
+
+/// Run a one-shot self-update from the tray, reporting the outcome via desktop
+/// notification. This is the ONLY feedback on the Windows GUI build (no console),
+/// so "Check for Updates" must never fail silently: the user always sees
+/// up-to-date, installing, or the actual error. Reuses [`crate::build_updater`]
+/// (same signed updater the hourly task uses); runs on its own thread so a slow
+/// network never freezes the menu.
 fn trigger_update_check() {
-    std::thread::spawn(|| match crate::build_updater() {
-        Ok(updater) => match updater.update() {
-            Ok(true) => {} // installed; the process is being replaced
-            Ok(false) => eprintln!("[decryptd] already up to date"),
-            Err(e) => eprintln!("[decryptd] update check failed: {e}"),
-        },
-        Err(e) => eprintln!("[decryptd] updater unavailable: {e}"),
+    std::thread::spawn(|| {
+        let updater = match crate::build_updater() {
+            Ok(u) => u,
+            Err(e) => {
+                notify_update(&format!("Updater unavailable: {e}"));
+                return;
+            }
+        };
+        // Check first so we can name the target version and surface a fetch/verify
+        // error, then hand off to update() (re-checks, installs, and restarts).
+        match updater.check() {
+            Ok(Some(available)) => {
+                let v = available.version().to_string();
+                notify_update(&format!("Updating to v{v} — decryptd will restart."));
+                if let Err(e) = updater.update() {
+                    notify_update(&format!("Update to v{v} failed: {e}"));
+                }
+            }
+            Ok(None) => notify_update(&format!("decryptd is up to date (v{VERSION}).")),
+            Err(e) => notify_update(&format!("Update check failed: {e}")),
+        }
     });
 }
 

src/gui.rs

@@ -924,23 +924,25 @@ fn upload_loop(ctx: RestContext, inflight: InFlight, done: Arc<Mutex<Receiver<Fi
 /// private identity.
 const RSUPD_FINGERPRINT: &str = "80b9edc7e6eaebf10b2a25bb10556b9b7fa6abc9fbe556706a2b680cefa4a0fc";
 
-/// The update channel this build tracks. The GUI build follows `master` (rsupd's
-/// default); the headless build follows `server`, a separate channel carrying the
-/// no-GUI binary, so a console worker updates to another console build rather than
-/// the GTK-linked GUI one. CI publishes each channel from its own binary.
+/// The rsupd project this build updates from. The dist backend keys releases by
+/// (project, version), so the GUI and headless builds — same version, same
+/// os_arch, different binary — must live under different projects, not just
+/// different channels. The GUI build is `decryptd`; the headless build is
+/// `decryptd-server`, published from the no-GUI binary. Both are signed by the
+/// same identity/fingerprint. A console worker thus updates to another console
+/// build, never the GTK-linked GUI one (which wouldn't start on a headless box).
 #[cfg(feature = "gui")]
-const UPDATE_CHANNEL: &str = "master";
+const UPDATE_PROJECT: &str = "decryptd";
 #[cfg(not(feature = "gui"))]
-const UPDATE_CHANNEL: &str = "server";
+const UPDATE_PROJECT: &str = "decryptd-server";
 
 /// Build the signed auto-updater. The transport (dist-go over rsurl) defaults from
-/// the fingerprint, so the anchor + channel are the only required inputs. The git
+/// the fingerprint, so the anchor + project are the only required inputs. The git
 /// stamps from `build.rs` let it also spot a newer build of the same version (and
 /// never reinstall the identical build).
 fn build_updater() -> rsupd::Result<rsupd::Updater> {
-    rsupd::Updater::builder(env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION"))
+    rsupd::Updater::builder(UPDATE_PROJECT, env!("CARGO_PKG_VERSION"))
         .fingerprint_hex(RSUPD_FINGERPRINT)
-        .channel(UPDATE_CHANNEL)
         .git_tag(env!("RSUPD_GIT_TAG"))
         .date_tag(rsupd::date_tag_from_unix(env!("RSUPD_BUILD_UNIX")))
         .build()