rename: app id network.ur.urnetwork -> com.bringyour.network by Ryanmello07 · Pull Request #5 · urnetwork/linux

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 · 2026-08-21T06:19:18Z

The Android and Apple clients ship under com.bringyour.network. Linux was the
only platform on a different reverse-DNS id, which meant every place the id gets
written down had to be told which one to use. This makes Linux match.

Why it is one commit and not six

The app id is a join key. All of these must agree or the desktop stops
recognising the app, and they fail silently at runtime, not at build time:

Consumer	What it uses the id for
`main.cpp`	the GApplication id passed to `Gtk::Application::create()`
`*.desktop`	filename (D-Bus activation), `Icon=`, `StartupWMClass=`
`metainfo.xml`	filename, `<id>`, `<launchable>`
polkit `.policy`	filename and all four action ids, matched by `ControlProtocol.hpp` so the daemon asks about the actions the shipped file actually declares
hicolor icons	basenames — Flatpak refuses to export an icon whose name is not the app id
flatpak manifest	filename, `id:`, and the `desktop-file-edit` paths
deb / rpm / tarball / AppImage / snap	installed paths, conffile entries, and the uninstaller's stale-path list

Splitting these would leave an intermediate commit where, for example, the
.desktop names an icon that does not exist, or the daemon checks polkit
actions the shipped .policy does not declare. Neither errors; both just stop
working.

Two things that are not search-and-replace

1. UrTheme::kAppIconName. The icon name was spelled as a literal in two
places — the by-path load in UrTheme.cpp and the by-name fallback in
MainWindow.cpp. Renaming the packaging alone left both pointing at a file that
no longer existed, and set_from_icon_name() renders a blank image without
raising anything, so the title-bar logo simply went empty. It is now one
constant shared by the packaging and both call sites.

2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp
moves with the id. This is deliberately not dual-read: an entry written by an
older build is no longer found, the app falls back to a fresh RPC session (the
same one-time cost as a Flatpak data path moving), and the previous app identity
is not left holding live key material in the user's keyring with nothing to
clean it up. Calling that out explicitly because it is the one user-visible
consequence of this PR.

Verified

network.ur.urnetwork appears nowhere in the tree afterwards.
bash -n on every touched shell script; yaml.safe_load on every touched
YAML; desktop-file-validate on both .desktop files; appstreamcli validate --no-net on the metainfo; XML well-formedness on the polkit policy.

Why this is split this way

This is the largest PR of the seven and it is unavoidably wide, but it is also
the shallowest: almost every hunk is one string. It is deliberately kept to
only the rename, so a reviewer can read it as "is this the right id, and did
they get every consumer" without also having to evaluate new artwork, a new
package format, or a build-system change. Those are PRs 3–6, each of which
rebases onto this one.

Two things that our internal branch does in the same commit have been held back
on purpose:

the new icon artwork and the extra sizes → PR 3. This PR renames the two
existing icon files byte-for-byte, so the rename is reviewable without also
reviewing artwork.
the metainfo templating → PR 4. This PR renames the static
metainfo.xml and leaves it static, so the tree is self-consistent at this
commit; PR 4 converts it to a configure_file template.

The Android and Apple clients ship under `com.bringyour.network`. Linux was the only platform on a different reverse-DNS id, and every place the id is written down had to be told which one to use. This makes Linux match, and it has to be done in one change because the id is a join key: the GTK application id, the .desktop basename, the AppStream component id, the polkit action namespace, the icon-theme name and the Flatpak app id must all agree or the desktop stops recognising the app. WHAT MOVES, AND WHY IT IS ALL ONE COMMIT main.cpp Gtk::Application::create() -- the GApplication id *.desktop filename, Icon=, StartupWMClass= metainfo.xml filename, <id>, <launchable> polkit .policy filename + all four action ids, matched in ControlProtocol.hpp so the daemon asks about the actions the file actually declares icons hicolor basenames; Flatpak refuses to export an icon whose name is not the app id flatpak manifest filename + id + the desktop-file-edit paths deb/rpm/tarball/ the installed paths, the conffile entries, and the AppImage/snap uninstaller's stale-path list Splitting these would leave an intermediate commit where, for example, the .desktop names an icon that does not exist, or the daemon checks polkit actions the shipped .policy does not declare -- both of which fail silently at runtime rather than at build time. TWO THINGS THAT ARE NOT PURE SEARCH-AND-REPLACE 1. `UrTheme::kAppIconName`. The icon name was spelled as a literal in two places -- the by-path load in UrTheme.cpp and the by-name fallback in MainWindow.cpp. Renaming the packaging alone left both lookups pointing at a file that no longer existed, and `set_from_icon_name()` renders a blank image without raising anything, so the title-bar logo simply went empty. It is now one constant that the packaging and both call sites share. 2. The libsecret keyring attribute in SecretServiceRpcSessionStore.cpp moves with the id. This is deliberately NOT dual-read: an entry written by an older build is no longer found, the app falls back to a fresh RPC session (the same one-time cost as the Flatpak data path moving), and the previous app identity is not left holding live key material in the user's keyring with nothing to clean it up. No behaviour changes beyond those two. `network.ur.urnetwork` no longer appears anywhere in the tree.

Ryanmello07 changed the title ~~PR 2 — upstream/app-id-rename~~rename: app id network.ur.urnetwork -> com.bringyour.networkAug 21, 2026

Ryanmello07 marked this pull request as ready for review August 21, 2026 15:40

Ryanmello07 merged commit b11bb54 into urnetwork:mainAug 21, 2026
3 checks passed