Let the Linux head check for updates, and seal its device key in the TPM

Two things the RPM shipped without, and the reason they arrive together is
that both are the same question — what may this platform ask of the machine,
and what must it not ask of the user.

◆ UPDATES: THIS CLIENT CHECKS AND FETCHES, AND PACKAGEKIT INSTALLS.

ADR 0013 rule 11 said there was no updater at all, and that went too far. It
conflated noticing that a newer build exists with installing it: the second is
what the trust argument is about, and the first is not — a client that checks
a fixed address and tells you what it found has taken no capability from
anybody. Written as a flat refusal, the rule bought its safety by paying a cost
that was avoidable, and the ADR now says so in its own words.

So LinuxUpdateChannel reads the rolling nightly release, compares versions the
way rpm compares them, downloads the package, verifies its digest and hands the
file to PackageKit over gdbus. Polkit asks; the user may say no; nothing is
torn down before the answer, because ApplyingEndsTheProcess is false and the
shell already knows what that means — it is the phone's shape, and declining an
update must not cost somebody their open shells.

Three details that are load-bearing rather than incidental:

  - The comparison is rpmvercmp and not SemVer, because rpm is what will accept
    or refuse the install. Same argument ADR 0014 makes for versionCode. The
    installed side is read out of the rpm database rather than derived from the
    assembly, so the SemVer-to-rpm translation exists in exactly one place. All
    28 expected values in RpmVersionTests came out of rpm itself rather than out
    of a reading of the algorithm.

  - The digest is checked and is not a signature. Velopack verifies its own
    downloads and Android checks a signature; an RPM over HTTPS has neither. The
    manifest names a SHA-256 and a mismatch deletes the file rather than leaving
    something installable-by-hand in the profile directory.

  - ONLY_TRUSTED is cleared, which is what routes the request to polkit's
    package-install-untrusted action. The package is unsigned, so requiring
    trust would fail every update at the last step.

◆ THE DEVICE KEY: SEALED IN THE TPM, BEHIND A PIN THE TPM CHECKS.

ADR 0007's amendment is the bar: a gate inside the process is not a gate. The
key is sealed into a TPM 2.0 keyedhash object whose userAuth comes from a PIN,
so unsealing is a command the chip refuses; the blob is encrypted to the storage
hierarchy and is useless on any other machine; nothing here ever compares a PIN.

The sealed object deliberately carries no NoDA attribute, and that one omission
is the whole reason four digits is enough: every wrong answer advances the TPM's
dictionary-attack counter and the chip stops answering entirely once it trips.
Measured at four wrong tries against a software TPM, after which the correct PIN
gets nothing either. It is asserted by a test rather than left to a reading of
the template, because removing the attribute leaves every other assertion
passing.

This is weaker than Hello and Touch ID and the difference is invisible, so it is
written down in three places rather than smoothed over: those raise their prompt
from inside the platform and this one is a window we draw. The prompt is
deliberately plain for that reason — teaching people that a convincing DodoSSH
PIN box is a system dialog is the one thing this design must not do.

Rejected, each for failing the amendment: the Secret Service API, which has no
per-use consent and is DPAPI's shape exactly; fprintd, which answers a question
and holds nothing, so skipping the call skips the gate; and a polkit-gated root
helper, which would work and puts a privileged component in a package that
installs nothing setuid.

Availability is narrower than "has a TPM": on Fedora /dev/tpmrm0 is root:tss and
desktop users are not in tss, so the ordinary case reports unavailable and keeps
asking for the passphrase. Shipping a udev rule to widen that is refused — it is
the administrator's decision, not an application package's.

◆ WHAT IS ACTUALLY VERIFIED, SINCE THAT IS THE PART THAT USUALLY ISN'T.

This is the only device key store in the repository with real coverage, and it
is only possible because the PIN is a delegate and the TPM is a device: seal,
unseal, wrong PIN, lockout, decline and a foreign blob all run unattended
against a software TPM. Windows and macOS cannot be tested at all — their
prompts block a suite forever, which WindowsDeviceKeyStoreTests records.

TSS.Net's own TcpTpmDevice cannot reach swtpm: it opens the platform socket too
and exchanges a handshake only the Microsoft reference simulator answers, so
Connect() blocks with no error and no timeout. SoftwareTpm speaks the data
channel and nothing else.

The suite also lied once and was fixed: the lockout test trips shared state, and
without a DictionaryAttackLockReset in Dispose every later test got null from a
correct PIN — six of them assert null and passed for entirely the wrong reason.

End to end on a real Fedora 44: a genuine linux-x64 publish packages, installs,
and every DT_NEEDED in the installed tree resolves except liblttng-ust, which is
the one this spec deliberately excludes. What no runner covers is /dev/tpmrm0,
PackageKit and polkit, and Phase 19 grew five checks for exactly those.

Also fixed: the magic-bytes literal picked up raw control characters, which made
LinuxDeviceKeyStore.cs binary to git — no diffs and no line-ending normalisation.

src/DodoSSH.Client.App/Platform/LinuxUpdateChannel.cs

@@ -0,0 +1,495 @@
+using System.Diagnostics;
+using System.Globalization;
+using System.Runtime.Versioning;
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
+using DodoSSH.Client.Session;
+
+namespace DodoSSH.Client.App.Platform;
+
+/// <summary>What a channel's release says it is publishing.</summary>
+/// <remarks>
+/// <para>
+/// Written by <c>scripts/ci-linux-rpm.sh</c> and read here, and it is a small file this repository
+/// controls rather than the forge's own release JSON for the reason the android manifest gives: this is
+/// fetched on a six-hourly timer, and a document whose shape changes when the forge is upgraded is not a
+/// contract.
+/// </para>
+/// <para>
+/// <b>The comparison is <see cref="RpmVersion"/> and never <see cref="Version"/>.</b> That is the string
+/// <c>rpm</c> will order the install against, so comparing anything else would let this offer an update
+/// PackageKit then refuses — the same argument <c>AndroidChannelManifest</c> makes for <c>versionCode</c>.
+/// The two differ exactly where it matters: <c>0.0.1-alpha.0.143</c> and <c>0.0.1~alpha.0.143</c> are one
+/// build, and only the second sorts below <c>0.0.1</c>.
+/// </para>
+/// </remarks>
+/// <param name="RpmVersion">The version-release string rpm knows the package by.</param>
+/// <param name="Version">What that build calls itself, for a human.</param>
+/// <param name="Rpm">The asset on the same release that holds it.</param>
+/// <param name="Sha256">The package's digest, lower-case hex.</param>
+internal sealed record LinuxChannelManifest(
+    [property: JsonPropertyName("rpmVersion")] string RpmVersion,
+    [property: JsonPropertyName("version")] string Version,
+    [property: JsonPropertyName("rpm")] string Rpm,
+    [property: JsonPropertyName("sha256")] string Sha256);
+
+/// <summary>One release as the forge describes it. Only the assets are read.</summary>
+internal sealed record LinuxForgeRelease(
+    [property: JsonPropertyName("assets")] IReadOnlyList<LinuxForgeAsset>? Assets);
+
+/// <summary>One file attached to a release.</summary>
+internal sealed record LinuxForgeAsset(
+    [property: JsonPropertyName("name")] string? Name,
+    [property: JsonPropertyName("browser_download_url")] string? DownloadUrl);
+
+[JsonSourceGenerationOptions(UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
+[JsonSerializable(typeof(LinuxChannelManifest))]
+[JsonSerializable(typeof(LinuxForgeRelease))]
+internal sealed partial class LinuxForgeJsonContext : JsonSerializerContext;
+
+/// <summary>
+/// Fetches a newer RPM from the project's own forge and asks the system's package manager to install it.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>Nothing here replaces anything.</b> That is the difference from
+/// <see cref="VelopackUpdateChannel"/> and it is the decision ADR 0013 rule 11 records rather than an
+/// unfinished half: on this platform the package manager is already an updater the user trusts, audits and
+/// controls, so this class does the two things the package manager cannot — notice that a build exists and
+/// fetch it — and then hands the file to PackageKit, which raises polkit and asks. The shape is the
+/// phone's, not the desktop's: <see cref="ApplyingEndsTheProcess"/> is false, and the answer may be no.
+/// </para>
+/// <para>
+/// <b>The feed is a constant and the deployment is never asked.</b> ADR 0011 rule 2, carried unchanged
+/// from both other channels: an operator who could answer the update check could pin a chosen user to a
+/// build with a known hole, without holding any key at all.
+/// </para>
+/// <para>
+/// <b>The digest is checked and is not a signature.</b> Velopack verifies what it downloads and Android
+/// refuses a package whose signature does not match the installed one; an RPM fetched over HTTPS and
+/// handed to PackageKit has neither. So the manifest names a digest and this refuses anything else —
+/// which catches a truncated download, a caching proxy and a corrupted mirror, and catches nothing at all
+/// about who built the file, because the same job wrote both. Provenance here is the constant address; a
+/// signed repository is what would improve on it, and ADR 0013 rule 11 says why there is not one yet.
+/// </para>
+/// </remarks>
+[SupportedOSPlatform("linux")]
+internal sealed class LinuxUpdateChannel : IUpdateChannel
+{
+    /// <summary>The project's own forge, and the one address in this file.</summary>
+    /// <remarks>
+    /// The owner half of the path matters for the reason <c>AndroidUpdateChannel</c> records: the
+    /// repository moved between organisations and Gitea leaves a 301 behind, so a client naming the old
+    /// one works until somebody deletes the redirect.
+    /// </remarks>
+    private const string RepositoryApi = "https://git.dodotech.cloud/api/v1/repos/DodoTech-Public/DodoSSH";
+
+    private readonly string channel;
+    private readonly string packageName;
+    private readonly string dataDirectory;
+    private readonly HttpClient http;
+    private readonly Func<string, string?> installedVersion;
+    private readonly Action<string> handToInstaller;
+
+    private (string Version, string RpmVersion, string Url, string Sha256)? found;
+    private string? fetched;
+
+    /// <summary>Creates a channel for the running build.</summary>
+    internal LinuxUpdateChannel(string channel)
+        : this(
+            channel,
+            ClientPaths.ForChannel(DesktopChannel.Name).DataDirectory,
+            new HttpClient(),
+            InstalledRpmVersion,
+            HandToPackageKit)
+    {
+    }
+
+    /// <summary>Creates a channel with its outside world supplied, which is how the tests reach it.</summary>
+    internal LinuxUpdateChannel(
+        string channel,
+        string dataDirectory,
+        HttpClient http,
+        Func<string, string?> installedVersion,
+        Action<string> handToInstaller)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(channel);
+        ArgumentException.ThrowIfNullOrEmpty(dataDirectory);
+        ArgumentNullException.ThrowIfNull(http);
+        ArgumentNullException.ThrowIfNull(installedVersion);
+        ArgumentNullException.ThrowIfNull(handToInstaller);
+
+        this.channel = channel;
+        this.dataDirectory = dataDirectory;
+        this.http = http;
+        this.installedVersion = installedVersion;
+        this.handToInstaller = handToInstaller;
+
+        packageName = string.Equals(channel, "nightly", StringComparison.Ordinal)
+            ? "dodossh-nightly"
+            : "dodossh";
+    }
+
+    /// <inheritdoc />
+    /// <remarks>
+    /// True unconditionally, because whether this copy is one that can be updated was already decided by
+    /// <see cref="UpdateChannels.ForThisMachine"/> — a build run from a checkout never reaches this class
+    /// at all. The same split Velopack's side uses, where <c>IsInstalled</c> is checked once at
+    /// composition rather than at every call site.
+    /// </remarks>
+    public bool IsSupported => true;
+
+    /// <inheritdoc />
+    public string CurrentVersion => ClientVersion.Current;
+
+    /// <inheritdoc />
+    /// <remarks>
+    /// False, and for the phone's reason rather than the desktop's. Applying hands a file to PackageKit
+    /// and returns; polkit then asks, and the user may say no. A caller that had already torn the vault
+    /// down would answer "not now" with a locked vault and every shell gone.
+    /// </remarks>
+    public bool ApplyingEndsTheProcess => false;
+
+    /// <inheritdoc />
+    /// <exception cref="HttpRequestException">The forge could not be reached, or refused.</exception>
+    /// <exception cref="InvalidOperationException">The release is there and does not carry a usable build.</exception>
+    public async Task<AvailableUpdate?> CheckAsync(CancellationToken cancellationToken)
+    {
+        var release = await ReadAsync(
+                ReleaseUrl(),
+                LinuxForgeJsonContext.Default.LinuxForgeRelease,
+                cancellationToken)
+            .ConfigureAwait(false);
+
+        var manifestName = $"linux-{channel}.json";
+
+        if (Asset(release, manifestName) is not { } manifestAsset)
+        {
+            throw new InvalidOperationException(
+                $"The {channel} release carries no {manifestName}, so there is nothing saying what it "
+                + "publishes.");
+        }
+
+        var manifest = await ReadAsync(
+                manifestAsset,
+                LinuxForgeJsonContext.Default.LinuxChannelManifest,
+                cancellationToken)
+            .ConfigureAwait(false);
+
+        if (manifest is null)
+        {
+            throw new InvalidOperationException(
+                $"The {channel} release's {manifestName} could not be read as a manifest.");
+        }
+
+        // The one place null is returned, and it means what null is documented to mean: this build is
+        // current. Compared the way rpm compares, because rpm is what accepts or refuses the install.
+        if (RpmVersion.Compare(manifest.RpmVersion, installedVersion(packageName) ?? "0") <= 0)
+        {
+            return null;
+        }
+
+        if (Asset(release, manifest.Rpm) is not { } rpm)
+        {
+            throw new InvalidOperationException(
+                $"The {channel} release advertises {manifest.Version} but carries no {manifest.Rpm}.");
+        }
+
+        found = (manifest.Version, manifest.RpmVersion, rpm, manifest.Sha256);
+
+        return new AvailableUpdate(manifest.Version);
+    }
+
+    /// <inheritdoc />
+    public async Task DownloadAsync(
+        AvailableUpdate update,
+        IProgress<int> progress,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(update);
+        ArgumentNullException.ThrowIfNull(progress);
+
+        if (found is not { } target
+            || !string.Equals(target.Version, update.Version, StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                "That update did not come from this channel's last check. Check again before downloading.");
+        }
+
+        // Under the profile directory rather than /tmp, because a package this size on a tmpfs is a
+        // machine that runs out of memory downloading an update. One name, overwritten, so a client that
+        // fetched three updates it never installed is not holding three hundred megabytes.
+        var directory = Path.Combine(dataDirectory, "updates");
+
+        Directory.CreateDirectory(directory);
+
+        var path = Path.Combine(directory, $"{packageName}-update.rpm");
+
+        await FetchAsync(target.Url, path, progress, cancellationToken).ConfigureAwait(false);
+
+        // ◆ Verified before it is ever named to the installer, and the file is removed if it does not
+        // match. Leaving a package that failed its digest on disk would put a file somebody could install
+        // by hand next to a filename that says it is an update.
+        var digest = Convert.ToHexStringLower(await Sha256OfAsync(path, cancellationToken).ConfigureAwait(false));
+
+        if (!string.Equals(digest, target.Sha256, StringComparison.OrdinalIgnoreCase))
+        {
+            File.Delete(path);
+
+            throw new InvalidOperationException(
+                $"The downloaded package is not the one {channel} published: expected {target.Sha256}, "
+                + $"got {digest}.");
+        }
+
+        fetched = path;
+    }
+
+    /// <summary>Streams one URL to one path, reporting progress as it goes.</summary>
+    private async Task FetchAsync(
+        string url,
+        string path,
+        IProgress<int> progress,
+        CancellationToken cancellationToken)
+    {
+        using var response = await http
+            .GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken)
+            .ConfigureAwait(false);
+
+        response.EnsureSuccessStatusCode();
+
+        var total = response.Content.Headers.ContentLength ?? 0;
+
+        var stream = await response.Content.ReadAsStreamAsync(cancellationToken).ConfigureAwait(false);
+        var destination = File.Create(path);
+
+        await using (stream.ConfigureAwait(false))
+        await using (destination.ConfigureAwait(false))
+        {
+            var buffer = new byte[81920];
+            long copied = 0;
+            int read;
+
+            while ((read = await stream.ReadAsync(buffer, cancellationToken).ConfigureAwait(false)) > 0)
+            {
+                await destination.WriteAsync(buffer.AsMemory(0, read), cancellationToken)
+                    .ConfigureAwait(false);
+
+                copied += read;
+
+                if (total > 0)
+                {
+                    progress.Report((int)(copied * 100 / total));
+                }
+            }
+        }
+    }
+
+    /// <inheritdoc />
+    /// <remarks>
+    /// <para>
+    /// <b>This installs nothing and returns immediately.</b> It asks PackageKit — the freedesktop service
+    /// every RPM distribution runs — to install a local file, which raises a polkit prompt drawn by the
+    /// desktop rather than by this application. The user may refuse, and refusing is not a failure.
+    /// </para>
+    /// <para>
+    /// <b>The process is not restarted and must not be.</b> Replacing files under a running process is
+    /// ordinary on Linux: the old inodes stay mapped and this build keeps running until somebody closes
+    /// it. That is the right behaviour for an application that deliberately keeps shells open across a
+    /// lock — the same argument ADR 0013 makes for waiting for a restart the user asks for — and it is why
+    /// the name inherited from the interface reads oddly here. There is no equivalent of Android's
+    /// "the platform ends the process", so nothing ends it.
+    /// </para>
+    /// </remarks>
+    public void ApplyAndRestart(AvailableUpdate update)
+    {
+        ArgumentNullException.ThrowIfNull(update);
+
+        if (fetched is not { } path || !File.Exists(path))
+        {
+            throw new InvalidOperationException("There is no downloaded update to install.");
+        }
+
+        handToInstaller(path);
+    }
+
+    /// <summary>Which release this build's channel reads.</summary>
+    /// <remarks>
+    /// <c>releases/latest</c> skips prereleases, which keeps the nightly — published as one — out of the
+    /// release channel's answer even though both live on the same forge.
+    /// </remarks>
+    private string ReleaseUrl() =>
+        string.Equals(channel, "nightly", StringComparison.Ordinal)
+            ? $"{RepositoryApi}/releases/tags/nightly-desktop"
+            : $"{RepositoryApi}/releases/latest";
+
+    private static string? Asset(LinuxForgeRelease? release, string name) =>
+        release?.Assets?.FirstOrDefault(
+            asset => string.Equals(asset.Name, name, StringComparison.Ordinal))?.DownloadUrl;
+
+    private async Task<T?> ReadAsync<T>(
+        string url,
+        JsonTypeInfo<T> shape,
+        CancellationToken cancellationToken)
+    {
+        var stream = await http.GetStreamAsync(url, cancellationToken).ConfigureAwait(false);
+
+        await using (stream.ConfigureAwait(false))
+        {
+            return await JsonSerializer
+                .DeserializeAsync(stream, shape, cancellationToken)
+                .ConfigureAwait(false);
+        }
+    }
+
+    private static async Task<byte[]> Sha256OfAsync(string path, CancellationToken cancellationToken)
+    {
+        var stream = File.OpenRead(path);
+
+        await using (stream.ConfigureAwait(false))
+        {
+            return await SHA256.HashDataAsync(stream, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    /// What rpm records for the installed package, which is the number a newer build must beat.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Read from the package database rather than from the assembly, for the reason
+    /// <c>AndroidUpdateChannel.ReadInstalledVersionCode</c> gives about reading it from the platform: the
+    /// assembly's version is a SemVer string and this comparison has to be the one the installer will
+    /// make. Deriving the rpm version from the assembly here would mean a second copy of the translation
+    /// <c>scripts/ci-linux-rpm.sh</c> performs, and two copies of one rule is a pair that can disagree.
+    /// </para>
+    /// <para>
+    /// A machine that cannot answer gets null, which the caller reads as <c>0</c> and makes every
+    /// published build look newer. That is the wrong way to fail, chosen deliberately: the failure is then
+    /// an install PackageKit declines rather than a security fix that never arrives.
+    /// </para>
+    /// </remarks>
+    private static string? InstalledRpmVersion(string packageName)
+    {
+        try
+        {
+            using var process = Process.Start(new ProcessStartInfo("rpm")
+            {
+                ArgumentList = { "-q", "--queryformat", "%{VERSION}-%{RELEASE}", packageName },
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+            });
+
+            if (process is null)
+            {
+                return null;
+            }
+
+            var answer = process.StandardOutput.ReadToEnd().Trim();
+
+            process.WaitForExit(TimeSpan.FromSeconds(10));
+
+            return process.ExitCode == 0 && answer.Length > 0 ? answer : null;
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>Asks PackageKit to install a local file, and lets polkit do the asking.</summary>
+    /// <remarks>
+    /// <para>
+    /// <b>Over <c>gdbus</c> rather than a D-Bus library, and that is a dependency argument rather than a
+    /// stylistic one.</b> <c>gdbus</c> ships in glib2, which this package already depends on twice over —
+    /// GTK and WebKitGTK are the terminal — so it is present on every machine that can run this at all.
+    /// Adding a managed D-Bus stack to reach two method calls would be a package, a lock file entry and a
+    /// second thing to keep current, for no capability. <c>BrowserLauncher</c> settles the same trade the
+    /// same way one layer down.
+    /// </para>
+    /// <para>
+    /// <b>Two calls, because PackageKit's interface is a factory.</b> <c>CreateTransaction</c> returns an
+    /// object path and the work is asked of that; a transaction is single-use, so this cannot be cached.
+    /// </para>
+    /// <para>
+    /// <b>The flags word is zero, and zero is load-bearing.</b> Bit 0 is <c>ONLY_TRUSTED</c>. This
+    /// package is not signed — ADR 0013 rule 11 says why, and why that is not decision 8's "unsigned for
+    /// now" — so requiring trust would make every update fail at the last step. Clearing it is what routes
+    /// the request to polkit's <c>package-install-untrusted</c> action, which asks for an administrator
+    /// rather than proceeding quietly. The user sees what they are agreeing to.
+    /// </para>
+    /// </remarks>
+    private static void HandToPackageKit(string path)
+    {
+        var transaction = Gdbus(
+            "--system",
+            "--dest", "org.freedesktop.PackageKit",
+            "--object-path", "/org/freedesktop/PackageKit",
+            "--method", "org.freedesktop.PackageKit.CreateTransaction");
+
+        // gdbus prints a GVariant tuple — (objectpath '/17_beadcfae',) — and the path is the only thing
+        // in it. Parsed by taking what is between the quotes rather than with a regular expression over a
+        // format nobody has promised to keep.
+        var opened = transaction.IndexOf('\'', StringComparison.Ordinal);
+        var closed = transaction.LastIndexOf('\'');
+
+        if (opened < 0 || closed <= opened)
+        {
+            throw new InvalidOperationException(
+                $"PackageKit did not return a transaction to install into: {transaction}");
+        }
+
+        var objectPath = transaction[(opened + 1)..closed];
+
+        Gdbus(
+            "--system",
+            "--dest", "org.freedesktop.PackageKit",
+            "--object-path", objectPath,
+            "--method", "org.freedesktop.PackageKit.Transaction.InstallFiles",
+            "0",
+            $"['{path}']");
+    }
+
+    /// <summary>Runs one gdbus call and answers with its output.</summary>
+    private static string Gdbus(params string[] arguments)
+    {
+        var start = new ProcessStartInfo("gdbus")
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+
+        foreach (var argument in arguments)
+        {
+            start.ArgumentList.Add(argument);
+        }
+
+        using var process = Process.Start(start)
+            ?? throw new InvalidOperationException(
+                "gdbus could not be started, so the package could not be handed to PackageKit.");
+
+        var output = process.StandardOutput.ReadToEnd();
+        var error = process.StandardError.ReadToEnd();
+
+        process.WaitForExit(TimeSpan.FromSeconds(30));
+
+        if (process.ExitCode != 0)
+        {
+            // The message is shown to the user by UpdateViewModel, so it says what to do rather than what
+            // failed. A missing PackageKit is the likely cause on a minimal install and is the one thing
+            // they can fix.
+            throw new InvalidOperationException(
+                string.Format(
+                    CultureInfo.CurrentCulture,
+                    "PackageKit would not take the package. Install it with `sudo dnf install PackageKit`, "
+                    + "or install the file yourself: {0}. ({1})",
+                    arguments[^1],
+                    error.Trim()));
+        }
+
+        return output;
+    }
+}