You can automate the winget update if you want 
Example:
Discussion on Winget
Hi, thanks for this useful utility. I’ve noticed that each release contains signature files for each downloadable executable package. But I’m not seeing a link on this thread, or the project page, or your own github page, to the public key one would use for verifying that signature. Where might I obtain this? Thanks.
Normally gpg itself tells you the key it lacks to verify a signature, e.g.:
$ gpg --verify syncthingtray-1.4.12-x86_64-pc-linux-gnu.tar.xz{.sig,}
gpg: Signature made Tue Jan 2 22:52:05 2024 CET
gpg: using RSA key B9E36A7275FC61B464B67907E06FE8F53CDC6A4C
gpg: Can't check signature: No public key
You can then import that key:
$ gpg --recv-keys B9E36A7275FC61B464B67907E06FE8F53CDC6A4C
gpg: key E06FE8F53CDC6A4C: public key "Martchus <martchus@gmx.net>" imported
gpg: Total number processed: 1
gpg: imported: 1
Now you can verify the signature again:
$ gpg --verify syncthingtray-1.4.12-x86_64-pc-linux-gnu.tar.xz{.sig,}
gpg: Signature made Tue Jan 2 22:52:05 2024 CET
gpg: using RSA key B9E36A7275FC61B464B67907E06FE8F53CDC6A4C
gpg: Good signature from "Martchus <martchus@gmx.net>" [unknown]
gpg: aka "Marius Kittler <mariuskittler@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: B9E3 6A72 75FC 61B4 64B6 7907 E06F E8F5 3CDC 6A4C
It would even be possibly to configure receiving keys automatically. Of course the signature is still not considered trustworthy yet but the verification works and the signature matched. If you want to make it a trusted signature you can --lsign-key it. (If the signature would not have matched because the file was tampered with you would have gotten gpg: BAD signature from "Martchus <martchus@gmx.net>" [unknown] instead.)
Note that I’m not using gpg very often so take my word with a grain of salt.
Thanks. Of course, the drawback there is that, for verification purposes, it’s sort of circular reasoning to look at the signature to figure out what key signed it, then go find the matching key and then verify that that key signed it. All that winds up really proving is that it was signed by someone. Whose key that really is, you wouldn’t know. Ideally there is a trusted public place to see the key belonging to a particular person or organization, separate from where the download itself comes from.
Yes, in the first place you only verify that the file is correctly signed by someone. On subsequent downloads you can verify that the file is signed by the same someone as before which is when the verification becomes useful.
Not sure how to solve this from my side. I could of course mention the key on GitHub but that’s not very useful because if someone gains access to my account and can tamper with the files offered there for download they can most likely also edit the mentioning of the key. The key needed to be mentioned at a different place than where the download is served from.
When setting up a website for Syncthing Tray (at some point) I am probably going to use GitHub pages. I guess if I would mention the key there the same caveat would apply.
Maybe it would make more sense to link to other places where the key is mentioned, e.g. Unofficial user repositories - ArchWiki and Server dashboard. It is unlikely that an attacker tampering the downloads on GitHub would also be able to gain access to the systems hosting these pages at the same time. So I could change my release script to mention these pages in the release description (which could be a bit more descriptive anyway). Of course the same problem still applies as an attacker could just change those references to other servers under they’re control and new users would probably not notice it.
I would start by just mentioning it in the README. Compromised binaries/packages can end up on download sites in ways other than having your Github account compromised[1], and if it’s in the repo, then the signature is at least as trusted as the source code. After a while it becomes established.
and of course some of those can be before you sign it, anyway, but… ↩︎
3 Likes
Changes in recent releases of Syncthing Tray that might be worth highlighting:
- Syncthing Tray now allows one to automatically stop Syncthing (or pause all devices) as long as the current network connection is considered metered. So if you migrated from SyncTrayzor and found this feature was missing you can now enable it in Syncthing Tray as well under the launcher settings (or connection settings for just pausing devices).
- The KDE integrations were ported to KDE 6 a while ago and are now ready to use after KDE 6 has just been released. Note that when using my packaging for Arch Linux, openSUSE and Fedora you will have to use the Qt 6 version of the packages (the set of packages ending with
-qt6). - A bug with the high-DPI support that caused too big or blurry icons in setups with mixed scaling factors was fixed.
- Syncthing Tray supports now Qt 6.7 and its improved styling under Windows 11. So when Qt 6.7 is released the next Syncthing Tray release will look much better under Windows 11. (Of course you will still be able to switch the style back if you prefer a more traditional look.)
1 Like
Hi I’m using ubuntu 22.04.4 gnome , I tried to install syncthingtray by downloading the binary syncthingtray-1.5.0-x86_64-pc-linux-gnu.tar.xz which I unzipped into my /opt, I already have my syncthing setup, I encountered a few annoying bugs first I have to double left click to open the tray, then it closes only when I open a new app, if I re open it a second time now it doesn’t closes unless I manage to right click and open the settings from the tray.
maybe I did something wrong at the installation, the app seemed to work fine apart from those bug, what’s the best way to install the tray ?
Unfortunately not a platform/environment I use myself but maybe others can be of better help. I assume you use this extension then?
The number of clicks is not controlled by the Syncthing Tray but by the tray/shell itself. So I’m afraid that’s nothing I could tweak from my side (and in any other environment I know only a single click is required).
This all sounds like your environment doesn’t support the type of application Syncthing Tray is.
Probably your only mistake was your choice of environment - GNOME is just very streamlined and therefore too limited to support applications like Syncthing Tray well. You can workaround it by changing the window type in the appearance settings, e.g. you can make it so the web UI opens directly when clicking on the icon (so the “buggy” part is just left out). See also GitHub - Martchus/syncthingtray: Tray application and Dolphin/Plasma integration for Syncthing for more details.
1 Like
thank you for your quick answer! Tbh I’m used to gnome, but open to new environments , is there any one you’d recommend (I’d love yo use syncthingtray in the way it was intended to)?
I think general recommendations are out of scope for this thread (especially as they could lead to heated discussions) and it also really depends on your personal preferences.
Syncthing Tray is best supported on Windows as this is a stable/uniform platform that supports everything needed for Syncthing Tray to work. Plasma is also well supported considering the Plasmoid and Dolphin integration. Generally, any X11-based environment with proper tray icon support is supposed to work. However, the distribution for GNU/Linux is not as easy as for Windows so packages for your distribution might be too old nor non-existent (and the binary for GNU/Linux on GitHub cannot support the Plasmoid). Also checkout the supported platforms section in the README.
1 Like
After update 1.5.0 The GUI has changed (on KDE) to what looks to be an older GUI and i can not figure how to get it back
I have seen it do this before but i cant for the life of me remember how i get it to work again.
EDIT: I am thinking that the problem is that i usually use the plasmoid but this is the stand-alone app. But i cant see how to add the plasmoid, it is not listed in the “add widget” or the system tray configs?
It normally looks like this (not the colour & theme)
But it now looks like this?
It looks like an older GUI to me but i dont know.
I dont really want to uninstall and reinstall because im not sure i want to set it all up again (if i can remember how).
Any suggestions?
System info
syncthingtray Version : 1.5.0-1
System:
Host: greg-optiplex7050 Kernel: 6.6.10-1-MANJARO arch: x86_64 bits: 64
Desktop: KDE Plasma v: 5.27.10 Distro: Manjaro Linux
Machine:
Type: Desktop System: Dell product: OptiPlex 7050 v: N/A
serial: <superuser required>
Mobo: Dell model: 055H3G v: A01 serial: <superuser required> UEFI: Dell
v: 1.26.0 date: 08/20/2023
CPU:
Info: quad core Intel Core i7-7700 [MCP] speed (MHz): avg: 4086
min/max: 800/4200
Graphics:
Device-1: Intel HD Graphics 630 driver: i915 v: kernel
Display: x11 server: X.Org v: 21.1.10 with: Xwayland v: 23.2.3 driver: X:
loaded: modesetting dri: iris gpu: i915 resolution: 3840x2160~60Hz
API: OpenGL v: 4.6 compat-v: 4.5 vendor: intel mesa v: 23.3.3-manjaro1.1
renderer: Mesa Intel HD Graphics 630 (KBL GT2)
Network:
Device-1: Intel Ethernet I219-LM driver: e1000e
Device-2: Intel Wireless 8265 / 8275 driver: iwlwifi
Drives:
Local Storage: total: 1.84 TiB used: 228.87 GiB (12.1%)
Info:
Processes: 220 Uptime: 31m Memory: total: 16 GiB available: 15.49 GiB
used: 4.84 GiB (31.3%) Shell: fish inxi: 3.3.31
Just a thought about GNOME desktop integration in general: There are several extensions for GNOME Shell that offer some of the same functionality, though not as feature-rich as syncthingtray. I’m using one of those happily, though maintenance regarding new version compatibility is not always as quick as one could wish.
You need to install syncthingtray-qt6 (and may uninstall syncthingtray) as I mentioned in my last summary about recent changes in this forum thread. Checkout the remarks in the pinned comments on the AUR for further details.
And yes, this is about the Plasmoid vs. the stand-alone version. Checkout the according README section for details.
That’s fortunately not how it works. When uninstalling a package of a GUI application like Syncthing Tray the configuration is not lost. So when installing the package again you won’t have to reconfigure anything. This also counts for switching from syncthingtray to syncthingtray-qt6 except that you’ll have to remove the “old” Plasmoid and add the new Plasmoid because for Plasma these are distinct Plasmoids. Removing/re-adding the Plasmoid does not reset the overall configuration so this is not a big deal. Again, checkout the README for details.
1 Like
Hmm, what am i doing wrong? why cant i reach/resolve
:: (27/40) Failed to download PKGBUILD: kcmutils-git
:: (27/40) Failed to download PKGBUILD: upower-git
:: (27/40) Failed to download PKGBUILD: qtforkawesome-qt6
:: (27/40) Failed to download PKGBUILD: kirigami-git
-> error fetching kauth-git: Cloning into 'kauth-git'...
fatal: unable to access 'https://aur.archlinux.org/kauth-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching knotifications-git: Cloning into 'knotifications-git'...
fatal: unable to access 'https://aur.archlinux.org/knotifications-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kiconthemes-git: Cloning into 'kiconthemes-git'...
fatal: unable to access 'https://aur.archlinux.org/kiconthemes-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kdoctools-git: Cloning into 'kdoctools-git'...
fatal: unable to access 'https://aur.archlinux.org/kdoctools-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kguiaddons-git: Cloning into 'kguiaddons-git'...
fatal: unable to access 'https://aur.archlinux.org/kguiaddons-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kdbusaddons-git: Cloning into 'kdbusaddons-git'...
fatal: unable to access 'https://aur.archlinux.org/kdbusaddons-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kcrash-git: Cloning into 'kcrash-git'...
fatal: unable to access 'https://aur.archlinux.org/kcrash-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching karchive-git: Cloning into 'karchive-git'...
fatal: unable to access 'https://aur.archlinux.org/karchive-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kwidgetsaddons-git: Cloning into 'kwidgetsaddons-git'...
fatal: unable to access 'https://aur.archlinux.org/kwidgetsaddons-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kcmutils-git: Cloning into 'kcmutils-git'...
fatal: unable to access 'https://aur.archlinux.org/kcmutils-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching upower-git: Cloning into 'upower-git'...
fatal: unable to access 'https://aur.archlinux.org/upower-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching qtforkawesome-qt6: Cloning into 'qtforkawesome-qt6'...
fatal: unable to access 'https://aur.archlinux.org/qtforkawesome-qt6.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
error fetching kirigami-git: Cloning into 'kirigami-git'...
fatal: unable to access 'https://aur.archlinux.org/kirigami-git.git/': Could not resolve host: aur.archlinux.org
context: exit status 128
I do use adguard on my server for DNS, maybe something to do with that ? I would doubt it though.
k…-git packages are not expected to be required. Could it be that Manjaro is not yet providing KDE 6 packages (so you’re still using Plasma 5)? Note that Manjaro is not supported by the AUR and using it nevertheless is asking for trouble as packages in Manjaro might be too old. I suppose in this case you can mitigate the problem by staying with syncthingtray as long as Manjaro is still only providing KDE 5. To still build KDE integrations as part of syncthingtray you need to add the following to /etc/makepkg.conf:
SYNCTHING_TRAY_ENABLE_KIO_PLUGIN=1
SYNCTHING_TRAY_ENABLE_PLASMOID=1
(But the DNS-related errors are of course something you’ll have to figure out regardless of this explanation.)
1 Like
Thx, it started working (resolving) about an hour later but i can not install syncthingtray-qt6 , i have tried and tried but i just get a lof of dependency errors and then after about half an hour of shell text going by it just fails.
I can show the last part as a screen shot (sorry but it was such a long installation attempt each time (and i tried many times) that i just used screen shots)
It has maybe 20-30 “ERROR: Could not resolve all dependencies.” with the error in the screen shot at the end.
I have given up, From what you say it sounds like im not even supposed to be trying unless i really know what im doing (and i dont ^^).
I shall just live with the stand-alone GUI (if i havent really messed up my system, lol).
Thx for the support though.
Like I said before, you need to keep using syncthingtray for the time being (in the way I described in my last reply).
I understood, i shall leave it for tonight though. Its been a long day trying to figure this thing alone. I shall start again in the morning with your settings in the makepkg.
Have a good evening
Ok i grabbed a little time this afternoon and used your suggestion to still use kde5 by altering the makepkg.conf
It worked fine, thank you
1 Like