rename: app id network.ur.urnetwork -> com.bringyour.network

APPIMAGE.md

@@ -738,11 +738,11 @@ bundling format inside a `.deb` — legitimate, but then use `/opt` + `$ORIGIN`
 - **apt gets strict in 26.04, not 24.04.** apt 3.2 uses Sequoia; `apt-key` is gone;
   `Signed-By` must point at a dearmored keyring in `/usr/share/keyrings`, never
   `/etc/apt/trusted.gpg.d` (which would trust our key for *all* repositories).
-- **Desktop-file naming**: `main.cpp:67` uses app id `network.ur.urnetwork` but the
+- **Desktop-file naming**: `main.cpp:67` uses app id `com.bringyour.network` but the
   desktop file is `urnetwork.desktop`. Nothing is broken today
   (`StartupWMClass` covers window association), but D-Bus activation — the clean way to
   deliver a `urnetwork://` URI to a running instance — requires the names to match.
-  Rename to `network.ur.urnetwork.desktop`.
+  Rename to `com.bringyour.network.desktop`.
 
 ### 10d. The recommended alternative, if the direction changes
 
@@ -903,7 +903,7 @@ working with no error anywhere — a changed type is a decode error, and a chang
       in from `postinst` (IVPN's latent bug). **`install.sh` must run
       `update-desktop-database` and `gtk-update-icon-cache` itself** — see the §5
       callout for why this one silently passes testing and reaches users broken.
-- [ ] Rename the desktop file to `network.ur.urnetwork.desktop` to match
+- [ ] Rename the desktop file to `com.bringyour.network.desktop` to match
       `main.cpp:67`'s app id. Harmless today, but D-Bus activation — the clean way to
       hand a `urnetwork://` URI to a running instance — requires the names to match.
 - [ ] Autostart via a root-owned **inert template** (`/etc/urnetwork/autostart/`) that

MIGRATION.md

@@ -37,12 +37,12 @@ a known follow-up, do not silently pretend loopback is private.
 | `/usr/lib/urnetwork/libURnetworkSdk.so` | daemon pkg | rpath `$ORIGIN` |
 | `/usr/bin/urnetwork` | daemon pkg | **launcher script**, the stable `Exec=` target |
 | `/lib/systemd/system/urnetworkd.service` | daemon pkg | `/lib`, in every release's load path |
-| `/usr/share/applications/network.ur.urnetwork.desktop` | daemon pkg | filename **must** match `main.cpp`'s app id |
-| `/usr/share/icons/hicolor/{48x48,256x256}/apps/urnetwork.png` | daemon pkg | |
+| `/usr/share/applications/com.bringyour.network.desktop` | daemon pkg | filename **must** match `main.cpp`'s app id |
+| `/usr/share/icons/hicolor/{48x48,256x256}/apps/com.bringyour.network.png` | daemon pkg | |
 | `/usr/share/urnetwork/world-110m.json` | daemon pkg | globe land outlines |
 | `/usr/share/urnetwork/icons/urnetwork-tray-*.png` | daemon pkg | tray art |
 | `/usr/share/locale/<l>/LC_MESSAGES/urnetwork.mo` | daemon pkg | gettext catalogs |
-| `/etc/urnetwork/autostart/network.ur.urnetwork.desktop` | daemon pkg | **inert template**, GUI symlinks it |
+| `/etc/urnetwork/autostart/com.bringyour.network.desktop` | daemon pkg | **inert template**, GUI symlinks it |
 | `/etc/NetworkManager/conf.d/95-urnetwork.conf` | daemon pkg | `unmanaged-devices=interface-name:urnet0` |
 | `/etc/udev/rules.d/85-urnetwork-unmanaged.rules` | daemon pkg | `ENV{NM_UNMANAGED}="1"` |
 | `~/.local/lib/urnetwork/URnetwork.AppImage` | **user** | never packaged; must be user-writable |

PLAN.md

@@ -302,7 +302,7 @@ than being the one platform that differs.
   refreshed by **dpkg triggers**, no dependency or maintainer script needed; §9.7.1
   covers `x-scheme-handler/urnetwork`. ⚠️ Triggers fire only for files **dpkg**
   installs, so never symlink one in from `postinst` (IVPN's latent bug). Residual:
-  `main.cpp:67`'s app id `network.ur.urnetwork` does not match
+  `main.cpp:67`'s app id `com.bringyour.network` does not match
   `urnetwork.desktop`; harmless today, but D-Bus activation requires them to match.
 - **R8 — GeoClue ≥ 2.7.0 is required for the location override** [confirmed]:
   Ubuntu 22.04 (2.5.7) and Debian 12 (2.6.0) can **never** support it. Those users

app/meson.build

@@ -305,30 +305,30 @@ endif
 # host_integration=false (Flatpak) drops it with the rest: the GUI never calls
 # polkit — the daemon does, against a subject the GUI cannot influence.
 if host_integration
-install_data('..' / 'packaging' / 'polkit' / 'network.ur.urnetwork.policy',
+install_data('..' / 'packaging' / 'polkit' / 'com.bringyour.network.policy',
              install_dir : get_option('datadir') / 'polkit-1' / 'actions')
 endif
 
-# desktop file: the filename MUST match main.cpp's app id network.ur.urnetwork
+# desktop file: the filename MUST match main.cpp's app id com.bringyour.network
 # (D-Bus activation requires it; APPIMAGE.md §11d)
-install_data('packaging/network.ur.urnetwork.desktop',
+install_data('packaging/com.bringyour.network.desktop',
              install_dir : get_option('datadir') / 'applications')
 
 # AppStream metadata — required by Flathub, read by GNOME Software / Discover
 # for the .deb and .rpm too. The component id matches the .desktop basename.
-install_data('packaging/network.ur.urnetwork.metainfo.xml',
+install_data('packaging/com.bringyour.network.metainfo.xml',
              install_dir : get_option('datadir') / 'metainfo')
 
-# hicolor icons (Icon=urnetwork in the desktop file)
-install_data('packaging/icons/hicolor/48x48/apps/urnetwork.png',
+# hicolor icons (Icon=com.bringyour.network in the desktop file)
+install_data('packaging/icons/hicolor/48x48/apps/com.bringyour.network.png',
              install_dir : get_option('datadir') / 'icons' / 'hicolor' / '48x48' / 'apps')
-install_data('packaging/icons/hicolor/256x256/apps/urnetwork.png',
+install_data('packaging/icons/hicolor/256x256/apps/com.bringyour.network.png',
              install_dir : get_option('datadir') / 'icons' / 'hicolor' / '256x256' / 'apps')
 
 # autostart INERT TEMPLATE: root-owned under /etc/urnetwork/autostart/, where
 # no desktop reads it; the GUI symlinks it into ~/.config/autostart atomically
 if host_integration
-install_data('packaging/autostart/network.ur.urnetwork.desktop',
+install_data('packaging/autostart/com.bringyour.network.desktop',
              install_dir : '/etc/urnetwork/autostart')
 endif
 

app/packaging/autostart/network.ur.urnetwork.desktop → app/packaging/autostart/com.bringyour.network.desktop

@@ -2,7 +2,7 @@
 Type=Application
 Name=URnetwork
 Comment=URnetwork VPN
-Icon=urnetwork
+Icon=com.bringyour.network
 Exec=urnetwork
 # TryExec self-disables this entry once the daemon package (and with it the
 # launcher) is removed, so a stale symlink cannot error at every login.

app/packaging/network.ur.urnetwork.desktop → app/packaging/com.bringyour.network.desktop

@@ -2,7 +2,7 @@
 Type=Application
 Name=URnetwork
 Comment=URnetwork VPN
-Icon=urnetwork
+Icon=com.bringyour.network
 # /usr/bin/urnetwork is the launcher script the daemon package installs; it
 # finds the user's AppImage (search order in MIGRATION.md) and execs it with
 # the same arguments. Keeping Exec= on a stable, package-managed path is what
@@ -13,7 +13,7 @@ Terminal=false
 Categories=Network;Security;
 Keywords=VPN;URnetwork;proxy;privacy;
 StartupNotify=true
-StartupWMClass=network.ur.urnetwork
+StartupWMClass=com.bringyour.network
 # Register the urnetwork:// scheme so OAuth/SSO callbacks and wallet deep
 # links route back to the app. Shipped as a plain dpkg file so the
 # desktop-file-utils dpkg trigger refreshes mimeinfo.cache automatically

app/packaging/network.ur.urnetwork.metainfo.xml → app/packaging/com.bringyour.network.metainfo.xml

@@ -2,7 +2,7 @@
 <!--
   AppStream metadata. Required by Flathub, and read by GNOME Software / KDE
   Discover for every other channel too. The component id MUST equal the .desktop
-  basename and the GTK application id in src/main.cpp (network.ur.urnetwork) or
+  basename and the GTK application id in src/main.cpp (com.bringyour.network) or
   the store shows a nameless entry and D-Bus activation misses.
 
   project_license is the CODE license (MPL-2.0). The four commercial brand
@@ -13,7 +13,7 @@
   SPDX-License-Identifier: MPL-2.0
 -->
 <component type="desktop-application">
-  <id>network.ur.urnetwork</id>
+  <id>com.bringyour.network</id>
 
   <name>URnetwork</name>
   <summary>Private, decentralized VPN powered by a peer network</summary>
@@ -45,7 +45,7 @@
     </p>
   </description>
 
-  <launchable type="desktop-id">network.ur.urnetwork.desktop</launchable>
+  <launchable type="desktop-id">com.bringyour.network.desktop</launchable>
 
   <url type="homepage">https://ur.io</url>
   <url type="bugtracker">https://github.com/urnetwork/urnetwork-linux/issues</url>

app/snap/snapcraft.yaml

@@ -49,7 +49,7 @@ apps:
   urnetwork:
     command: usr/bin/urnetwork
     extensions: [gnome]     # GTK4/libadwaita runtime, themes, portals, wayland/x11
-    common-id: network.ur.urnetwork
+    common-id: com.bringyour.network
     desktop: usr/share/applications/urnetwork.desktop
     plugs:
       - network            # outbound sockets (SDK platform + provider traffic)

app/src/ControlProtocol.hpp

@@ -108,14 +108,14 @@ inline constexpr const char* kControlGroupName = "urnetwork";
 //   policy file absent   -> byte-for-byte today's behaviour: 0660
 //                           root:urnetwork and AuthorizeControlPeer.
 inline constexpr const char* kPolkitPolicyPath =
-    "/usr/share/polkit-1/actions/network.ur.urnetwork.policy";
+    "/usr/share/polkit-1/actions/com.bringyour.network.policy";
 // The immutable-host twin. ostree/bootc machines mount /usr read-only, so the
 // tarball installer maps its whole payload under /usr/local — and polkit has
 // read both directories since 124. ControlServer::PolicyPath() probes this one
 // FIRST; without it the daemon looks in the one place the file cannot be on
 // Bazzite/Silverblue/Kinoite/SteamOS and silently falls back to the group.
 inline constexpr const char* kPolkitPolicyPathLocal =
-    "/usr/local/share/polkit-1/actions/network.ur.urnetwork.policy";
+    "/usr/local/share/polkit-1/actions/com.bringyour.network.policy";
 
 // HelloReply::auth_mode — which authority this daemon actually latched at
 // start. The GUI needs it because the "add yourself to the urnetwork group,
@@ -125,16 +125,16 @@ inline constexpr const char* kAuthModePolkit = "polkit";
 inline constexpr const char* kAuthModeGroup = "group";
 
 // The four polkit action ids, namespaced to the app id. Shipped in
-// packaging/polkit/network.ur.urnetwork.policy (0644 root:root — polkit
+// packaging/polkit/com.bringyour.network.policy (0644 root:root — polkit
 // ignores group- or world-writable action files). They are checked by
 // urnetworkd, never by the GUI: the subject is built from SO_PEERCRED on the
 // connection being served, so a client can neither nominate its own subject
 // nor skip the check by not asking.
-inline constexpr const char* kActionControlTunnel = "network.ur.urnetwork.control-tunnel";
+inline constexpr const char* kActionControlTunnel = "com.bringyour.network.control-tunnel";
 inline constexpr const char* kActionManageKillSwitch =
-    "network.ur.urnetwork.manage-kill-switch";
-inline constexpr const char* kActionTakeOverTunnel = "network.ur.urnetwork.take-over-tunnel";
-inline constexpr const char* kActionReadLog = "network.ur.urnetwork.read-log";
+    "com.bringyour.network.manage-kill-switch";
+inline constexpr const char* kActionTakeOverTunnel = "com.bringyour.network.take-over-tunnel";
+inline constexpr const char* kActionReadLog = "com.bringyour.network.read-log";
 
 // The SDK's built-in default device-RPC address (sdk/device_rpc.go:109,
 // deviceRpcDefaultAddress = "127.0.0.1:12025"). Kept as a NAMED CONSTANT ONLY,

app/src/MainWindow.cpp

@@ -517,7 +517,7 @@ void MainWindow::BuildChrome() {
   if (auto logo = BrandLogoTexture()) {
     icon->set(logo);
   } else {
-    icon->set_from_icon_name("urnetwork");
+    icon->set_from_icon_name(kAppIconName);
   }
   icon->set_pixel_size(20);
   brand->append(*icon);

app/src/SecretServiceRpcSessionStore.cpp

@@ -12,7 +12,13 @@ namespace {
 
 constexpr int kSecretPayloadVersion = 1;
 constexpr size_t kMaxSecretPayloadBytes = 256 * 1024;
-constexpr const char* kApplicationAttribute = "network.ur.urnetwork";
+// The keyring attribute that scopes our secrets. Renamed with the app ID, so
+// an entry written by an older build is not found by this one and the app
+// falls back to a fresh RPC session — the same one-time cost as the Flatpak
+// data path moving. Deliberately NOT dual-read: keeping the old attribute
+// alive would leave the previous app identity holding live key material in the
+// user's keyring with nothing left to clean it up.
+constexpr const char* kApplicationAttribute = "com.bringyour.network";
 
 const SecretSchema kRpcSessionSchema = [] {
   // Zero-initialize libsecret's reserved ABI fields explicitly. A short C

app/src/UrTheme.cpp

@@ -369,7 +369,8 @@ Glib::RefPtr<Gdk::Texture> BrandLogoTexture() {
   const std::string dir = BrandIconDir();
   if (dir.empty()) return cached;
   for (const char* size : {"256x256", "48x48"}) {
-    const std::string path = dir + "/hicolor/" + size + "/apps/urnetwork.png";
+    const std::string path =
+        dir + "/hicolor/" + size + "/apps/" + kAppIconName + ".png";
     if (!g_file_test(path.c_str(), G_FILE_TEST_IS_REGULAR)) continue;
     try {
       cached = Gdk::Texture::create_from_filename(path);
@@ -378,7 +379,7 @@ Glib::RefPtr<Gdk::Texture> BrandLogoTexture() {
       g_warning("brand logo: %s failed to load: %s", path.c_str(), e.what());
     }
   }
-  g_warning("brand logo: no urnetwork.png under %s", dir.c_str());
+  g_warning("brand logo: no %s.png under %s", kAppIconName, dir.c_str());
   return cached;
 }
 

app/src/UrTheme.hpp

@@ -34,10 +34,20 @@ void LoadBrandFonts();
 // Install the brand CSS provider once per display. Safe to call repeatedly.
 void EnsureBrandCss();
 
+// The app icon's basename AND its icon-theme name: the packaging installs
+// <datadir>/icons/hicolor/<size>/apps/<kAppIconName>.png, and the .desktop's
+// Icon= key names the same string. It lives here as ONE constant because it was
+// previously spelled as a literal in two places -- the by-path load in
+// UrTheme.cpp and the by-name fallback in MainWindow.cpp -- and the rename to
+// the reverse-DNS app id caught only the packaging, so both lookups missed and
+// the title-bar logo went blank with no error. Flatpak additionally REQUIRES
+// this to equal the app id, or it exports no icon at all.
+inline constexpr const char* kAppIconName = "com.bringyour.network";
+
 // Register the app's hicolor icon directory with the default icon theme so
-// the icon NAME "urnetwork" resolves (window icon, tray, .desktop matching)
+// the icon NAME "com.bringyour.network" resolves (window icon, tray, .desktop matching)
 // even when the app runs from a build tree or a relocated AppImage. Without
-// this, set_from_icon_name("urnetwork") silently renders a BLANK image —
+// this, set_from_icon_name("com.bringyour.network") silently renders a BLANK image —
 // which is exactly how the title-bar logo came out empty. Idempotent.
 void RegisterBrandIcons();
 

app/src/main.cpp

@@ -78,7 +78,7 @@ int main(int argc, char** argv) {
   // the window with the app (and the hide-to-tray window keeps its identity).
   // HANDLES_OPEN: the single instance receives urnetwork:// deep links (wallet
   // callbacks) via signal_open — the .desktop registers x-scheme-handler/urnetwork.
-  auto app = Gtk::Application::create("network.ur.urnetwork",
+  auto app = Gtk::Application::create("com.bringyour.network",
                                       Gio::Application::Flags::HANDLES_OPEN);
 
   // Hold the application so it survives with only the tray (window hidden).
@@ -98,7 +98,7 @@ int main(int argc, char** argv) {
     // missing face fails silently to the fallback font (windows parity).
     urnw::LoadBrandFonts();
     urnw::EnsureBrandCss();
-    // the icon NAME "urnetwork" must resolve for the window icon and the
+    // the icon NAME kAppIconName must resolve for the window icon and the
     // tray, wherever the app runs from
     urnw::RegisterBrandIcons();
 

docs/TESTING-CACHYOS.md

@@ -1094,7 +1094,7 @@ cd urnetwork-linux
 ### 10.2 Run it
 
 ```bash
-flatpak run network.ur.urnetwork
+flatpak run com.bringyour.network
 ```
 
 ### 10.3 What is different from the AppImage — and what to test because of it
@@ -1121,7 +1121,7 @@ inode, and every `connect()` fails with `EACCES` — which historically got repo
 as a group-membership problem. The app now detects this and says so instead. To test it:
 
 ```bash
-flatpak run network.ur.urnetwork &          # leave it running
+flatpak run com.bringyour.network &          # leave it running
 sudo systemctl restart urnetworkd
 # now press Connect in the Flatpak GUI
 ```
@@ -1187,7 +1187,7 @@ Plus, separately:
 * **The full `--selftest-egress` output and its exit code** (§5.2). Always.
 * **The app's own log** — the `connect:` lines. From a terminal launch that is `gui.log` from
   §7.1; otherwise `journalctl --user -b | grep -E 'urnetwork|connect:'`, or for the Flatpak,
-  `flatpak run network.ur.urnetwork 2>&1 | tee flatpak-gui.log`.
+  `flatpak run com.bringyour.network 2>&1 | tee flatpak-gui.log`.
 * **The installer's full output** (§4 dry-run and §6 real run).
 
 **Use `stat -c %C`, never `ls -Z`.** On a machine with no SELinux, `ls -Z` prints `?` and
@@ -1208,7 +1208,7 @@ tunnel addresses (`169.254.x.x`) are fine and are useful to us.
 sudo systemctl stop urnetworkd
 sudo /usr/lib/urnetwork/uninstall.sh          # add --purge to also remove state + group
 rm -f ~/.local/lib/urnetwork/URnetwork.AppImage
-flatpak uninstall --user network.ur.urnetwork
+flatpak uninstall --user com.bringyour.network
 ```
 
 Then confirm the machine is back to normal:

docs/linux_agent_help.md

@@ -1803,7 +1803,7 @@ single-process model existed only under Snap and is dead). ~17.8k lines of C++ a
   `urnetwork_sdk.hpp` wrapper as Windows. Holds `urnet::DeviceRemote` + a control-socket
   client. Ships as a **user AppImage in a user-writable path** with a `/usr/bin/urnetwork`
   launcher-script indirection; never installed by a package (meson `install_rpath
-  '$ORIGIN/../lib'`). App id `network.ur.urnetwork`; GApplication HANDLES_OPEN deep links;
+  '$ORIGIN/../lib'`). App id `com.bringyour.network`; GApplication HANDLES_OPEN deep links;
   hide-to-tray; forces `ADW_COLOR_SCHEME_FORCE_DARK`; runtime-resolved `bindtextdomain`.
 - **`urnetworkd`** — root daemon, **no GTK of any kind** (glib GMainLoop + gio + json + SDK;
   `-static-libstdc++ -static-libgcc`). Holds `DeviceLocal(enable_rpc=true)`, opens
@@ -1898,8 +1898,8 @@ replacing it, keeping its version/SDK-match enforcement.
   `urnetworkd.service` (Type=notify, After/Wants `network-pre.target`,
   `RuntimeDirectory=urnetwork` 0750, `StateDirectory`/`LogsDirectory` 0700,
   `NoNewPrivileges`, `ProtectHome`, `Restart=on-failure`/`RestartSec=2`),
-  `network.ur.urnetwork.desktop` (`Exec=urnetwork %u`,
-  `MimeType=x-scheme-handler/urnetwork;`, `StartupWMClass=network.ur.urnetwork`),
+  `com.bringyour.network.desktop` (`Exec=urnetwork %u`,
+  `MimeType=x-scheme-handler/urnetwork;`, `StartupWMClass=com.bringyour.network`),
   `urnetwork-launcher` (installed `/usr/bin/urnetwork`; search order `$URNETWORK_APPIMAGE` →
   `~/.local/lib/urnetwork/URnetwork.AppImage` → `~/Applications/URnetwork*.AppImage` newest →
   `/usr/lib/urnetwork/URnetwork.AppImage` → `urnetwork-gui` on PATH; exit 127 with install
@@ -1947,7 +1947,7 @@ Files that ARE snap support (delete):
 - `linux:app/snap/snapcraft.yaml` — the whole file (114 lines). Already carries a SUPERSEDED
   banner ("NOT BUILT, NOT SHIPPED... describes the SINGLE-PROCESS architecture... Do not
   resurrect as-is"); it is also **broken** — it organizes `packaging/urnetwork.desktop`,
-  which was renamed to `network.ur.urnetwork.desktop`, and its `version: "0.0.0"` sed
+  which was renamed to `com.bringyour.network.desktop`, and its `version: "0.0.0"` sed
   stamping mechanism is gone. It was retained only because "Snap Store as secondary channel"
   was left open (`APPIMAGE.md` §8 item 5); that door is now closed.
 - `linux:app/.gitignore` lines 8–11: `*.snap`, `parts/`, `prime/`, `stage/`.
@@ -2139,7 +2139,7 @@ EOL ~yearly — plan an annual runtime bump.
 - polkit: actions as XML `.policy` in `/usr/share/polkit-1/actions/`; the daemon checks each
   privileged request via `CheckAuthorization` (CLI form `pkcheck`), passing request variables
   so admins can write rules. Proposed action split (tiering idiom is standard; names are our
-  proposal): `network.ur.urnetwork.connect`/`.disconnect` → `allow_active=yes`;
+  proposal): `com.bringyour.network.connect`/`.disconnect` → `allow_active=yes`;
   `.install-daemon`, `.set-killswitch`, `.clear-blocking` → `auth_admin_keep`. Simpler
   alternative used by Mullvad/Tailscale: socket file mode + group membership (already the
   linux: model — group `urnetwork`); reasonable default, with polkit/pkexec reserved for the