Your apps.
One runtime.

What was verified

Starts through the shared runtime; its private FFmpeg remains with the app.

Split from its bundled runtime and tested alongside the Electron 42 application set.

Application-owned boundary

• Application payload and private FFmpeg stay app-owned.
• Depends on Electron 42 rather than carrying Chromium.
• The earlier monolithic package remains the rollback path until publication.

Publication

Built, tested, and available from the signed repository.

What was verified

draw.io and LosslessCut co-install on Electron 42; CLI diagram export works.

Packaged without Electron; clean-container CLI export passed.

Application-owned boundary

• Uses the shared sandbox owned by the runtime.
• Keeps application resources separate from Electron files.
• CLI export is tested, not merely GUI startup.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh-container test opens and renders a real Markdown document on Electron 42.

Packaged without Electron; its packaged-mode adaptation preserves electron-log and its ABI 146 native modules.

Application-owned boundary

• Native modules remain in the application package.
• Dependency bounds require Electron 42.9.3.
• The test requires a rendered editor window and rejects main-process JavaScript errors.

Publication

Built, tested, and available from the signed repository.

What was verified

Fresh-container profile creation, persistence, and reopen passed.

The 3.7 prerelease package persists and reopens its SQLite profile.

Application-owned boundary

• This package follows Joplin’s 3.7 prerelease channel.
• SQLite state survives a full close and reopen.
• The app depends on Electron 42.9.3.

Publication

Built, tested, and available from the signed repository.

What was verified

Fresh-container initialization and profile reopen passed.

Initializes and reopens its profile through the shared runtime.

Application-owned boundary

• Unofficial and not affiliated with Microsoft.
• The wrapper no longer carries its own Electron copy.
• Persistent application state is exercised by the test.

Publication

Built, tested, and available from the signed repository.

What was verified

Jupyter server startup and desktop-profile persistence passed.

Runs its private Jupyter environment and persists its desktop profile.

Application-owned boundary

• The offline Python/Jupyter environment remains app-private.
• Only the generic Electron runtime is shared.
• Both server and desktop behavior are tested.

Publication

Built, tested, and available from the signed repository.

What was verified

An unprivileged user opened a model on Electron 44 in a fresh container.

Packaged as a plain app payload without Electron, Chromium, or its upstream self-updater.

Application-owned boundary

• Exact runtime bounds require Electron 44 and reject Electron 45.
• The upstream self-updater is removed in favor of package updates.
• Model opening—not just process startup—is verified.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh unprivileged profile initialized a valid SQLite database and reopened successfully on Electron 44.

The pinned development snapshot is packaged as an application-only payload with its private SQLite module and no bundled Electron or Chromium.

Application-owned boundary

• This is an immutable candidate snapshot, not a stable upstream release.
• The application retains its N-API better-sqlite3 module.
• Exact dependency bounds require Electron 44 and reject Electron 45.
• APT is the only package update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified package bounds and started the client unprivileged on Electron 44.

Built from the immutable v0.24.0 source tag without Electron, Chromium, native modules, or an active self-updater.

Application-owned boundary

• This is an unofficial client and is not endorsed by the Penpot project.
• The default hosted experience needs network access; self-hosted instances remain separately managed.
• The optional Docker-based local-instance workflow is not exercised by the headless startup test.
• APT is the only application update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified the native sidecar and launched the application unprivileged on Electron 44.

Built from an immutable source snapshot without Electron or Chromium; the optional OpenHome helper is built from checksum-pinned source.

Application-owned boundary

• This is a pinned candidate because upstream’s own version history still labels 2.7.0 TBD.
• The OpenHome sidecar passed its source-build test suite and dynamically uses Ubuntu’s libnl packages.
• Headless startup does not validate physical audio hardware, WebAssembly DSP output, or network discovery.
• APT is the only application update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container rendered a visible Element window as an unprivileged user on Electron 44.

Built from one immutable web-and-desktop monorepo snapshot as an application-only payload without Electron or Chromium.

Application-owned boundary

• This is a pinned development snapshot, not a stable upstream release.
• Optional matrix-seshat local encrypted-room indexing is intentionally omitted from this candidate.
• The test verifies startup and profile creation without requiring a Matrix account.
• The launcher disables upstream update activity; APT is the update authority.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container checked dependency bounds, sandbox mode, file ownership, and updater-feed removal, then started poi unprivileged on Electron 44 and required configuration state to be created.

Built from the checksum-pinned v12.0.1 tag archive; the production graph is pure JavaScript with no .node module, and both electron-updater feed assignments are removed.

Application-owned boundary

• This is a pinned candidate snapshot; it is not presented as a stable upstream release.
• Upstream excludes the poi icon and SVG artwork from its MIT grant; the copyright file records that restriction.
• The application uses webviews with Node integration exactly as upstream designed it.
• Game availability, authentication, and plugin installation are outside the startup test.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified dependency bounds, file ownership, both x86-64 native modules, and absence of update metadata, then started Tuta unprivileged on Electron 44 and required per-user configuration to be created.

Built from the pinned commit archive plus three independently checksummed gitlink sources, retaining the source-built SQLCipher and Rust mail-importer N-API modules and no updater metadata.

Application-owned boundary

• Upstream’s tag name says 357.260824.2 while the tagged tree says 357.260827.0; the package uses the tree’s honest version.
• The two native modules use N-API, so they stay application-private while Electron is shared.
• Login, mailbox decryption, mail import, and calendar sync are not exercised by the startup test.
• Upstream’s custom-desktop-release mode ships no update feed; APT is the only update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container checked dependency bounds and ownership exclusions, then launched the start screen unprivileged on Electron 44 and required a live renderer and a created user-data directory.

Built from the checksum-pinned 5.0.0-beta.1 development commit with a frozen pnpm lockfile; the installed payload is architecture-neutral JavaScript with no .node or private shared library.

Application-owned boundary

• This is a development snapshot of the 5.0.0-beta.1 line, not a stable upstream release.
• Both the background and Help-menu update paths are patched to no-ops and the launcher enforces the suppression flag.
• The launcher sets an APT-package marker because app.isPackaged is false under a shared runtime.
• The official Node 24 toolchain is used as a build tool only and creates no runtime dependency.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified dependency bounds, native-module presence, and updater removal, then started Nerimity unprivileged on Electron 44 and required a live Electron process and created configuration.

Repacked from the checksum-verified official v2.3.2 Debian artifact; the upstream Electron executable and every Chromium file are discarded and the packaged updater window is patched out.

Application-owned boundary

• uiohook-napi and the active-window modules use N-API, so they remain application-private.
• X11 libraries needed by the global-hook binary are explicit package dependencies.
• The Windows-only loopback audio capture addon is removed; that path is unsupported on Linux.
• The exact tag ships no LICENSE file, so the copyright record supplies the declared ISC grant and documents the gap.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified ownership boundaries, native-module presence, and disabled update polling, then started OpenComic unprivileged on Electron 44 and required configuration state to be created.

Built from the checksum-pinned commit archive with lockfile-fixed npm inputs; sharp, node-zstd, libvips, and the 7-Zip helpers are retained byte-for-byte as application files.

Application-owned boundary

• The commit is later than upstream tag v1.6.5, so the package uses a snapshot version rather than claiming a release.
• The native helpers use N-API rather than Electron’s V8 ABI; only the Linux amd64 glibc selection is retained.
• A patch disables the startup release poll and defaults release checking to false.
• Optional AI image helpers, archive, EPUB, and network-server workflows are outside the startup test.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container verified ownership and dependency bounds, then started Min unprivileged on Electron 43 and required per-user configuration with no missing-module, native-ABI, or uncaught-exception diagnostics.

Repacked from the checksum-verified official Debian artifact into a 5.6 MiB application package, against roughly 310 MiB extracted upstream; no private Electron, sandbox, crash handler, .node module, or shared object survives.

Application-owned boundary

• Min configures no self-updater and sets its crash reporter to uploadToServer: false; APT owns updates.
• The shipped payload retains 58 licence and notice files, including Mozilla-derived components.
• Web compatibility, media codecs, and password-manager integration are outside the startup test.
• The source tree publishes no npm lockfile, so the official artifact is checksum-verified rather than rebuilt.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container generated a known 2×2 PNG and opened it through LeafView as an unprivileged user on Electron 44, requiring a live renderer and rejecting updater, native-ABI, and uncaught-exception diagnostics.

Repacked from the official v4.4.2 Debian artifact at its attested SHA-256; the ASAR contains no .node addon, and app-update.yml plus the startup update check are removed.

Application-owned boundary

• Images are decoded by Chromium and Leaflet; the package ships no private decoder library.
• The desktop entry associates BMP, GIF, PNG, JPEG, WebP, SVG, and ICO and passes files through %U.
• The test covers deterministic PNG startup, not animation, colour management, or printing.
• APT is the only update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container drove the real rendered calculator through Chromium’s debugging protocol and verified sqrt(3² + 4²) = 5 on Electron 44.

Built from a checksum-pinned commit archive; the production payload carries no .node addon or shared library, and the npm Electron peer stub is removed.

Application-owned boundary

• The active repository has no tag or release, so the package pins a commit and uses a snapshot version.
• A single test-tree file is retained deliberately because production serialization code imports it.
• There is no electron-updater; the optional upstream version check only presents download information.
• Arbitrary-precision arithmetic, custom JavaScript buttons, and graphing beyond the fixed workflow are untested.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container imported an OPML subscription from a loopback-only RSS fixture, read the rendered article back, and re-exported OPML with the fixture name and URL intact on Electron 44.

Built from the checksum-pinned v1.2.2 tag archive; the webpack output contains no .node addon, shared library, Chromium resource, or updater metadata.

Application-owned boundary

• Feeds and articles are stored through Lovefield in Chromium’s IndexedDB, not a native SQLite binding.
• Test hooks bypass only the native file chooser; the real file, parser, Redux, and database paths run.
• No account is required for local feeds; Fever, Feedbin, Miniflux, and Nextcloud News integrations are optional and untested.
• The source contains no self-installing updater, so APT owns installed files.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container created a real local repository with one commit and one uncommitted line, completed the account-free welcome and identity screens, added the repository, and verified its name, changed file, and added content rendered on Electron 44.

Repacked from the shiftkey/desktop 3.4.13-linux1 Debian artifact at its published SHA-256; the bundled Electron 32 tree is discarded while Git 2.45.3, Git LFS, and Git Credential Manager 2.6.1 are retained as application tools.

Application-owned boundary

• This is the community Linux fork, not GitHub’s own Windows or macOS release, and no affiliation is claimed.
• The MIT grant excludes GitHub trademark rights, so a neutral icon replaces upstream logo artwork.
• keytar-forked, fs-admin-forked, and desktop-notifications use N-API rather than an Electron-major ABI.
• Clone, publish, pull-request, and issue workflows need a service account and are outside the account-free test.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container started Electorrent with upstream’s own in-process mock client, completed the connection form without credentials, inserted a synthetic transfer through the real preload/IPC boundary, and required exactly one matching row in the torrent table on Electron 42.

Repacked from the official v2.16.0 Debian asset at its publisher-supplied SHA-256; the private Electron and Chromium tree is discarded and the updater entry point is replaced with a local up-to-date response.

Application-owned boundary

• Electorrent is a client, not a torrent engine; it needs a separately operated qBittorrent, Transmission, Deluge, rTorrent, uTorrent, or aria2 service.
• Upstream’s Linux updater would download and launch a replacement AppImage; that path is removed.
• No tracker, swarm, external account, or remote torrent service is used by the test.
• The retained 55 MiB ASAR contains no .node addon or application-owned shared library.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container fixed the seed at 0.4242, generated a 64×64 world through the real renderer, switched draw modes, asserted a non-empty canvas, and validated the exported world object’s seed and both maps on Electron 44.

Built from a checksum-pinned commit archive with a locked three-module production graph; a patch moves mutable preferences from the read-only install tree into Electron’s per-user data directory.

Application-owned boundary

• Upstream has no stable 0.4.3 release, so the package pins the branch commit and uses a snapshot version.
• The same run proves settings land under the test user’s XDG hierarchy and not in /usr/lib.
• Both halves of the preferences patch are asserted at build time after an earlier partial application went undetected.
• There is no updater, crash reporter, account, or required service.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container performed the learner’s side of the first three challenges for real, then drove the rendered UI and required all eight verification checks to pass with no credentials and no GitHub account on Electron 44.

Built from the checksum-pinned v6.0.1 release tarball of the maintained Git-it-App continuation; the tree carries no .node addon and no updater of any kind, and the .deb rebuilds to an identical SHA-256.

Application-owned boundary

• Five of the eleven challenges are entirely local; the test asserts their verifiers contain no HTTP client or URL.
• Git is not vendored — the package depends on the distribution’s git, which the challenge verifiers shell out to.
• Two challenges depend on reporobot.jlord.us, which returned HTTP 500 on 2026-09-02; that is an upstream tutorial property.
• A packaging adaptation anchors the translation bundles to the installed tree; the test proves it by switching the UI to German.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container asserted an empty first-run server list and upstream defaults, changed four real preferences through the app’s own configuration path, verified they reached config.json on disk, restarted, and confirmed every value survived on Electron 43.

Repacked unpatched from the official v6.3.0 Debian asset at its verified SHA-256; the private Electron and Chromium tree is discarded and exactly one native object — the Node-API Koffi addon — ships.

Application-owned boundary

• Electron 44 was probed first and rejected on concrete behaviour: it removes app.isUnityRunning, which this release calls on Linux.
• Five Linux ELF objects belonging to darwin- and win32-only modules are dropped, but their JavaScript wrappers are kept because Electron serves an unpacked module’s whole directory.
• enableSentry and enableMetrics are upstream defaults and are documented rather than silently patched out; the test demonstrates the user control.
• Server connection, messaging, and notification delivery are deliberately not exercised.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container blackholed every Blockbench service host, built a two-cube project through the real toolbar actions, exported OBJ deterministically with 16 vertices, 12 faces, and 2 objects, and round-tripped the saved .bbmodel back through the app’s own parser on Electron 44.

Rebuilt from the checksum-pinned v5.1.6 source rather than upstream’s Electron-bearing artifacts, producing a 6.9 MB package with a 30 MB footprint against a 100 MB upstream .deb; the tree holds no .node addon, shared object, or WebAssembly payload.

Application-owned boundary

• The electron-updater import and update block are patched out, and the build asserts no autoUpdater reference survives.
• The optional electron-color-picker helper is guarded rather than shipped — upstream uninstalls it before its own Linux builds.
• Third-party notices are harvested mechanically from esbuild’s metafile; the build fails if fewer than 30 packages are found.
• Upstream’s plugin store and anonymised install counters remain available and are documented rather than patched out.

Publication

Built, tested, and available from the signed repository.

What was verified

A disposable QEMU/KVM virtual machine with a throwaway file-backed USB disk ran the real packaged GUI end to end: it flashed and verified through the pkexec-elevated sidecar, reported Flash Completed!, and an independent host-side SHA-256 comparison matched on two clean runs.

Repacked from the official v2.1.6 Debian artifact at its verified SHA-256; the private Electron and Chromium payload is removed while the upstream etcher-util Node 20 sidecar and two N-API renderer addons are retained unrewritten.

Application-owned boundary

• The boot disk was present but correctly marked a system drive and never selectable as a target.
• A container-only test was rejected as insufficient: the SDK write path needs a genuine block device, and Docker shares the host device namespace.
• VM testing surfaced two real packaging gaps — the polkit dependency had to become pkexec | policykit-1, and the Docker test needed librsvg2-common.
• The embedded electron-updater is inert for a Debian install; APT owns updates.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container wrote an Artist tag to a PNG with the bundled ExifTool, read it back, stripped all metadata, confirmed the tag was gone, then started ExifCleaner unprivileged on Electron 43 with no missing-module or native-ABI diagnostics.

Application-only package retaining the bundled ExifTool distribution; no private Electron executable and no app-update.yml remain, and the launcher execs the shared runtime against app.asar.

Application-owned boundary

• Metadata handling is performed by the bundled ExifTool at /usr/lib/exifcleaner/nix/bin/exiftool.
• Dependency bounds require electron-runtime-43 (>= 43.4.1) and (<< 44).
• The package depends on the distribution’s perl for ExifTool.
• APT is the only application update path.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container queried Chromium’s debugging target to prove the bundled first-run organization picker loaded, verified the writable profile hierarchy and canonical icon, and confirmed continued process health on Electron 42.

Repacked from the official v5.12.4 Debian asset at its matching GitHub digest; only app.asar, desktop integration, and the upstream icon are retained, and the electron-builder app-update.yml is excluded.

Application-owned boundary

• The archive carries no unpacked native Node addon.
• The account-free boundary is the local organization picker; chat requires a Zulip server account.
• Upstream initializes Sentry error reporting, so this package does not claim to be telemetry-free.
• Upstream’s first-run logger emits harmless rejected-read diagnostics while creating absent log files; the test records rather than hides them.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container followed the application’s resolved FFmpeg symlinks to create a one-second video, copy its video stream, transcode PCM audio to FLAC, preserve deterministic metadata, inspect both codecs, and compare a frame-level digest on Electron 42.

Extracted from the checksum-pinned v2.1.1 AppImage; the 68 MiB FFmpeg and 79 MiB FFprobe payloads are replaced with symlinks to Ubuntu’s ffmpeg package, leaving no ELF executable or shared library in the application tree.

Application-owned boundary

• The package preserves upstream’s installer-module path contract while owning no duplicate codec binaries.
• There is no electron-updater; a renderer component may show a link-only availability dialog.
• Aptabase telemetry is initialized by upstream, so this package is not presented as telemetry-free.
• Dependency bounds require electron-runtime-42 (>= 42.9.3) and (<< 43).

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container completed first-run setup, created a project through the application’s own dialog, delivered a task into it over the superproductivity:// protocol handler from a second launch, found both in the profile’s IndexedDB, restarted, and confirmed both survived on Electron 43.

Repacked from the checksum-pinned official v18.21.2 Debian asset; the private Electron and Chromium tree and the electron-builder updater descriptor are dropped, and the Wayland idle helper is rebuilt from the Rust sources upstream ships in the same archive rather than vendored as a prebuilt binary.

Application-owned boundary

• No native addon ships: the archive has no app.asar.unpacked tree, and the build asserts it.
• electron-updater is absent and upstream’s autoUpdater block is commented out; APT owns updates.
• No telemetry or crash reporting is present; every outbound host is an opt-in integration.
• libsecret-1-0 is a Recommends rather than a Depends because the app never calls safeStorage or keytar.
• Electron 43 was chosen on the declaration alone; nothing is ABI-bound, so 44 was not needed to test.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container opened a fixture Markdown workspace, loaded the bundled dictionary and spell-checked through the Node-API Nodehun addon, exported the document to HTML through Ubuntu’s pandoc, restarted, and confirmed the update check stayed disabled on Electron 43.

Repacked from the checksum-pinned official v4.7.0 Debian asset; the 156 MiB bundled Pandoc is replaced by a symlink to Ubuntu’s pandoc package, and the ASAR is rebuilt with five count-asserted edits that remove the hourly release poller, the developer-extension download a shared runtime would trigger, and Pandoc resolution from the runtime’s resource root.

Application-owned boundary

• The only native code is the Nodehun spell-check addon, which is Node-API and was proven to load on both Electron 43 and 44.
• Install size falls from 545 MiB to 73 MiB and the download from 128 MiB to 13 MiB.
• quarto is dropped because Ubuntu does not ship it; TeX packages are Suggests for the PDF profiles only.
• No telemetry or crash reporting is present; LanguageTool defaults off and link previews fetch only hovered links.
• Electron 43 is required by upstream’s ^43.1.0 declaration.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container completed an account-free first run, confirmed the native mail-sync engine created and migrated its SQLite database, exercised safeStorage through a live GNOME Keyring, changed three preferences and verified them on disk, then restarted and confirmed the schema and preferences survived.

Repacked from the checksum-pinned official v1.23.0 Debian asset; upstream builds against Electron 41.7.2, for which no shared runtime line exists, so the only native addon (better-sqlite3) is rebuilt at 12.11.1 against Electron 44 headers and the package depends on electron-runtime-44 instead of a matching-major line.

Application-owned boundary

• Upstream declares Electron 41.7.2; no shared runtime matches it, so this targets electron-runtime-44 after Electron 43 was probed and behaved identically.
• The bundled cyrus-sasl objects are replaced with Ubuntu's libsasl2-modules.
• The release poller against updates.getmailspring.com is removed so APT owns updates.
• libsecret-1-0 is a hard dependency here, unlike some other ports: the app quits with a fatal dialog if credential encryption is unavailable.
• Sentry error reporting and Chromium crash reporting remain enabled by default; neither calls out at startup.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container completed account-free first-run configuration, changed real settings, and confirmed they survived a restart, without Wine installed or a store account.

Repacked from the checksum-pinned official v2.22.1 Debian asset; contains no native Node addon. All four vendored Linux store clients are verified byte-for-byte against the exact release asset their own upstream projects publish; the one binary that failed that check, an unprovenanced prebuilt helper, is rebuilt from its pinned source instead.

Application-owned boundary

• legendary, gogdl, nile, comet, and two Wine-prefix shims are each verified byte-for-byte against their own project's tagged release.
• vulkan-helper, a prebuilt blob committed to Heroic's repo with no release behind it, is rebuilt from its pinned MIT source instead of redistributed.
• app.isPackaged is false under a shared runtime, which broke resource-path resolution and navigation guards; both are patched.
• Wine is a Recommends, not a Depends: the launcher UI is fully usable without it, and it is only needed to run a Windows title.
• Electron 44 was probed and works, but the package stays on electron-runtime-43 to match upstream's declared ^43.1.1.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container opened a fixture M3U playlist from the command line, listed its channels, and restored them from the local SQLite database after a restart, with no network reachable.

Repacked from the checksum-pinned official v0.23.0 Debian asset; the only native code is the Node-API better-sqlite3 addon. The optional embedded-MPV frame-copy engine is dropped entirely because upstream gates it on app.isPackaged, which no shared-runtime launch can satisfy.

Application-owned boundary

• The embedded-MPV engine is omitted rather than shipped inert, removing libmpv2, libgbm1, and libegl1 from the dependency set.
• electron-updater's two release-comparison paths are removed so APT owns updates.
• app.isPackaged-derived worker and remote-control paths are redirected into the installed tree.
• Upstream asserts its name and icon artwork as unregistered trademarks; this package redistributes the official build nominatively, not as a fork.
• Electron 44 was probed and did not fail, but the package stays on electron-runtime-43 to match upstream's declared ^43.3.0.

Publication

Built, tested, and available from the signed repository.

What was verified

A fresh Ubuntu 26.04 container registered the launcher, opened it through its own toggle entry point, answered a calculator query through the built-in extension, and confirmed the enabled extension and settings survived a restart.

Repacked from the checksum-pinned official v9.29.0 Debian asset; upstream builds against Electron 41, so the only ABI-bound native addon (better-sqlite3) is rebuilt at 12.11.1 against Electron 44 headers, since no matching runtime line exists for the declared major.

Application-owned boundary

• The shipped better-sqlite3 binding is V8-ABI at NODE_MODULE_VERSION 145 (Electron 41) and does not load under 42, 43, or 44; it is rebuilt at 12.11.1, inside upstream's own declared range, against Electron 44 headers.
• sharp is Node-API and repacks untouched, but its bundled libvips statically links all 28 of its image and text codec libraries and carries a soname Ubuntu does not ship, so no substitution is possible.
• Upstream's release tag declares Electron ^41.0.3, not the newer range visible on its main branch; no matching runtime line exists, so the runtime choice was free and lands on the newest available.
• No updater and no telemetry; only application search and Ueli's own commands run by default, with the calculator, web-search, terminal, and workflow extensions opt-in.

Publication

Built, tested, and available from the signed repository.