Bug bash fixes: special-file reads, per-client lockout, prefs validation, security headers, kernel-thread guard, login feedback, error text; plus journal-quiet sudoers + journal groups, upload overwrite guard, machines pattern, dnf freshness, cron/services speed, clean version

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/updates/updates.go

@@ -12,6 +12,7 @@ import (
 	"errors"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -83,6 +84,52 @@ func out(ctx context.Context, args ...string) (string, error) {
 	return string(b), nil
 }
 
+// newestMtime: the newest mtime among the paths matching any of the globs.
+func newestMtime(globs ...string) int64 {
+	var best int64
+	for _, g := range globs {
+		matches, _ := filepath.Glob(g)
+		for _, m := range matches {
+			if t := mtimeMs(m); t > best {
+				best = t
+			}
+		}
+	}
+	return best
+}
+
+// dnfLastUpgrade: newest transaction in `dnf history` whose action includes an upgrade,
+// else the newest transaction of any kind.
+func dnfLastUpgrade(ctx context.Context) int64 {
+	text, err := out(ctx, "dnf", "history", "list")
+	if err != nil {
+		return 0
+	}
+	re := regexp.MustCompile(`(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\s+(\S+)`)
+	var newest, upgrade int64
+	for _, line := range strings.Split(text, "\n") {
+		m := re.FindStringSubmatch(line)
+		if m == nil {
+			continue
+		}
+		t, err := time.ParseInLocation("2006-01-02 15:04:05", m[1], time.Local)
+		if err != nil {
+			continue
+		}
+		ms := t.UnixMilli()
+		if ms > newest {
+			newest = ms
+		}
+		if strings.Contains(m[2], "U") && ms > upgrade {
+			upgrade = ms
+		}
+	}
+	if upgrade > 0 {
+		return upgrade
+	}
+	return newest
+}
+
 func mtimeMs(p string) int64 {
 	st, err := os.Stat(p)
 	if err != nil {
@@ -113,7 +160,8 @@ func (m *Manager) Status(ctx context.Context) Status {
 		s.AutoUpgrades = aptAutoUpgrades(ctx)
 	case "dnf":
 		s.Packages = dnfUpgradable(ctx)
-		s.LastRefresh = mtimeMs("/var/cache/dnf")
+		s.LastRefresh = newestMtime("/var/cache/libdnf5/*/repodata", "/var/cache/dnf/*/repodata", "/var/cache/libdnf5", "/var/cache/dnf")
+		s.LastUpgrade = dnfLastUpgrade(ctx)
 	case "pacman":
 		s.Packages = pacmanUpgradable(ctx)
 		s.LastRefresh = mtimeMs("/var/lib/pacman/sync")