Tidy the Linux packages and tray after testing on Debian 13

Verified on Debian 13 arm64 with Cinnamon: the .deb installs, the tray
registers and renders its menu, and pull and push sync end to end.

- Packages ship 0755 directories whatever the builder's umask, name the
  native changelog changelog.gz, and override lintian for the static
  binary and the 0640 server config; prerm uses deb-systemd-invoke.
- The tray item is titled KeepOrg for StatusNotifierItem hosts.
- Event log lines omit empty fields.
- -reset-admin help no longer says to stop the server.

Client 0.6.1 (Linux, macOS, Windows, BSD), server 0.12.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/keeporg/tray.go

@@ -62,6 +62,11 @@ func (t *trayApp) onReady() {
 		systray.SetIcon(icon.PNG(icon.Tray(64, icon.Brand)))
 	}
 	systray.SetTooltip("KeepOrg " + Version)
+	if runtime.GOOS != "darwin" {
+		// The item's name in a StatusNotifierItem host's list of tray
+		// icons; on macOS the title is text beside the icon instead.
+		systray.SetTitle("KeepOrg")
+	}
 
 	t.header = systray.AddMenuItem("Starting…", "")
 	t.header.Disable()

cmd/keeporgd/main.go

@@ -111,7 +111,7 @@ func main() {
 			"write a commented example config to this path and exit")
 		resetAdmin = flag.Bool("reset-admin", false,
 			"reset the built-in administrator's password, print a new one and "+
-				"exit; stop the server first")
+				"exit; a running server picks it up within seconds")
 	)
 	flag.Parse()
 

internal/client/mirror.go

@@ -152,7 +152,14 @@ func (m *Mirror) listen(ctx context.Context, wake func()) {
 	for ctx.Err() == nil {
 		err := m.api.Events(ctx, func(ev Event) {
 			backoff = time.Second
-			m.log.Printf("event %s %s v%d by %s", ev.Type, ev.Name, ev.Version, ev.By)
+			line := "event " + ev.Type
+			if ev.Name != "" {
+				line += fmt.Sprintf(" %s v%d", ev.Name, ev.Version)
+			}
+			if ev.By != "" {
+				line += " by " + ev.By
+			}
+			m.log.Print(line)
 			wake()
 		})
 		if ctx.Err() != nil {

packaging/deb/client/changelog

@@ -1,3 +1,11 @@
+keeporg (0.6.1) unstable; urgency=medium
+
+  * Name the tray item KeepOrg for StatusNotifierItem hosts, log events 
+    without empty fields, and package with 0755 directories, a native 
+    changelog name and a lintian override for the static binary.
+
+ -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Tue, 03 Nov 2026 14:41:03 +0100
+
 keeporg (0.6.0) unstable; urgency=medium
 
   * Security hardening: the tray and CLI open only the server's own 

packaging/deb/server/changelog

@@ -1,3 +1,11 @@
+keeporgd (0.12.1) unstable; urgency=medium
+
+  * Package with 0755 directories, a native changelog name and a lintian 
+    override for the static binary; -reset-admin help no longer says to 
+    stop the server.
+
+ -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Tue, 03 Nov 2026 14:41:03 +0100
+
 keeporgd (0.12.0) unstable; urgency=medium
 
   * Security hardening after an audit. Single sign-on: a device is approved 

scripts/build-deb.sh

@@ -48,8 +48,24 @@ mkdir -p "$stage/DEBIAN" "$stage/usr/share/doc/$pkg"
 sed -e "s/@VERSION@/$version/" -e "s/@ARCH@/$arch/" \
 	"$root/packaging/deb/$kind/control.in" > "$stage/DEBIAN/control"
 install -m 0644 "$root/packaging/deb/copyright" "$stage/usr/share/doc/$pkg/copyright"
-gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/changelog.Debian.gz"
+# A version without a Debian revision is a native package, whose changelog
-chmod 0644 "$stage/usr/share/doc/$pkg/changelog.Debian.gz"
+# Debian policy names changelog.gz rather than changelog.Debian.gz.
+case $version in
+*-*) changelog=changelog.Debian.gz ;;
+*) changelog=changelog.gz ;;
+esac
+gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/$changelog"
+chmod 0644 "$stage/usr/share/doc/$pkg/$changelog"
+# Go links statically on purpose: one binary, no libc dependency.
+mkdir -p "$stage/usr/share/lintian/overrides"
+printf '%s: statically-linked-binary [usr/bin/%s]\n' "$pkg" "$binary" \
+	> "$stage/usr/share/lintian/overrides/$pkg"
+if [ "$kind" = server ]; then
+	# The config may carry the OIDC client secret, so it is not world-readable.
+	echo "$pkg: non-standard-file-perm 0640 != 0644 [etc/keeporg/server.json]" \
+		>> "$stage/usr/share/lintian/overrides/$pkg"
+fi
+chmod 0644 "$stage/usr/share/lintian/overrides/$pkg"
 
 if [ "$kind" = server ]; then
 	cat > "$stage/DEBIAN/conffiles" <<'CONF'
@@ -90,13 +106,17 @@ POST
 #!/bin/sh
 set -e
 if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
-	systemctl stop keeporgd || true
+	deb-systemd-invoke stop keeporgd.service || true
 fi
 exit 0
 PRERM
 	chmod 0755 "$stage/DEBIAN/postinst" "$stage/DEBIAN/prerm"
 fi
 
+# Whatever the builder's umask, packaged directories are 0755; postinst
+# tightens /etc/keeporg itself.
+find "$stage" -type d -exec chmod 0755 {} +
+
 mkdir -p "$(dirname "$out")"
 fakeroot dpkg-deb --root-owner-group --build "$stage" "$out" >/dev/null
 printf 'built %s (%s %s %s)\n' "$out" "$binary" "$version" "$arch"

versions.mk

@@ -1,10 +1,10 @@
 # Single source of truth for all platform versions (semver).
 # Bump with: make bump PLATFORM=<server|linux|macos|windows|bsd|android> PART=<major|minor|patch>
-VERSION_SERVER   := 0.12.0
+VERSION_SERVER   := 0.12.1
-VERSION_LINUX    := 0.6.0
+VERSION_LINUX    := 0.6.1
-VERSION_MACOS    := 0.6.0
+VERSION_MACOS    := 0.6.1
-VERSION_WINDOWS  := 0.6.0
+VERSION_WINDOWS  := 0.6.1
-VERSION_BSD      := 0.6.0
+VERSION_BSD      := 0.6.1
 VERSION_ANDROID  := 0.4.0
 # Monotonic Android versionCode, never decreases.
 ANDROID_VERSION_CODE := 4