Merge pull request #625 from KernelGhost/main

Specify securing configuration file with '600' permissions in README

.github/workflows/update-nix.yaml

@@ -1,40 +0,0 @@
-name: "Update Flake Packages"
-
-permissions:
-  contents: write
-  pull-requests: write
-
-on:
-  pull_request:
-    branches: [main]
-    types: [labeled]
-  schedule:
-    - cron: "0 10 * * 0" # https://crontab.guru/#0_10_*_*_0
-
-jobs:
-  build:
-    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'rebuild nix')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@main
-        with:
-          trust-runner-user: true
-
-      - name: Set up cache
-        uses: cachix/cachix-action@v15
-        with:
-          name: winapps
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Update flake packages
-        uses: winapps-org/nix-update-action@v1.4.0
-        with:
-          extra-args: --version=branch
-          skip-pr: "${{ github.event_name == 'pull_request' }}"
-
-      - name: Build packages
-        run: nix build .#winapps .#winapps-launcher

.github/workflows/update-submodule.yaml

@@ -1,37 +0,0 @@
-name: Update submodules
-on:
-  repository_dispatch:
-    types: update
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Update module
-        run: |
-          pushd WinApps-Launcher
-            branch=$(git rev-parse --abbrev-ref origin/HEAD | sed "s|origin/||")
-            git config remote.origin.fetch "+refs/heads/$branch:refs/remotes/origin/$branch"
-            git fetch --depth=1 origin "refs/heads/$branch"
-          popd
-
-          git submodule update --init --remote WinApps-Launcher
-
-      - name: Commit and push
-        uses: EndBug/add-and-commit@v9
-        with:
-          add: WinApps-Launcher
-          default_author: github_actions
-          message: "Update submodules"
-          push: false
-
-      - name: Create PR
-        uses: peter-evans/create-pull-request@v7
-        with:
-          branch: chore/update_submodules
-          delete-branch: true
-          title: "Update submodules"

.gitignore

@@ -0,0 +1,5 @@
+/.idea
+/.vscode
+/result
+.DS_Store
+**/.DS_Store

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "WinApps-Launcher"]
-	path = WinApps-Launcher
-	url = https://github.com/winapps-org/WinApps-Launcher.git

LICENSE.md

@@ -8,7 +8,7 @@ Due to lack of a license, it is All Rights Reserved by the original author.
 We have tried contacting Fmstrat about this, but they abandoned the project and did not reply nor apply an open-source license to the project.
 However, almost all parts of the codebase have been rewritten and all new contributions require a Contributor License Agreement ([for individuals](https://gist.github.com/oskardotglobal/35f0a72eb45fcc7087e535561383dbc5), [for legal entities](https://gist.github.com/oskardotglobal/75a8cc056e56a439fa6a1551129ae47f)) to be signed. Therefore, the below license is applied to all new contributions made to the project.
 
-Refer to a specific file for it's respective license.
+Refer to a specific file for its respective license.
 
 # GNU AFFERO GENERAL PUBLIC LICENSE
 

README.md

@@ -17,7 +17,7 @@ WinApps works by:
 - The GNU/Linux `/home` directory is accessible within Windows via the `\\tsclient\home` mount.
 - Integration with `Nautilus`, allowing you to right-click files to open them with specific Windows applications based on the file MIME type.
 - The [official taskbar widget](https://github.com/winapps-org/WinApps-Launcher) enables seamless administration of the Windows subsystem and offers an easy way to launch Windows applications.
-- Microsoft Office links (e.g. ms-word://) from the host system are automatically opened in the Windows subsystem. (Note: You may need to use an [User Agent switcher](https://github.com/ray-lothian/UserAgent-Switcher/) Browser Extension and set the User-Agent to Windows, as as the Office webapps typically hide the "Open in Desktop App" option for Linux users.)
+- Microsoft Office links (e.g. ms-word://) from the host system are automatically opened in the Windows subsystem. (Note: You may need to use a [User Agent Switcher](https://github.com/ray-lothian/UserAgent-Switcher/) browser extension and set the User-Agent to Windows, as the Office webapps typically hide the "Open in Desktop App" option for Linux users.)
 
 ## Supported Applications
 **WinApps supports <u>*ALL*</u> Windows applications.**
@@ -398,7 +398,7 @@ RDP_SCALE="100"
 #   This improves compatibility with most desktop environments (DEs).
 # ATTENTION: The Filesystem Hierarchy Standard (FHS) recommends /media instead. Verify your system's configuration.
 # - To manually mount devices, you may optionally use /mnt.
-# REFERRENCE: https://wiki.archlinux.org/title/Udisks#Mount_to_/media
+# REFERENCE: https://wiki.archlinux.org/title/Udisks#Mount_to_/media
 REMOVABLE_MEDIA="/run/media"
 
 # [ADDITIONAL FREERDP FLAGS & ARGUMENTS]
@@ -469,8 +469,19 @@ RDP_TIMEOUT="30"
 # DEFAULT VALUE: '60'
 APP_SCAN_TIMEOUT="60"
 
+# WINDOWS BOOT
+# - The maximum time (in seconds) to wait for the Windows VM to boot if it is not running, before attempting to launch an application.
+# DEFAULT VALUE: '120'
+BOOT_TIMEOUT="120"
 ```
 
+> [!IMPORTANT]
+> To safeguard your Windows password, ensure `~/.config/winapps/winapps.conf` is accessible only by your user account.
+> ```bash
+> chown $(whoami):$(whoami) ~/.config/winapps/winapps.conf
+> chmod 600 ~/.config/winapps/winapps.conf
+> ```
+
 > [!IMPORTANT]
 > `RDP_USER` and `RDP_PASS` must correspond to a complete Windows user account and password, such as those created during Windows setup or for a domain user. User/PIN combinations are not valid for RDP access.
 
@@ -484,6 +495,7 @@ APP_SCAN_TIMEOUT="60"
 - On high-resolution (UHD) displays, you can set `RDP_SCALE` to the scale you would like to use (100, 140 or 180).
 - To add additional flags to the FreeRDP call (e.g. `/prevent-session-lock 120`), uncomment and use the `RDP_FLAGS` configuration option.
 - For multi-monitor setups, you can try adding `/multimon` to `RDP_FLAGS`. A FreeRDP bug may result in a black screen however, in which case you should revert this change.
+- To enable non-English input and seamless language switching, you can try adding `/kbd:unicode` to `RDP_FLAGS`. This ensures client inputs are sent as Unicode sequences.
 - If you enable `DEBUG`, a log will be created on each application start in `~/.local/share/winapps/winapps.log`.
 - If using a system on which the FreeRDP command is not `xfreerdp` or `xfreerdp3`, the correct command can be specified using `FREERDP_COMMAND`.
 
@@ -570,6 +582,11 @@ The installer can be run multiple times. To update your installation of WinApps:
 2. Pull the latest changes from the WinApps GitHub repository.
 3. Re-install WinApps using the WinApps installer by running `winapps-setup`.
 
+## WinApps Launcher (Optional)
+The [WinApps Launcher](https://github.com/winapps-org/winapps-launcher) provides a simple system tray menu that makes it easy to launch your installed Windows applications, open a full desktop RDP session, and control your Windows VM or container. You can start, stop, pause, reboot or hibernate Windows, as well as access your installed applications from a convenient list. This lightweight, optional tool helps streamline your overall WinApps experience.
+
+<img src="./demo/launcher.gif" width=1000 alt="WinApps Launcher Animation.">
+
 ## Installation using Nix
 
 First, follow Step 1 of the normal installation guide to create your VM.
@@ -584,10 +601,6 @@ First, make sure Flakes and the `nix` command are enabled.
 In your `~/.config/nix/nix.conf`:
 ```
 experimental-features = nix-command flakes
-# specify to use binary cache (optional)
-extra-substituters = https://winapps.cachix.org/
-extra-trusted-public-keys = winapps.cachix.org-1:HI82jWrXZsQRar/PChgIx1unmuEsiQMQq+zt05CD36g=
-extra-trusted-users = <your-username> # replace with your username
 ```
 
 ```bash
@@ -634,12 +647,6 @@ nix profile install github:winapps-org/winapps#winapps-launcher # optional
               ...
             }:
             {
-              # set up binary cache (optional)
-              nix.settings = {
-                substituters = [ "https://winapps.cachix.org/" ];
-                trusted-public-keys = [ "winapps.cachix.org-1:HI82jWrXZsQRar/PChgIx1unmuEsiQMQq+zt05CD36g=" ];
-              };
-
               environment.systemPackages = [
                 winapps.packages."${system}".winapps
                 winapps.packages."${system}".winapps-launcher # optional

apps/emclient/info

@@ -0,0 +1,17 @@
+# GNOME shortcut name
+NAME="eM Client"
+
+# Used for descriptions and window class
+FULL_NAME="eM Client"
+
+# The executable inside windows
+WIN_EXECUTABLE="C:\Program Files (x86)\eM Client\mailclient.exe"
+
+# GNOME categories
+CATEGORIES="WinApps;Network;Office;"
+
+# GNOME mimetypes
+MIME_TYPES=""
+
+# System Icon
+ICON="eM Client"

apps/paint.net/info

@@ -0,0 +1,17 @@
+# GNOME shortcut name
+NAME="Paint.NET"
+
+# Used for descriptions and window class
+FULL_NAME="Paint.NET"
+
+# The executable inside windows
+WIN_EXECUTABLE="C:\Program Files\Paint.NET\paintdotnet.exe"
+
+# GNOME categories
+CATEGORIES="WinApps;Graphic;"
+
+# GNOME mimetypes
+MIME_TYPES=""
+
+# System Icon
+ICON="Paint.Net"

bin/winapps

@@ -50,9 +50,11 @@ RDP_SCALE=100
 AUTOPAUSE="off"
 AUTOPAUSE_TIME="300"
 DEBUG="true"
+BOOT_TIMEOUT=120
 
 # OTHER
 FREERDP_PID=-1
+NEEDED_BOOT=false
 
 ### TRAPS ###
 # Catch SIGINT (CTRL+C) to call 'waCleanUp'.
@@ -105,15 +107,15 @@ Please run:
         notify-send --expire-time=8000 --icon="dialog-error" --app-name="WinApps" --urgency="low" "WinApps" "Windows failed to resume."
         ;;
     "$EC_FAIL_DESTROY")
-        dprint "ERROR: WINDOWS FAILED TO IMMEDIATELY UNGRACEFULLY SHUT DOWN WINDOWS. EXITING."
-        notify-send --expire-time=8000 --icon="dialog-error" --app-name="WinApps" --urgency="low" "WinApps" "Failed to ungracefully shut down Windows."
+        dprint "ERROR: FAILED TO FORCE STOP WINDOWS. EXITING."
+        notify-send --expire-time=8000 --icon="dialog-error" --app-name="WinApps" --urgency="low" "WinApps" "Failed to forcibly stop Windows."
         ;;
     "$EC_SD_TIMEOUT")
         dprint "ERROR: WINDOWS TOOK TOO LONG TO SHUT DOWN. EXITING."
         notify-send --expire-time=8000 --icon="dialog-error" --app-name="WinApps" --urgency="low" "WinApps" "Windows took too long to shut down."
         ;;
     "$EC_DIE_TIMEOUT")
-        dprint "ERROR: WINDOWS TOOK TOO LONG TO SHUT DOWN. EXITING."
+        dprint "ERROR: WINDOWS TOOK TOO LONG TO DIE. EXITING."
         notify-send --expire-time=8000 --icon="dialog-error" --app-name="WinApps" --urgency="low" "WinApps" "Windows took too long to die."
         ;;
     "$EC_RESTART_TIMEOUT")
@@ -156,7 +158,7 @@ function dprint() {
     [ "$DEBUG" = "true" ] && echo "[$(date)-$RUNID] $1" >>"$LOG_PATH"
 }
 # Name: 'waFixRemovableMedia'
-# Role: If user left REMOVABLE_MEDIA config null,fallback to /run/media for udisks defaults ,warning.
+# Role: If REMOVABLE_MEDIA is empty, default to /run/media (udisks default) and show a warning.
 function waFixRemovableMedia() {
     if [ -z "$REMOVABLE_MEDIA" ]; then
         REMOVABLE_MEDIA="/run/media"  # Default for udisks
@@ -299,9 +301,10 @@ function waGetFreeRDPCommand() {
 function waCheckGroupMembership() {
     # Identify groups the current user belongs to.
     # shellcheck disable=SC2155 # Silence warnings regarding masking return values through simultaneous declaration and assignment.
-    local USER_GROUPS=$(groups "$(whoami)")
+    local USER_GROUPS=$(id -nG "$(whoami)")
 
-    if ! (echo "$USER_GROUPS" | grep -q -E "\blibvirt\b") || ! (echo "$USER_GROUPS" | grep -q -E "\bkvm\b"); then
+    if ! echo "$USER_GROUPS" | grep -qE '\b(libvirt|libvirtd)\b' || \
+       ! echo "$USER_GROUPS" | grep -qE '\bkvm\b'; then
         waThrowExit "$EC_NOT_IN_GROUP"
     fi
 }
@@ -323,6 +326,7 @@ function waCheckVMRunning() {
         if (virsh list --state-shutoff --name | xargs | grep -wq "$VM_NAME"); then
             dprint "WINDOWS SHUT OFF. BOOTING WINDOWS."
             notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
+            NEEDED_BOOT=true
             virsh start "$VM_NAME" &>/dev/null || EXIT_STATUS=$EC_FAIL_START
             if (virsh list --state-paused --name | xargs | grep -wq "$VM_NAME"); then
                 dprint "WINDOWS PAUSED. RESUMING WINDOWS."
@@ -344,6 +348,7 @@ function waCheckVMRunning() {
                         dprint "WINDOWS SHUT OFF. BOOTING WINDOWS."
                         notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
                         virsh start "$VM_NAME" &>/dev/null || EXIT_STATUS=$EC_FAIL_START
+                        NEEDED_BOOT=true
                         break
                     fi
                     sleep $TIME_INTERVAL
@@ -357,6 +362,7 @@ function waCheckVMRunning() {
                     dprint "WINDOWS DESTROYED. BOOTING WINDOWS."
                     notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
                     virsh start "$VM_NAME" &>/dev/null || EXIT_STATUS=$EC_FAIL_START
+                    NEEDED_BOOT=true
                 fi
             elif (virsh domstate "$VM_NAME" | xargs | grep -wq "dying"); then
                 dprint "WINDOWS DYING. WAITING."
@@ -372,6 +378,7 @@ function waCheckVMRunning() {
                             dprint "WINDOWS DESTROYED. BOOTING WINDOWS."
                             notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
                             virsh start "$VM_NAME" &>/dev/null || EXIT_STATUS=$EC_FAIL_START
+                            NEEDED_BOOT=true
                         fi
                         break
                     elif (virsh list --state-shutoff --name | xargs | grep -wq "$VM_NAME"); then
@@ -379,6 +386,7 @@ function waCheckVMRunning() {
                         dprint "WINDOWS SHUT OFF. BOOTING WINDOWS."
                         notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
                         virsh start "$VM_NAME" &>/dev/null || EXIT_STATUS=$EC_FAIL_START
+                        NEEDED_BOOT=true
                         break
                     fi
                     sleep $TIME_INTERVAL
@@ -395,6 +403,45 @@ function waCheckVMRunning() {
 
     # Handle non-zero exit statuses.
     [ "$EXIT_STATUS" -ne 0 ] && waThrowExit "$EXIT_STATUS"
+
+    # Wait for VM to be fully ready
+    if [[ "$NEEDED_BOOT" == "true" ]]; then
+        dprint "WAITING FOR VM TO BE FULLY READY..."
+        notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Waiting for Windows to be ready..."
+
+        TIME_ELAPSED=0
+
+        while (( TIME_ELAPSED < BOOT_TIMEOUT )); do
+            # Check if VM is running
+            if (virsh list --state-running --name | xargs | grep -wq "$VM_NAME"); then
+                # Try to connect to RDP port to verify it's ready
+                if timeout 1 bash -c ">/dev/tcp/$RDP_IP/$RDP_PORT" 2>/dev/null; then
+                    dprint "VM IS READY"
+                    notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Windows is ready."
+                    # Add a delay after Windows is ready
+                    if [ "$NEEDED_BOOT" = "true" ]; then
+                        sleep 10
+                    fi
+                    break
+                fi
+            fi
+
+            sleep 5
+            TIME_ELAPSED=$((TIME_ELAPSED + 5))
+
+            # Show progress every 30 seconds
+            if (( TIME_ELAPSED % 30 == 0 )); then
+                notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Still waiting for Windows to be ready... ($TIME_ELAPSED seconds elapsed)"
+            fi
+        done
+
+        # If we timed out waiting for the VM
+        if (( TIME_ELAPSED >= BOOT_TIMEOUT )); then
+            dprint "TIMEOUT WAITING FOR VM TO BE READY"
+            notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Timeout waiting for Windows to be ready. Please try again."
+            waThrowExit $EC_FAIL_START
+        fi
+    fi
 }
 
 # Name: 'waCheckContainerRunning'
@@ -426,6 +473,7 @@ function waCheckContainerRunning() {
             dprint "WINDOWS CREATED. BOOTING WINDOWS."
             notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
             $COMPOSE_COMMAND --file "$COMPOSE_PATH" start &>/dev/null
+            NEEDED_BOOT=true
             ;;
         "restarting")
             dprint "WINDOWS RESTARTING. WAITING."
@@ -436,6 +484,7 @@ function waCheckContainerRunning() {
                     EXIT_STATUS=0
                     dprint "WINDOWS RESTARTED."
                     notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Restarted Windows."
+                    NEEDED_BOOT=true
                     break
                 fi
                 sleep $TIME_INTERVAL
@@ -451,11 +500,13 @@ function waCheckContainerRunning() {
             dprint "WINDOWS SHUT OFF. BOOTING WINDOWS."
             notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Booting Windows."
             $COMPOSE_COMMAND --file "$COMPOSE_PATH" start &>/dev/null
+            NEEDED_BOOT=true
             ;;
         "dead")
             dprint "WINDOWS DEAD. RECREATING WINDOWS CONTAINER."
             notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Re-creating and booting Windows."
             $COMPOSE_COMMAND --file "$COMPOSE_PATH" down &>/dev/null && $COMPOSE_COMMAND --file "$COMPOSE_PATH" up -d &>/dev/null
+            NEEDED_BOOT=true
             ;;
         "unknown")
             EXIT_STATUS=$EC_UNKNOWN
@@ -464,6 +515,45 @@ function waCheckContainerRunning() {
 
     # Handle non-zero exit statuses.
     [ "$EXIT_STATUS" -ne 0 ] && waThrowExit "$EXIT_STATUS"
+
+    # Wait for container to be fully ready
+    if [[ "$CONTAINER_STATE" == "created" || "$CONTAINER_STATE" == "exited" || "$CONTAINER_STATE" == "dead" || "$CONTAINER_STATE" == "restarting" ]]; then
+        dprint "WAITING FOR CONTAINER TO BE FULLY READY..."
+        notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Waiting for Windows to be ready..."
+
+        TIME_ELAPSED=0
+
+        while (( TIME_ELAPSED < BOOT_TIMEOUT )); do
+            # Check if container is running
+            if [[ $("$WAFLAVOR" inspect --format='{{.State.Status}}' "$CONTAINER_NAME") == "running" ]]; then
+                # Try to connect to RDP port to verify it's ready
+                if timeout 1 bash -c ">/dev/tcp/$RDP_IP/$RDP_PORT" 2>/dev/null; then
+                    dprint "CONTAINER IS READY"
+                    notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Windows is ready."
+                    # Add a delay after Windows is ready
+                    if [ "$NEEDED_BOOT" = "true" ]; then
+                        sleep 10
+                    fi
+                    break
+                fi
+            fi
+
+            sleep 5
+            TIME_ELAPSED=$((TIME_ELAPSED + 5))
+
+            # Show progress every 30 seconds
+            if (( TIME_ELAPSED % 30 == 0 )); then
+                notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Still waiting for Windows to be ready... ($TIME_ELAPSED seconds elapsed)"
+            fi
+        done
+
+        # If we timed out waiting for the container
+        if (( TIME_ELAPSED >= BOOT_TIMEOUT )); then
+            dprint "TIMEOUT WAITING FOR CONTAINER TO BE READY"
+            notify-send --expire-time=4000 --icon="dialog-info" --app-name="WinApps" --urgency="low" "WinApps" "Timeout waiting for Windows to be ready. Please try again."
+            waThrowExit $EC_FAIL_START
+        fi
+    fi
 }
 
 # Name: 'waCheckPortOpen'
@@ -588,7 +678,7 @@ function waRunCommand() {
                 +auto-reconnect \
                 /drive:media,"$REMOVABLE_MEDIA" \
                 /wm-class:"$FULL_NAME" \
-                /app:program:"$WIN_EXECUTABLE",icon:"$ICON",name:$"FULL_NAME",cmd:\""$FILE_PATH"\" \
+                /app:program:"$WIN_EXECUTABLE",icon:"$ICON",name:"$FULL_NAME",cmd:\""$FILE_PATH"\" \
                 /v:"$RDP_IP" &>/dev/null &
 
             # Capture the process ID.

compose.yaml

@@ -44,6 +44,6 @@ services:
       # NOTE: 'disk1' will be mounted as the main drive. THIS DISK WILL BE FORMATTED BY DOCKER.
       # All following disks (disk2, ...) WILL NOT BE FORMATTED.
       # - /dev/disk/by-id/<id>:/disk1
-      # - dev/disk/by-id/<id>:/disk2
+      # - /dev/disk/by-id/<id>:/disk2
     # group_add:      # uncomment this line and the next one for using rootless podman containers
     #   - keep-groups # to make /dev/kvm work with podman. needs "crun" installed, "runc" will not work! Add your user to the 'kvm' group or another that can access /dev/kvm.

docs/docker.md

@@ -13,8 +13,8 @@ Although WinApps supports using `QEMU+KVM+libvirt` as a backend for running Wind
 
 > [!IMPORTANT]
 > The iptables kernel module must be loaded for folder sharing with the host to work.
-> Check that the output of `lsmod | grep ip_tables` and `lsmod | grep iptable_nat` is non empty.
-> If the output of one of the previous command is empty, run `echo -e "ip_tables\niptable_nat" | sudo tee /etc/modules-load.d/iptables.conf` and reboot.
+> Check that the output of `lsmod | grep ip_tables` and `lsmod | grep iptable_nat` is non-empty.
+> If the output of one of the previous commands is empty, run `echo -e "ip_tables\niptable_nat" | sudo tee /etc/modules-load.d/iptables.conf` and reboot.
 
 ## `Docker`
 ### Installation

docs/libvirt.md

@@ -46,6 +46,8 @@ Together, these components form a powerful and flexible virtualization stack, wi
     sudo reboot # Reboot the system to ensure the user is added to the relevant groups.
     ```
 
+    Note: On NixOS, the group name for libvirt is `libvirtd` and not `libvirt`. In addition, user and group management on NixOS is handled through the Nix configuration files and not via traditional tools like `usermod`. Please see "Adding User to a group" on [this NixOS Wiki page](https://wiki.nixos.org/wiki/User_management).
+
     Note: Due to a known bug in `rpm-ostree`, which affects various distributions such as Silverblue, Bazzite, Bluefin, Kinoite, Aurora, UCore, and others, the commands provided earlier may not properly add your user to all required groups. If the `groups $USER` command does not show your user as being part of the necessary groups, you'll need to manually add these groups to `/etc/group` if they are present in `/usr/lib/group`.
 
     To resolve this:
@@ -193,7 +195,7 @@ Together, these components form a powerful and flexible virtualization stack, wi
 
         Example 1:
         - CPU cores share the same singular L3 cache, so this cannot be optimised.
-        - CPU cores utilise different L1 and L2 caches, so isolatng corresponding thread pairs will help improve performance.
+        - CPU cores utilise different L1 and L2 caches, so isolating corresponding thread pairs will help improve performance.
         - Thus, if limiting the virtual machine to a maximum of 4 threads, there are 10 possible optimal configurations:
             - T<sub>0</sub>+T<sub>4</sub>
             - T<sub>1</sub>+T<sub>5</sub>

flake.lock

@@ -32,13 +32,28 @@
         "type": "github"
       }
     },
+    "nix-filter": {
+      "locked": {
+        "lastModified": 1731533336,
+        "narHash": "sha256-oRam5PS1vcrr5UPgALW0eo1m/5/pls27Z/pabHNy2Ms=",
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "rev": "f7653272fd234696ae94229839a99b73c9ab7de0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "nix-filter",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1724819573,
-        "narHash": "sha256-GnR7/ibgIH1vhoy8cYdmXE6iyZqKqFxQSVkFgosBh6w=",
+        "lastModified": 1751984180,
+        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "71e91c409d1e654808b2621f28a327acfdad8dc2",
+        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
         "type": "github"
       },
       "original": {
@@ -52,6 +67,7 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
+        "nix-filter": "nix-filter",
         "nixpkgs": "nixpkgs"
       }
     },

flake.nix

@@ -1,17 +1,29 @@
 {
-  description = "WinApps Nix packages & NixOS module";
+  description = "WinApps Nix packages";
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz";
     flake-utils.url = "github:numtide/flake-utils";
+    nix-filter.url = "github:numtide/nix-filter";
+  };
+
+  nixConfig = {
+    extra-substituters = [
+      "https://cache.garnix.io"
+    ];
+
+    extra-trusted-public-keys = [
+      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+    ];
   };
 
   outputs =
     {
       nixpkgs,
       flake-utils,
+      nix-filter,
       ...
     }:
     flake-utils.lib.eachDefaultSystem (
@@ -19,11 +31,13 @@
       let
         pkgs = import nixpkgs { inherit system; };
       in
-      {
+      rec {
         formatter = pkgs.nixfmt-rfc-style;
 
-        packages.winapps = pkgs.callPackage ./packages/winapps { };
-        packages.winapps-launcher = pkgs.callPackage ./packages/winapps-launcher { };
+        packages.winapps = pkgs.callPackage ./packages/winapps { inherit nix-filter; };
+        packages.winapps-launcher = pkgs.callPackage ./packages/winapps-launcher {
+          inherit (packages) winapps;
+        };
       }
     );
 }

install/ExtractPrograms.ps1

@@ -49,7 +49,7 @@ Function GetApplicationIcon {
 # Args:
 #    - 'Names': An array of application names.
 #    - 'Paths': An array of executable paths.
-#    - 'Source': The source of the applications (e.g. Windows Registry, Package manangers, Universal Windows Platform (UWP), etc.)
+#    - 'Source': The source of the applications (e.g. Windows Registry, Package managers, Universal Windows Platform (UWP), etc.)
 function PrintArrayData {
     param (
         [string[]]$Names,
@@ -240,7 +240,7 @@ function AppSearchUWP {
     PrintArrayData -Names $exeNames -Paths $exePaths -Source "uwp"
 }
 
-# Name: 'AppSearchWinReg'
+# Name: 'AppSearchChocolatey'
 # Role: Search for chocolatey shims.
 function AppSearchChocolatey {
     # Initialise empty arrays.
@@ -272,7 +272,7 @@ function AppSearchChocolatey {
     }
 }
 
-# Name: 'AppSearchWinReg'
+# Name: 'AppSearchScoop'
 # Role: Search for scoop shims.
 function AppSearchScoop {
     # Initialise empty arrays.

oem/install.bat

@@ -1,25 +1,66 @@
 @echo off
+title WinApps Setup Wizard
 
-reg import %~dp0\RDPApps.reg
-
-if exists %~dp0\Container.reg (
-    reg import %~dp0\Container.reg
+REM Check for administrative privileges
+fltmc >nul 2>&1 || (
+    echo [INFO] Script not running as administrator. Attempting to relaunch with elevation...
+    powershell -Command "Start-Process '%~f0' -Verb runAs"
+    exit /b 0
 )
 
-REM Create network profile cleanup scheduled task
-copy %~dp0\NetProfileCleanup.ps1 %windir%
-set "taskname=NetworkProfileCleanup"
-set "command=powershell.exe -ExecutionPolicy Bypass -File "%windir%\NetProfileCleanup.ps1^""
+REM Confirm the user wants to proceed with setup
+echo ============================================
+echo             WinApps Setup Wizard
+echo ============================================
+echo.
+echo Press any key to continue or close this window to cancel...
+pause >nul
+echo.
+echo [INFO] Starting setup...
 
-schtasks /query /tn "%taskname%" >nul 2>&1
+REM Apply RDP and system configuration tweaks
+echo [INFO] Importing "RDPApps.reg"...
+reg import "%~dp0RDPApps.reg" >nul 2>&1
 if %ERRORLEVEL% equ 0 (
-    echo Task "%taskname%" already exists, deleting it first...
-    schtasks /delete /tn "%taskname%" /f
-)
-
-schtasks /create /tn "%taskname%" /tr "%command%" /sc onstart /ru "SYSTEM" /rl HIGHEST /f
-if %ERRORLEVEL% equ 0 (
-    echo Scheduled task "%taskname%" created successfully.
+    echo [SUCCESS] Imported "RDPApps.reg".
 ) else (
-    echo Failed to create scheduled task.
+    echo [ERROR] Failed to import "RDPApps.reg".
 )
+
+REM Configure the system clock to use UTC instead of local time
+if exist "%~dp0Container.reg" (
+    echo [INFO] Importing "Container.reg"...
+    reg import "%~dp0Container.reg" >nul 2>&1
+    if %ERRORLEVEL% equ 0 (
+        echo [SUCCESS] Imported "Container.reg".
+    ) else (
+        echo [ERROR] Failed to import "Container.reg".
+    )
+) else (
+    echo [WARNING] "Container.reg" not found. Skipping...
+)
+
+REM Create a startup task to clean up stale network profiles
+echo [INFO] Creating network profile cleanup task...
+
+REM Initialise values required to create the startup task
+set "scriptpath=%windir%\NetProfileCleanup.ps1"
+set "taskname=WinApps_NetworkProfileCleanup"
+set "command=powershell.exe -ExecutionPolicy Bypass -File ""%scriptpath%"""
+
+REM Copy the script to the Windows directory
+copy /Y "%~dp0NetProfileCleanup.ps1" "%scriptpath%" >nul
+if %ERRORLEVEL% neq 0 (
+    echo [ERROR] Failed to copy "NetProfileCleanup.ps1" to "%windir%".
+) else (
+    schtasks /create /tn "%taskname%" /tr "%command%" /sc onstart /ru "SYSTEM" /rl HIGHEST /f >nul 2>&1
+    if %ERRORLEVEL% equ 0 (
+        echo [SUCCESS] Created scheduled task "%taskname%".
+    ) else (
+        echo [ERROR] Failed to create scheduled task "%taskname%".
+    )
+)
+
+echo.
+echo Press any key to exit...
+pause >nul

packages/winapps-launcher/default.nix

@@ -4,8 +4,8 @@
   fetchFromGitHub,
   makeWrapper,
   makeDesktopItem,
-  callPackage,
   yad,
+  winapps ? throw "Pass in the winapps package",
   ...
 }:
 let
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
     yad
-    (callPackage ../winapps { })
+    winapps
   ];
 
   patches = [ ./WinApps-Launcher.patch ];

packages/winapps/default.nix

@@ -1,33 +1,36 @@
 {
   stdenv,
   lib,
-  fetchFromGitHub,
   makeWrapper,
-  freerdp3,
+  freerdp,
   dialog,
   libnotify,
   netcat,
   iproute2,
+  writeShellScriptBin,
+  nix-filter ? throw "Pass github:numtide/nix-filter as an argument!",
   ...
 }:
-let
-  rev = "aa5b3e945526800da1b8891fd8b38272a4a6189d";
-  hash = "sha256-nB56x76W+eyMqIturj26zDbKEMvp/IgDud/twz6pwCY=";
-in
 stdenv.mkDerivation rec {
   pname = "winapps";
-  version = "0-unstable-2025-06-20";
+  version = "0-unstable-2025-07-02";
 
-  src = fetchFromGitHub {
-    owner = "winapps-org";
-    repo = "winapps";
-
-    inherit rev hash;
+  src = nix-filter {
+    root = ./../..;
+    include = [
+      "apps"
+      "install"
+      "bin"
+      "icons"
+      "LICENSE.md"
+      "COPYRIGHT.md"
+      "setup.sh"
+    ];
   };
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
-    freerdp3
+    (writeShellScriptBin "xfreerdp3" ''${lib.getExe' freerdp "xfreerdp"} "$@"'')
     libnotify
     dialog
     netcat
@@ -35,7 +38,6 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    ./winapps.patch
     ./setup.patch
   ];
 

packages/winapps/setup.patch

@@ -7,9 +7,9 @@ index 0debe4d..6aeea08 100755
  readonly USER_BIN_PATH_WIN='\\tsclient\home\.local\bin' # WINDOWS path to 'bin' directory for a '--user' WinApps installation.
  # 'SOURCE'
 -readonly SYS_SOURCE_PATH="${SYS_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
--readonly USER_SOURCE_PATH="${USER_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
+-readonly USER_SOURCE_PATH="${USER_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--user' WinApps installation.
 +readonly SYS_SOURCE_PATH="@out@/src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
-+readonly USER_SOURCE_PATH="@out@/src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
++readonly USER_SOURCE_PATH="@out@/src" # UNIX path to WinApps source directory for a '--user' WinApps installation.
  # 'APP'
  readonly SYS_APP_PATH="/usr/share/applications"                        # UNIX path to 'applications' directory for a '--system' WinApps installation.
  readonly USER_APP_PATH="${HOME}/.local/share/applications"             # UNIX path to 'applications' directory for a '--user' WinApps installation.

packages/winapps/winapps.patch

@@ -1,11 +0,0 @@
---- a/bin/winapps
-+++ b/bin/winapps
-@@ -295,7 +295,7 @@ function waCheckGroupMembership() {
-     # shellcheck disable=SC2155 # Silence warnings regarding masking return values through simultaneous declaration and assignment.
-     local USER_GROUPS=$(groups "$(whoami)")
-
--    if ! (echo "$USER_GROUPS" | grep -q -E "\blibvirt\b") || ! (echo "$USER_GROUPS" | grep -q -E "\bkvm\b"); then
-+    if ! (echo "$USER_GROUPS" | grep -q -E "\blibvirtd\b") || ! (echo "$USER_GROUPS" | grep -q -E "\bkvm\b"); then
-         waThrowExit "$EC_NOT_IN_GROUP"
-     fi
- }

setup.sh

@@ -21,7 +21,7 @@ readonly EC_BAD_ARGUMENT="2"     # Unsupported argument passed to script.
 readonly EC_EXISTING_INSTALL="3" # Existing conflicting WinApps installation.
 readonly EC_NO_CONFIG="4"        # Absence of a valid WinApps configuration file.
 readonly EC_MISSING_DEPS="5"     # Missing dependencies.
-readonly EC_NO_SUDO="6"          # Insufficient privilages to invoke superuser access.
+readonly EC_NO_SUDO="6"          # Insufficient privileges to invoke superuser access.
 readonly EC_NOT_IN_GROUP="7"     # Current user not in group 'libvirt' and/or 'kvm'.
 readonly EC_VM_OFF="8"           # Windows 'libvirt' VM powered off.
 readonly EC_VM_PAUSED="9"        # Windows 'libvirt' VM paused.
@@ -40,7 +40,7 @@ readonly USER_BIN_PATH="${HOME}/.local/bin"             # UNIX path to 'bin' dir
 readonly USER_BIN_PATH_WIN='\\tsclient\home\.local\bin' # WINDOWS path to 'bin' directory for a '--user' WinApps installation.
 # 'SOURCE'
 readonly SYS_SOURCE_PATH="${SYS_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
-readonly USER_SOURCE_PATH="${USER_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--system' WinApps installation.
+readonly USER_SOURCE_PATH="${USER_BIN_PATH}/winapps-src" # UNIX path to WinApps source directory for a '--user' WinApps installation.
 # 'APP'
 readonly SYS_APP_PATH="/usr/share/applications"                        # UNIX path to 'applications' directory for a '--system' WinApps installation.
 readonly USER_APP_PATH="${HOME}/.local/share/applications"             # UNIX path to 'applications' directory for a '--user' WinApps installation.
@@ -151,7 +151,7 @@ function waGetSourceCode() {
     SCRIPT_DIR_PATH=$(readlink -f "$(dirname "${BASH_SOURCE[0]}")")
 
     # Check if winapps is currently installed on $SOURCE_PATH
-    if [[ -f "$SCRIPT_DIR_PATH/winapps" && "$SCRIPT_DIR_PATH" -ne "$SOURCE_PATH" ]]; then
+    if [[ -f "$SCRIPT_DIR_PATH/winapps" && "$SCRIPT_DIR_PATH" != "$SOURCE_PATH" ]]; then
         # Display a warning.
         echo -e "${WARNING_TEXT}[WARNING]${CLEAR_TEXT} You are running a WinApps installation located outside of default location '${SOURCE_PATH}'. A new installation will be created."
         echo -e "${WARNING_TEXT}[WARNING]${CLEAR_TEXT} You might want to remove your old installation on '${SCRIPT_DIR_PATH}'."
@@ -1156,7 +1156,7 @@ function waFindInstalled() {
         echo "IF EXIST \"${WIN_EXECUTABLE}\" ECHO ${APPLICATION} >> ${TMP_INST_FILE_PATH_WIN}" >>"$BATCH_SCRIPT_PATH"
     done
 
-    # Append a command to the batch script to run the PowerShell script and store it's output in the 'detected' file.
+    # Append a command to the batch script to run the PowerShell script and store its output in the 'detected' file.
     # shellcheck disable=SC2129 # Silence warning regarding repeated redirects.
     echo "powershell.exe -ExecutionPolicy Bypass -File ${PS_SCRIPT_HOME_PATH_WIN} > ${DETECTED_FILE_PATH_WIN}" >>"$BATCH_SCRIPT_PATH"
 
@@ -1279,7 +1279,7 @@ function waConfigureApp() {
 
     # Source 'Info' File Containing:
     # - The Application Name          (FULL_NAME)
-    # - The Shortcut Nsame            (NAME)
+    # - The Shortcut Name             (NAME)
     # - Application Categories        (CATEGORIES)
     # - Executable Path               (WIN_EXECUTABLE)
     # - Supported MIME Types          (MIME_TYPES)
@@ -1379,7 +1379,7 @@ function waConfigureApps() {
     for OSA in "${OSA_LIST[@]}"; do
         # Source 'Info' File Containing:
         # - The Application Name          (FULL_NAME)
-        # - The Shortcut Nsame            (NAME)
+        # - The Shortcut Name             (NAME)
         # - Application Categories        (CATEGORIES)
         # - Executable Path               (WIN_EXECUTABLE)
         # - Supported MIME Types          (MIME_TYPES)