# Install Garry Updates once, then update from the desktop

This kit is for a computer **already booted into your Garry Linux USB**. It cannot
repair a USB that will not boot, create persistence, or make a read-only ISO boot
medium writable. It never formats or repartitions a disk.

1. Connect Garry to Wi-Fi or Ethernet and download the official
   `Garry-Online-Updater-Fixed-20260923.zip` from GarryHQ.
2. Extract the whole ZIP. Open a terminal in the extracted folder containing
   `install-updater.py`, `bootstrap-manifest.json`, and `payload`.
3. Run `sudo python3 -I install-updater.py` and enter your local administrator
   password if asked. This is the one-time updater installation, not the release
   update itself. `-I` isolates Python imports from the download directory. Do
   not send your password to Garry or a website.
4. Open **Garry Updates** from the desktop, or the applications menu (System or Settings). Click **Check
   for updates**, review the release, then **Download update**.
5. After download verification, choose **Install for next restart** and complete
   the normal administrator prompt. Wait for the installation receipt and
   **Restart when ready** message. Save your work and restart yourself.

After this first installation, use Garry Updates from any
internet connection. No Rufus or Windows PC is needed for supported updates.
Checking, downloading, installing and restarting are distinct steps. Downloaded
does not mean installed. No background auto-update or automatic reboot is set up.

## What is trusted and what changes

The first-install ZIP is obtained from the owner's official HTTPS site. Its
bootstrap manifest checks package-file integrity; it is not an independent
signature trust anchor. The one-time installer places the public update-signing
key and updater in protected root-owned paths. Subsequent update manifests and
payloads are verified by that pinned key and the fixed-origin core, including
again after the administrator prompt. An existing different trust key is never
silently replaced.

The installer requires a mounted, writable, disk-backed full-system live root
overlay backed by a verified USB device. A `persistence` boot flag alone is insufficient. It copies only four
reviewed updater files to fixed paths, retains private backups and an
installation receipt, preserves the updater's release state, and installs an
application-menu launcher. A separate process drops all root privileges before
creating a new desktop shortcut for the invoking user; existing shortcuts are
preserved. It never writes into a user's Desktop as root. Nothing modifies Windows,
network settings, accounts, partitions, or running applications.

The updater may still reject installation if boot media is read-only, the
storage is unhealthy, the signed release is invalid, or its requirements are
not met. Follow the exact reported issue; do not repeatedly retry an operation
whose outcome is unknown. A successful file update cannot guarantee every
computer's firmware, graphics and USB hardware will boot correctly.

## Release packaging

The ZIP root contains this README, `install-updater.py`,
`bootstrap-manifest.json`, and exactly these payload files:

```
payload/garry-usb-update-core
payload/garry-updates
payload/update-signing.pub
payload/garry-updates.desktop
```

`bootstrap-manifest.json` uses
`{"schema_version":1,"files":{"payload/filename":"lowercase SHA-256",...}}`.
Only these four manifest entries are accepted. Production tests/evidence and
private signing keys must not be included in the public ZIP.

This fixed bootstrap corrects the Debian loop-device tool path. It checks
the required system tools and performs a read-only loop inventory before
installing updater files. The signed USB release and trust key are unchanged.
