Kempt

Tidy dnf and Flatpak updates for Fedora KDE, from a tray widget or the command line. Other distributions come later.

The widget lists each update with its old and new version. The padlock on each row holds a package back, and the footer shows the download size.

Install

Kempt needs Fedora with Plasma 6.

sudo dnf copr enable erez-c137/kempt
sudo dnf install kempt-plasmoid
kempt doctor          # checks the helpers, polkit, config and state

This installs the widget, the command-line tool and its helpers. Kempt appears in the system tray under System Services. The first time, it can take a log-out, or plasmashell --replace, to show up. To have it on the panel instead, add it from Add Widgets and turn off the tray entry.

From then on, dnf updates Kempt like any other package. The install guide lists what goes where and how to remove it.

On a machine without a desktop, sudo dnf install kempt installs only the command-line tool. The widget is also on the KDE Store, but it needs that tool, so install the package above.

On Silverblue, Kinoite, Bazzite and other image-based editions, Kempt can check for updates and hold packages. It cannot install updates there yet, and tells you which tool to use instead.

Why Kempt

On Fedora, dnf and Flatpak update separately, and each prints a long transaction to read through. Discover's notifier counts from PackageKit's own cache, so its number can differ from what dnf will install. Its background work can also hold the dnf lock.

Kempt checks the same cache the update uses, so the count in the tray is what that cache offers. Updates published since that check can still join the update. dnf fetches new lists once its copy passes the repository's age limit, six hours for Fedora's updates, and Flatpak always asks. Every update ends with a summary: each package's old and new version, how long it took, and whether to restart. The widget runs the same commands you can run in a terminal, so the two always agree.

Kempt is a desktop tool. It checks for updates on its own, but installs them only when you say so. For servers and unattended machines, Fedora's dnf5-automatic is the better fit.

Features

• Pending updates at a glance. The badge counts dnf packages and Flatpak apps. The widget lists each one with the version you have and the version you would get.
• Flatpak runtimes too. Updating an app can also update the runtime it runs on. Kempt lists runtimes in their own section, so the count matches what changes.
• Space back from old runtimes. Old Flatpak runtimes stay on disk after apps move on. When the unused ones take 1 GB or more, Kempt offers to remove them. kempt reclaim does it any time.
• Holds. A held package stays out of updates but stays in the list, so you do not forget it. Click its padlock, or run kempt hold dnf:kernel-core.
• Two ways to update. Now, in the widget, or on the next restart. kempt update in a terminal shows live output. When the kernel, systemd, Qt or graphics drivers have updates, Kempt suggests the restart. Discard Updates or kempt unstage takes back updates waiting for it.
• The download size up front. The widget's footer shows it before you start, from data already on disk.
• A summary of every run. Each package with its old and new version, plus the full log. Updates installed during a restart get a summary too.
• A log of what Kempt did. kempt log has one line per action.
• Limited root access. Two small helper scripts do the work that needs root, through polkit. A wheel user at the computer updates with no password, and nobody can update over SSH.
• You choose when to restart. When an update needs one, Kempt opens KDE's restart prompt, which you can cancel.
• A self-check. kempt doctor checks the install one line at a time.
• One count. Kempt can turn off Discover's update checks, so you see one number.

The settings page edits the same config file the command line reads. docs/configuration.md lists every setting.

From a checkout

To try unreleased changes, tools/build-local.sh builds the packages from your checkout and installs them. The contributing guide covers the details.

Documentation

Document	What is in it
docs/install.md	Installing from the package, who gets a password dialog, and removing Kempt
docs/widget.md	What the panel widget shows, and what each message, button and setting does
docs/usage.md	Every command with its options, output and exit codes
docs/configuration.md	Every setting with its default, holds, and where Kempt keeps its files
docs/architecture.md	How Kempt is built, the state file format, and how to add a package manager
docs/security.md	What runs as root, and who can start an update without a password
docs/ROADMAP.md	Where the project is going, in order
docs/RELEASING.md	How a release is made
docs/man/kempt.1	Man page: man kempt once installed
CHANGELOG.md	What each release shipped
CONTRIBUTING.md	Setting up, testing, and the code and writing conventions
AGENTS.md	A two-minute orientation for new contributors: the map, and six rules that catch people out
SECURITY.md	How to report a vulnerability privately
CODE_OF_CONDUCT.md	Be respectful, stay on topic, and how to report a problem

Contributing

Kempt goes deep on Fedora first (see the roadmap). Support for more package managers is still welcome. Each has an open issue: apt, pacman and zypper. A backend is one file with two required functions and a parser. Adding one also changes the root helper, so open an issue first.

Start with adding a backend, then read CONTRIBUTING.md. Report security problems through SECURITY.md, not the public issue tracker.

License

MIT. See LICENSE.