diff --git a/Cargo.lock b/Cargo.lock
index 8f12c43..1ae5668 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "addr2line"
-version = "0.22.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
+checksum = "b9ecd88a8c8378ca913a680cd98f0f13ac67383d35993f86c90a70e3f137816b"
 dependencies = [
  "gimli",
 ]
@@ -26,36 +26,15 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
 [[package]]
 name = "aho-corasick"
-version = "1.1.3"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
 dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "anstream"
 version = "0.6.15"
@@ -107,9 +86,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.86"
+version = "1.0.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+checksum = "08f9b8508dccb7687a1d6c4ce66b2b0ecef467c94667de27d8d7fe1f8d2a9cdc"
 
 [[package]]
 name = "array-macro"
@@ -130,9 +109,9 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "1.9.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+checksum = "2114d64672151c0c5eaa5e131ec84a74f06e1e559830dabba01ca30605d66319"
 dependencies = [
  "concurrent-queue",
  "event-listener",
@@ -141,51 +120,51 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.13.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7ebdfa2ebdab6b1760375fa7d6f382b9f486eac35fc994625a00e89280bdbb7"
+checksum = "871f9bb5e0a22eeb7e8cf16641feb87c9dc67032ccf8ff49e772eb9941d3a965"
 dependencies = [
  "async-task",
  "concurrent-queue",
- "fastrand 2.1.1",
- "futures-lite 2.3.0",
+ "fastrand",
+ "futures-lite",
+ "once_cell",
  "slab",
 ]
 
 [[package]]
 name = "async-io"
-version = "1.13.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
+checksum = "a811e6a479f2439f0c04038796b5cfb3d2ad56c230e0f2d3f7b04d68cfee607b"
 dependencies = [
- "async-lock",
- "autocfg",
- "cfg-if 1.0.0",
  "concurrent-queue",
- "futures-lite 1.13.0",
+ "futures-lite",
+ "libc",
  "log",
+ "once_cell",
  "parking",
  "polling",
- "rustix 0.37.13",
  "slab",
  "socket2",
  "waker-fn",
+ "winapi",
 ]
 
 [[package]]
 name = "async-lock"
-version = "2.8.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "287272293e9d8c41773cec55e365490fe034813a2f172f502d6ddcf75b2f582b"
+checksum = "e97a171d191782fba31bb902b14ad94e24a68145032b7eedf871ab0bc0d077b6"
 dependencies = [
  "event-listener",
 ]
 
 [[package]]
 name = "async-task"
-version = "4.7.1"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+checksum = "30696a84d817107fc028e049980e09d5e140e8da8f1caeb17e8e950658a3cea9"
 
 [[package]]
 name = "atk"
@@ -194,7 +173,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a83b21d2aa75e464db56225e1bda2dd5993311ba1095acaa8fa03d1ae67026ba"
 dependencies = [
  "atk-sys",
- "bitflags 1.2.1",
+ "bitflags",
  "glib 0.14.8",
  "libc",
 ]
@@ -213,21 +192,21 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "backtrace"
-version = "0.3.73"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
+checksum = "11a17d453482a265fd5f8479f2a3f405566e6ca627837aaddb85af8b1ab8ef61"
 dependencies = [
  "addr2line",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "miniz_oxide 0.7.4",
+ "miniz_oxide",
  "object",
  "rustc-demangle",
 ]
@@ -247,12 +226,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
 
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
-
 [[package]]
 name = "block-buffer"
 version = "0.9.0"
@@ -274,16 +247,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "bumpalo"
-version = "3.16.0"
+name = "byteorder"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
-name = "byteorder"
-version = "1.5.0"
+name = "cache-padded"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+checksum = "c1db59621ec70f09c5e9b597b220c7a2b43611f4710dc03ceb8748637775692c"
 
 [[package]]
 name = "cairo-rs"
@@ -291,7 +264,7 @@ version = "0.14.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33b5725979db0c586d98abad2193cdb612dd40ef95cd26bd99851bf93b3cb482"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "cairo-sys-rs",
  "glib 0.14.8",
  "libc",
@@ -311,12 +284,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.15"
+version = "1.0.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57b6a275aa2903740dc87da01c62040406b8812552e97129a63ea8850a17c6e6"
-dependencies = [
- "shlex",
-]
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
 
 [[package]]
 name = "cfg-expr"
@@ -341,16 +311,15 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
 dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "wasm-bindgen",
- "windows-targets 0.52.6",
+ "libc",
+ "num-integer",
+ "num-traits 0.2.15",
+ "time",
+ "winapi",
 ]
 
 [[package]]
@@ -411,9 +380,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.16"
+version = "4.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed6719fffa43d0d87e5fd8caeab59be1554fb028cd30edc88fc4369b17971019"
+checksum = "3e5a21b8495e732f1b3c364c9949b201ca7bae518c502c80256c96ad79eaf6ac"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -421,9 +390,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.15"
+version = "4.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216aec2b177652e3846684cbfe25c9964d18ec45234f0f5da5157b207ed1aab6"
+checksum = "8cf2dd12af7a047ad9d6da2b6b249759a22a7abc0f474c1dae1777afa4b21a73"
 dependencies = [
  "anstream",
  "anstyle",
@@ -440,7 +409,7 @@ dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 2.0.76",
+ "syn 2.0.77",
 ]
 
 [[package]]
@@ -457,33 +426,27 @@ checksum = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
 
 [[package]]
 name = "concurrent-queue"
-version = "2.5.0"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+checksum = "30ed07550be01594c6026cff2a1d7fe9c8f683caa798e12b68694ac9e88286a3"
 dependencies = [
- "crossbeam-utils 0.8.20",
+ "cache-padded",
 ]
 
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
 [[package]]
 name = "cpufeatures"
-version = "0.2.13"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51e852e6dc9a5bed1fae92dd2375037bf2b768725bf3be87811edee3249d09ad"
+checksum = "59a6001667ab124aebae2a495118e11d30984c3a653e99d86d58971708cf5e4b"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
 dependencies = [
  "cfg-if 1.0.0",
 ]
@@ -494,7 +457,7 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ec7fcd21571dc78f96cc96243cab8d8f035247c3efd16c687be154c3fa9efa"
 dependencies = [
- "crossbeam-utils 0.6.6",
+ "crossbeam-utils",
 ]
 
 [[package]]
@@ -507,12 +470,6 @@ dependencies = [
  "lazy_static",
 ]
 
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
-
 [[package]]
 name = "crypto-mac"
 version = "0.10.1"
@@ -574,7 +531,7 @@ checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -587,25 +544,31 @@ dependencies = [
 ]
 
 [[package]]
-name = "easy-parallel"
-version = "3.3.1"
+name = "dtoa"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2afbb9b0aef60e4f0d2b18129b6c0dff035a6f7dbbd17c2f38c1432102ee223c"
+checksum = "56899898ce76aaf4a0f24d914c97ea6ed976d42fec6ad33fcbb0a1103e07b2b0"
+
+[[package]]
+name = "easy-parallel"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6907e25393cdcc1f4f3f513d9aac1e840eb1cc341a0fccb01171f7d14d10b946"
 
 [[package]]
 name = "ed25519"
-version = "1.5.3"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91cff35c70bba8a626e3185d8cd48cc11b5437e1a5bcd15b9b5fa3c64b6dfee7"
+checksum = "1e9c280362032ea4203659fc489832d0204ef09f247a0506f170dafcac08c369"
 dependencies = [
  "signature",
 ]
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
 
 [[package]]
 name = "enum-map"
@@ -625,7 +588,7 @@ checksum = "e5c450cf304c9e18d45db562025a14fb1ca0f5c769b6f609309f81d4c31de455"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -655,7 +618,7 @@ checksum = "946ee94e3dbf58fdd324f9ce245c7b238d46a66f00e86a020b71996349e46cce"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -665,7 +628,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "43bd5effaae6a671efa2032056110916a501bd24128cfb6f44e5a339b5cdb152"
 dependencies = [
  "enumset_derive",
- "num-traits",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
@@ -685,21 +648,11 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
-[[package]]
-name = "errno"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "event-listener"
-version = "2.5.3"
+version = "2.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+checksum = "77f3309417938f28bf8228fcff79a4a37103981e3e186d2ccd19c74b38f4eb71"
 
 [[package]]
 name = "failure"
@@ -719,65 +672,59 @@ checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
  "synstructure",
 ]
 
 [[package]]
 name = "fastrand"
-version = "1.9.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
 dependencies = [
  "instant",
 ]
 
-[[package]]
-name = "fastrand"
-version = "2.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"
-
 [[package]]
 name = "field-offset"
-version = "0.3.6"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+checksum = "1e1c54951450cbd39f3dbcf1005ac413b49487dabf18a720ad2383eccfeffb92"
 dependencies = [
- "memoffset 0.9.1",
+ "memoffset",
  "rustc_version",
 ]
 
 [[package]]
 name = "flate2"
-version = "1.0.33"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "324a1be68054ef05ad64b861cc9eaf1d623d2d8cb25b4bf2cb9cdd902b4bf253"
+checksum = "f82b0f4c27ad9f8bfd1f3208d882da2b09c301bc1c828fd3a00d0216d2fbbff6"
 dependencies = [
  "crc32fast",
- "miniz_oxide 0.8.0",
+ "miniz_oxide",
 ]
 
 [[package]]
 name = "futures-channel"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+checksum = "9420b90cfa29e327d0429f19be13e7ddb68fa1cccb09d65e5706b8c7a749b8a6"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -786,17 +733,17 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+checksum = "fc4045962a5a5e935ee2fdedaa4e08284547402885ab326734432bed5d12966b"
 
 [[package]]
 name = "futures-lite"
-version = "1.13.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+checksum = "7694489acd39452c77daa48516b894c153f192c3578d5a839b62c58099fcbf48"
 dependencies = [
- "fastrand 1.9.0",
+ "fastrand",
  "futures-core",
  "futures-io",
  "memchr",
@@ -805,47 +752,34 @@ dependencies = [
  "waker-fn",
 ]
 
-[[package]]
-name = "futures-lite"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52527eb5074e35e9339c6b4e8d12600c7128b68fb25dcb9fa9dec18f7c25f3a5"
-dependencies = [
- "fastrand 2.1.1",
- "futures-core",
- "futures-io",
- "parking",
- "pin-project-lite",
-]
-
 [[package]]
 name = "futures-macro"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 2.0.76",
+ "syn 1.0.95",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+checksum = "21163e139fa306126e6eedaf49ecdb4588f939600f0b1e770f4205ee4b7fa868"
 
 [[package]]
 name = "futures-task"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
 
 [[package]]
 name = "futures-util"
-version = "0.3.30"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
 dependencies = [
  "futures-core",
  "futures-macro",
@@ -862,7 +796,7 @@ version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d749dcfc00d8de0d7c3a289e04a04293eb5ba3d8a4e64d64911d481fa9933b"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "cairo-rs",
  "gdk-pixbuf",
  "gdk-sys",
@@ -916,9 +850,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "0.14.7"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+checksum = "fd48d33ec7f05fbfa152300fdad764757cbded343c1aa1cff2fbaf4134851803"
 dependencies = [
  "typenum",
  "version_check",
@@ -926,9 +860,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
@@ -937,9 +871,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.29.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
+checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
 
 [[package]]
 name = "gio"
@@ -947,7 +881,7 @@ version = "0.14.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "711c3632b3ebd095578a9c091418d10fed492da9443f58ebc8f45efbeb215cb0"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "futures-channel",
  "futures-core",
  "futures-io",
@@ -977,7 +911,7 @@ version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c685013b7515e668f1b57a165b009d4d28cb139a8a989bbd699c10dad29d0c5"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -996,7 +930,7 @@ version = "0.14.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c515f1e62bf151ef6635f528d05b02c11506de986e43b34a5c920ef0b3796a4"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "futures-channel",
  "futures-core",
  "futures-executor",
@@ -1022,7 +956,7 @@ dependencies = [
  "proc-macro-error",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -1033,11 +967,11 @@ checksum = "2aad66361f66796bfc73f530c51ef123970eb895ffba991a234fcf7bea89e518"
 dependencies = [
  "anyhow",
  "heck 0.3.3",
- "proc-macro-crate 1.3.1",
+ "proc-macro-crate 1.1.3",
  "proc-macro-error",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -1089,7 +1023,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb51122dd3317e9327ec1e4faa151d1fa0d95664cd8fb8dcfacf4d4d29ac70c"
 dependencies = [
  "atk",
- "bitflags 1.2.1",
+ "bitflags",
  "cairo-rs",
  "field-offset",
  "futures-channel",
@@ -1131,11 +1065,11 @@ checksum = "21de1da96dc117443fb03c2e270b2d34b7de98d0a79a19bbb689476173745b79"
 dependencies = [
  "anyhow",
  "heck 0.3.3",
- "proc-macro-crate 1.3.1",
+ "proc-macro-crate 1.1.3",
  "proc-macro-error",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -1159,12 +1093,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hermit-abi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
-
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -1181,34 +1109,11 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "iana-time-zone"
-version = "0.1.60"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "indexmap"
-version = "2.4.0"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93ead53efc7ea8ed3cfb0c79fc8023fbb782a5432b52830b6518941cebe6505c"
+checksum = "68b900aa2f7301e21c36462b170ee99994de34dff39a4a6a528e80e7376d07e5"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -1220,7 +1125,7 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46dd0a94b393c730779ccfd2a872b67b1eb67be3fc33082e733bdb38b5fde4d4"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "inotify-sys",
  "libc",
 ]
@@ -1236,24 +1141,13 @@ dependencies = [
 
 [[package]]
 name = "instant"
-version = "0.1.13"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
 dependencies = [
  "cfg-if 1.0.0",
 ]
 
-[[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.1"
@@ -1271,33 +1165,38 @@ dependencies = [
 
 [[package]]
 name = "itertools"
-version = "0.10.5"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+checksum = "a9a9d19fa1e79b6215ff29b9d6880b706147f16e9b1dbb1e4e5947b5b02bc5e3"
 dependencies = [
  "either",
 ]
 
 [[package]]
-name = "js-sys"
-version = "0.3.70"
+name = "itoa"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
+checksum = "8324a32baf01e2ae060e9de58ed0bc2320c9a2833491ee36cd3b4c414de4db8c"
+
+[[package]]
+name = "launch-gnome-software"
+version = "0.1.0"
 dependencies = [
- "wasm-bindgen",
+ "anyhow",
+ "libcitadel",
 ]
 
 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.158"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8adc4bb1803a324070e64a98ae98f38934d91957a99cfb3a43dcbc01bc56439"
+checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
 
 [[package]]
 name = "libcitadel"
@@ -1315,16 +1214,17 @@ dependencies = [
  "procfs",
  "serde",
  "serde_derive",
+ "serde_json",
  "sodiumoxide",
- "toml 0.5.11",
+ "toml 0.5.9",
  "walkdir",
 ]
 
 [[package]]
 name = "libdbus-sys"
-version = "0.2.5"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06085512b750d640299b79be4bad3d2fa90a9c00b1fd9e1b46364f66f0485c72"
+checksum = "c185b5b7ad900923ef3a8ff594083d4d9b5aea80bb4f32b8342363138c0d456b"
 dependencies = [
  "pkg-config",
 ]
@@ -1341,23 +1241,14 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
-
 [[package]]
 name = "log"
-version = "0.4.22"
+version = "0.4.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if 1.0.0",
+]
 
 [[package]]
 name = "md-5"
@@ -1372,9 +1263,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
 
 [[package]]
 name = "memoffset"
@@ -1385,40 +1276,22 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "miniz_oxide"
-version = "0.7.4"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+checksum = "d2b29bd4bc3f33391105ebee3589c19197c4271e3e5a9ec9bfe8127eeff8f082"
 dependencies = [
  "adler",
 ]
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
-dependencies = [
- "adler2",
-]
-
 [[package]]
 name = "nix"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50e4785f2c3b7589a0d0c1dd60285e1188adac4006e8abd6dd578e1567027363"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "cc",
  "cfg-if 0.1.10",
  "libc",
@@ -1431,11 +1304,11 @@ version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77d9f3521ea8e0641a153b3cddaf008dcbf26acd4ed739a2517295e0760d12c7"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "memoffset 0.6.5",
+ "memoffset",
 ]
 
 [[package]]
@@ -1448,7 +1321,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-rational",
- "num-traits",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
@@ -1458,27 +1331,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6b19411a9719e753aff12e5187b74d60d3dc449ec3f4dc21e3989c3f554bc95"
 dependencies = [
  "autocfg",
- "num-traits",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.46"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
 dependencies = [
- "num-traits",
+ "autocfg",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.45"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
 dependencies = [
  "autocfg",
  "num-integer",
- "num-traits",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
@@ -1489,14 +1363,23 @@ checksum = "5c000134b5dbf44adc5cb772486d335293351644b801551abe8f75c84cfa4aef"
 dependencies = [
  "autocfg",
  "num-integer",
- "num-traits",
+ "num-traits 0.2.15",
 ]
 
 [[package]]
 name = "num-traits"
-version = "0.2.19"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+checksum = "92e5113e9fd4cc14ded8e499429f396a20f98c772a47cc8622a736e1ec843c31"
+dependencies = [
+ "num-traits 0.2.15",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
 dependencies = [
  "autocfg",
 ]
@@ -1509,24 +1392,24 @@ checksum = "b8f8bdf33df195859076e54ab11ee78a1b208382d3a26ec40d142ffc1ecc49ef"
 
 [[package]]
 name = "object"
-version = "0.36.4"
+version = "0.28.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
+checksum = "e42c982f2d955fac81dd7e1d0e1426a7d702acd9c98d19ab01083a6a0328c424"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "87f3e037eac156d1775da914196f0f37741a274155e34a0b7e427c35d2a2ecb9"
 
 [[package]]
 name = "opaque-debug"
-version = "0.3.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "owning_ref"
@@ -1543,7 +1426,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9937068580bebd8ced19975938573803273ccbcbd598c58d4906efd4ac87c438"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "glib 0.10.3",
  "glib-sys 0.10.1",
  "gobject-sys 0.10.0",
@@ -1558,7 +1441,7 @@ version = "0.14.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "546fd59801e5ca735af82839007edd226fe7d3bb06433ec48072be4439c28581"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "glib 0.14.8",
  "libc",
  "once_cell",
@@ -1591,15 +1474,24 @@ dependencies = [
 
 [[package]]
 name = "parking"
-version = "2.2.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
+checksum = "427c3892f9e783d91cc128285287e70a59e206ca452770ece88a76f7a3eddd72"
+
+[[package]]
+name = "pest"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10f4872ae94d7b90ae48754df22fd42ad52ce740b8f370b03da4835417403e53"
+dependencies = [
+ "ucd-trie",
+]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.14"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
 
 [[package]]
 name = "pin-utils"
@@ -1609,29 +1501,28 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.30"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
 
 [[package]]
 name = "polling"
-version = "2.5.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22122d5ec4f9fe1b3916419b76be1e80bcb93f618d071d2edf841b137b2a2bd6"
+checksum = "685404d509889fade3e86fe3a5803bca2ec09b0c0778d5ada6ec8bf7a8de5259"
 dependencies = [
- "autocfg",
  "cfg-if 1.0.0",
  "libc",
  "log",
  "wepoll-ffi",
- "windows-sys 0.42.0",
+ "winapi",
 ]
 
 [[package]]
 name = "posix-acl"
-version = "1.2.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9928b761309e4a4ca4f2d90eb03029142e3f7164107e18db4d46516515b87441"
+checksum = "2ea5dae99e4365fa738533b43f4c649c0450ba7fbb81a984a4fba6a42ce91812"
 dependencies = [
  "acl-sys",
  "libc",
@@ -1639,12 +1530,9 @@ dependencies = [
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
-dependencies = [
- "zerocopy",
-]
+checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
 
 [[package]]
 name = "proc-macro-crate"
@@ -1652,17 +1540,17 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d6ea3c4595b96363c13943497db34af4460fb474a95c43f4446ad341b8c9785"
 dependencies = [
- "toml 0.5.11",
+ "toml 0.5.9",
 ]
 
 [[package]]
 name = "proc-macro-crate"
-version = "1.3.1"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+checksum = "e17d47ce914bf4de440332250b0edd23ce48c005f59fab39d3335866b114f11a"
 dependencies = [
- "once_cell",
- "toml_edit 0.19.15",
+ "thiserror",
+ "toml 0.5.9",
 ]
 
 [[package]]
@@ -1674,7 +1562,7 @@ dependencies = [
  "proc-macro-error-attr",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
  "version_check",
 ]
 
@@ -1713,7 +1601,7 @@ version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0941606b9934e2d98a3677759a971756eb821f75764d0e0d26946d08e74d9104"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
  "byteorder",
  "chrono",
  "flate2",
@@ -1778,9 +1666,9 @@ dependencies = [
 
 [[package]]
 name = "rand_core"
-version = "0.6.4"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
  "getrandom",
 ]
@@ -1810,36 +1698,27 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
 dependencies = [
- "bitflags 1.2.1",
+ "bitflags",
 ]
 
 [[package]]
 name = "redox_termios"
-version = "0.1.3"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20145670ba436b55d91fc92d25e71160fbfbdd57831631c8d7d36377a476f1cb"
-
-[[package]]
-name = "regex"
-version = "1.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
+checksum = "8440d8acb4fd3d277125b4bd01a6f38aee8d814b3b5fc09b3f2b825d37d3fe8f"
 dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
+ "redox_syscall",
 ]
 
 [[package]]
-name = "regex-automata"
-version = "0.4.7"
+name = "regex"
+version = "1.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "1a11647b6b25ff05a515cb92c365cec08801e83423a235b51e231e1808747286"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1848,9 +1727,18 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.6.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
 
 [[package]]
 name = "rpassword"
@@ -1875,46 +1763,19 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.24"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
 
 [[package]]
 name = "rustc_version"
-version = "0.4.1"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+checksum = "f0dfe2087c51c460008730de8b57e6a320782fbfb312e1f4d520e6c6fae155ee"
 dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.37.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79bef90eb6d984c72722595b5b1348ab39275a5e5123faca6863bf07d75a4e0"
-dependencies = [
- "bitflags 1.2.1",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.3.8",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a85d50532239da68e9addb745ba38ff4612a242c1c7ceea689c4bc7c2f43c36f"
-dependencies = [
- "bitflags 2.6.0",
- "errno",
- "libc",
- "linux-raw-sys 0.4.14",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -1926,15 +1787,27 @@ dependencies = [
 
 [[package]]
 name = "scoped-tls"
-version = "1.0.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+checksum = "ea6a9290e3c9cf0f18145ef7ffa62d68ee0bf5fcd651017e586dc7fd5da448c2"
 
 [[package]]
 name = "semver"
-version = "1.0.23"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+checksum = "f301af10236f6df4160f7c3f04eec6dbc70ace82d23326abad5edee88801c6b6"
+dependencies = [
+ "semver-parser",
+]
+
+[[package]]
+name = "semver-parser"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0bef5b7f9e0df16536d3961cfb6e84331c065b4066afb39768d0e319411f7"
+dependencies = [
+ "pest",
+]
 
 [[package]]
 name = "serde"
@@ -1953,18 +1826,30 @@ checksum = "a5831b979fd7b5439637af1752d535ff49f4860c0f341d1baeb6faf0f4242170"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 2.0.76",
+ "syn 2.0.77",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c62115693d0a9ed8c32d1c760f0fdbe7d4b05cb13c135b9b54137ac0d59fccb"
+dependencies = [
+ "dtoa",
+ "itoa",
+ "num-traits 0.1.43",
+ "serde",
 ]
 
 [[package]]
 name = "serde_repr"
-version = "0.1.19"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+checksum = "a2ad84e47328a31223de7fed7a4f5087f2d6ddfe586cf3ca25b7a165bc0a5aed"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 2.0.76",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -2000,9 +1885,9 @@ dependencies = [
 
 [[package]]
 name = "sha1_smol"
-version = "1.0.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+checksum = "ae1a47186c03a32177042e55dbc5fd5aee900b8e0069a8d70fba96a9375cd012"
 
 [[package]]
 name = "sha2"
@@ -2017,12 +1902,6 @@ dependencies = [
  "opaque-debug",
 ]
 
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
 [[package]]
 name = "signal-hook"
 version = "0.1.17"
@@ -2035,48 +1914,45 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+checksum = "e51e73328dc4ac0c7ccbda3a494dfa03df1de2f46018127f60c693f2648455b0"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "signature"
-version = "1.6.4"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+checksum = "f054c6c1a6e95179d6f23ed974060dcefb2d9388bb7256900badad682c499de4"
 
 [[package]]
 name = "slab"
-version = "0.4.9"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-dependencies = [
- "autocfg",
-]
+checksum = "eb703cfe953bccee95685111adeedb76fabe4e97549a58d16f03ea7b9367bb32"
 
 [[package]]
 name = "slotmap"
-version = "1.0.7"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbff4acf519f630b3a3ddcfaea6c06b42174d9a44bc70c620e9ed1649d58b82a"
+checksum = "e1e08e261d0e8f5c43123b7adf3e4ca1690d655377ac93a03b2c9d3e98de1342"
 dependencies = [
  "version_check",
 ]
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
 
 [[package]]
 name = "socket2"
-version = "0.4.10"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
+checksum = "66d72b759436ae32898a2af0a14218dbf55efde3feeb170eb623637db85ee1e0"
 dependencies = [
  "libc",
  "winapi",
@@ -2133,7 +2009,7 @@ dependencies = [
  "heck 0.3.3",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -2145,7 +2021,7 @@ dependencies = [
  "heck 0.3.3",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -2167,9 +2043,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "fbaf6116ab8924f39d52792136fb74fd60a80194cf1b1c6ffa6453eef1c3f942"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
@@ -2178,9 +2054,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.76"
+version = "2.0.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578e081a14e0cefc3279b0472138c513f37b41a08d5a3cca9b6e4e8ceb6cd525"
+checksum = "9f35bcdf61fd8e7be6caf75f429fdca8beb3ed76584befb503b1569faee373ed"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
@@ -2195,8 +2071,8 @@ checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
- "unicode-xid 0.2.5",
+ "syn 1.0.95",
+ "unicode-xid 0.2.3",
 ]
 
 [[package]]
@@ -2210,7 +2086,7 @@ dependencies = [
  "strum 0.18.0",
  "strum_macros 0.18.0",
  "thiserror",
- "toml 0.5.11",
+ "toml 0.5.9",
  "version-compare 0.0.10",
 ]
 
@@ -2223,26 +2099,27 @@ dependencies = [
  "anyhow",
  "cfg-expr",
  "heck 0.3.3",
- "itertools 0.10.5",
+ "itertools 0.10.3",
  "pkg-config",
  "strum 0.21.0",
  "strum_macros 0.21.1",
  "thiserror",
- "toml 0.5.11",
+ "toml 0.5.9",
  "version-compare 0.0.11",
 ]
 
 [[package]]
 name = "tempfile"
-version = "3.12.0"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbcdd0c794ebb0d4cf35e88edd2f7d2c4c3e9a5a6dab322839b321c6a87a64"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
 dependencies = [
  "cfg-if 1.0.0",
- "fastrand 2.1.1",
- "once_cell",
- "rustix 0.38.35",
- "windows-sys 0.59.0",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
 ]
 
 [[package]]
@@ -2259,22 +2136,32 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.63"
+version = "1.0.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+checksum = "bd829fe32373d27f76265620b5309d0340cb8550f523c1dda251d6298069069a"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.63"
+version = "1.0.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+checksum = "0396bc89e626244658bef819e22d0cc459e795a5ebe878e6ec336d1674a8d79a"
 dependencies = [
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 2.0.76",
+ "syn 1.0.95",
+]
+
+[[package]]
+name = "time"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
+dependencies = [
+ "libc",
+ "winapi",
 ]
 
 [[package]]
@@ -2288,9 +2175,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.5.11"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
+checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
 dependencies = [
  "serde",
 ]
@@ -2304,7 +2191,7 @@ dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "toml_edit 0.22.20",
+ "toml_edit",
 ]
 
 [[package]]
@@ -2316,17 +2203,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "toml_edit"
-version = "0.19.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
-dependencies = [
- "indexmap",
- "toml_datetime",
- "winnow 0.5.40",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.22.20"
@@ -2337,32 +2213,38 @@ dependencies = [
  "serde",
  "serde_spanned",
  "toml_datetime",
- "winnow 0.6.18",
+ "winnow",
 ]
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56dee185309b50d1f11bfedef0fe6d036842e3fb77413abef29f8f8d1c5d4c1c"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "d22af068fba1eb5edcb4aea19d382b2a3deb4c8f9d475c589b6ada9e0fd493ee"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.11.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
+checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
 
 [[package]]
 name = "unicode-width"
-version = "0.1.13"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
 
 [[package]]
 name = "unicode-xid"
@@ -2372,9 +2254,9 @@ checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.5"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229730647fbc343e3a80e463c1db7f78f3855d3f3739bee0dda773c9a037c90a"
+checksum = "957e51f3646910546462e67d5f7599b9e4fb8acdd304b087a6494730f9eebf04"
 
 [[package]]
 name = "utf8parse"
@@ -2396,9 +2278,9 @@ checksum = "1c18c859eead79d8b95d09e4678566e8d70105c4e7b251f707a03df32442661b"
 
 [[package]]
 name = "version_check"
-version = "0.9.5"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "void"
@@ -2408,80 +2290,26 @@ checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
 
 [[package]]
 name = "waker-fn"
-version = "1.2.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
+checksum = "9d5b2c62b4012a3e1eca5a7e077d13b3bf498c4073e33ccd58626607748ceeca"
 
 [[package]]
 name = "walkdir"
-version = "2.5.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
 dependencies = [
  "same-file",
+ "winapi",
  "winapi-util",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.10.2+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
-dependencies = [
- "cfg-if 1.0.0",
- "once_cell",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2 1.0.86",
- "quote 1.0.37",
- "syn 2.0.76",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
-dependencies = [
- "quote 1.0.37",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
-dependencies = [
- "proc-macro2 1.0.86",
- "quote 1.0.37",
- "syn 2.0.76",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
 
 [[package]]
 name = "wepoll-ffi"
@@ -2510,11 +2338,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.9"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
 dependencies = [
- "windows-sys 0.59.0",
+ "winapi",
 ]
 
 [[package]]
@@ -2523,30 +2351,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
-[[package]]
-name = "windows-core"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -2565,15 +2369,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -2605,12 +2400,6 @@ dependencies = [
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -2623,12 +2412,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -2641,12 +2424,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -2665,12 +2442,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -2683,12 +2454,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -2701,12 +2466,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -2719,12 +2478,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -2737,15 +2490,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "winnow"
-version = "0.5.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winnow"
 version = "0.6.18"
@@ -2799,32 +2543,11 @@ version = "2.0.0-beta.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf0fa91321143695013cb3fa62a6395dbe14eafd97ab58c2ba73f61d5035b1d9"
 dependencies = [
- "proc-macro-crate 1.3.1",
+ "proc-macro-crate 1.1.3",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
  "regex",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
-dependencies = [
- "byteorder",
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.7.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
-dependencies = [
- "proc-macro2 1.0.86",
- "quote 1.0.37",
- "syn 2.0.76",
+ "syn 1.0.95",
 ]
 
 [[package]]
@@ -2847,8 +2570,8 @@ version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4ca5e22593eb4212382d60d26350065bf2a02c34b85bc850474a74b589a3de9"
 dependencies = [
- "proc-macro-crate 1.3.1",
+ "proc-macro-crate 1.1.3",
  "proc-macro2 1.0.86",
  "quote 1.0.37",
- "syn 1.0.109",
+ "syn 1.0.95",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 1f33bf0..9b66f82 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-members = ["citadel-realms", "citadel-installer-ui", "citadel-tool", "realmsd", "realm-config-ui" ]
+members = ["citadel-realms", "citadel-installer-ui", "citadel-tool", "realmsd", "realm-config-ui", "launch-gnome-software" ]
 [profile.release]
 lto = true
 codegen-units = 1
diff --git a/citadel-tool/src/sync/desktop_sync.rs b/citadel-tool/src/sync/desktop_sync.rs
index e7b889b..94a78b0 100644
--- a/citadel-tool/src/sync/desktop_sync.rs
+++ b/citadel-tool/src/sync/desktop_sync.rs
@@ -99,7 +99,7 @@ impl DesktopFileSync {
     }
 
     fn collect_source_files(&mut self,  directory: impl AsRef<Path>) -> Result<()> {
-        let mut directory = Realms::current_realm_symlink().join(directory.as_ref());
+        let mut directory = self.realm.run_path().join(directory.as_ref());
         directory.push("share/applications");
         if directory.exists() {
             util::read_directory(&directory, |dent| {
@@ -126,7 +126,11 @@ impl DesktopFileSync {
     }
 
     fn remove_missing_target_files(&mut self) -> Result<()> {
-        let sources = self.source_filenames();
+        let mut sources = self.source_filenames();
+        // If flatpak is enabled, don't remove the generated GNOME Software desktop file
+        if self.realm.config().flatpak() {
+            sources.insert(format!("realm-{}.org.gnome.Software.desktop", self.realm.name()));
+        }
         let prefix = format!("realm-{}.", self.realm.name());
         util::read_directory(Self::CITADEL_APPLICATIONS, |dent| {
             if let Some(filename) = dent.file_name().to_str() {
@@ -182,7 +186,9 @@ impl DesktopFileSync {
 
     fn sync_item(&self, item: &DesktopItem) -> Result<()> {
         let mut dfp = DesktopFileParser::parse_from_path(&item.path, "/usr/libexec/citadel-run ")?;
-        if dfp.is_showable() {
+        // When use-flatpak is enabled a gnome-software desktop file will be generated
+        let flatpak_gs_hide = dfp.filename() == "org.gnome.Software.desktop" && self.realm.config().flatpak();
+        if dfp.is_showable() && !flatpak_gs_hide {
             self.sync_item_icon(&mut dfp);
             dfp.write_to_dir(Self::CITADEL_APPLICATIONS, Some(&self.realm))?;
         } else {
diff --git a/citadel-tool/src/sync/icons.rs b/citadel-tool/src/sync/icons.rs
index 28ac7b0..8be6bdf 100644
--- a/citadel-tool/src/sync/icons.rs
+++ b/citadel-tool/src/sync/icons.rs
@@ -4,7 +4,6 @@ use std::path::{Path, PathBuf};
 
 use libcitadel::{Result, util, Realm};
 use std::cell::{RefCell, Cell};
-use std::fs;
 use crate::sync::desktop_file::DesktopFile;
 use crate::sync::REALM_BASE_PATHS;
 
diff --git a/citadel-tool/src/sync/mod.rs b/citadel-tool/src/sync/mod.rs
index 6956027..dd807a4 100644
--- a/citadel-tool/src/sync/mod.rs
+++ b/citadel-tool/src/sync/mod.rs
@@ -14,7 +14,7 @@ fn has_arg(args: &[String], arg: &str) -> bool {
 
 pub const REALM_BASE_PATHS:&[&str]  = &[
     "rootfs/usr",
-    "rootfs/var/lib/flatpak/exports",
+    "flatpak/exports",
     "home/.local",
     "home/.local/share/flatpak/exports"
 ];
diff --git a/launch-gnome-software/Cargo.toml b/launch-gnome-software/Cargo.toml
new file mode 100644
index 0000000..a7de13d
--- /dev/null
+++ b/launch-gnome-software/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "launch-gnome-software"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+libcitadel = { path = "../libcitadel" }
+anyhow = "1.0"
\ No newline at end of file
diff --git a/launch-gnome-software/src/main.rs b/launch-gnome-software/src/main.rs
new file mode 100644
index 0000000..30b5285
--- /dev/null
+++ b/launch-gnome-software/src/main.rs
@@ -0,0 +1,67 @@
+use std::env;
+
+use libcitadel::{Logger, LogLevel, Realm, Realms, util};
+use libcitadel::flatpak::GnomeSoftwareLauncher;
+
+use anyhow::{bail, Result};
+
+
+fn realm_arg() -> Option<String> {
+    let mut args = env::args();
+    while let Some(arg) = args.next() {
+        if arg == "--realm" {
+            return args.next();
+        }
+    }
+    None
+}
+
+fn choose_realm() -> Result<Realm> {
+    let mut realms = Realms::load()?;
+    if let Some(realm_name) = realm_arg() {
+        match realms.by_name(&realm_name) {
+            None => bail!("realm '{}' not found", realm_name),
+            Some(realm) => return Ok(realm),
+        }
+    }
+    let realm = match realms.current() {
+        Some(realm) => realm,
+        None => bail!("no current realm"),
+    };
+
+    Ok(realm)
+}
+
+fn has_arg(arg: &str) -> bool {
+    env::args()
+        .skip(1)
+        .any(|s| s == arg)
+}
+
+fn launch() -> Result<()> {
+    let realm = choose_realm()?;
+    if !util::is_euid_root() {
+        bail!("Must be run with root euid");
+    }
+    let mut launcher = GnomeSoftwareLauncher::new(realm)?;
+
+    if has_arg("--quit") {
+        launcher.quit()?;
+    } else {
+        if has_arg("--shell") {
+            launcher.set_run_shell();
+        }
+        launcher.launch()?;
+    }
+    Ok(())
+}
+
+fn main() {
+    if has_arg("--verbose") {
+        Logger::set_log_level(LogLevel::Verbose);
+    }
+
+    if let Err(err) = launch() {
+        eprintln!("Error: {}", err);
+    }
+}
diff --git a/libcitadel/Cargo.toml b/libcitadel/Cargo.toml
index 5eb3829..7242b35 100644
--- a/libcitadel/Cargo.toml
+++ b/libcitadel/Cargo.toml
@@ -10,6 +10,7 @@ nix = "0.17.0"
 toml = "0.5"
 serde = "1.0"
 serde_derive = "1.0"
+serde_json = "=1.0.1"
 lazy_static = "1.4"
 sodiumoxide = "0.2"
 hex = "0.4"
diff --git a/libcitadel/src/flatpak/bubblewrap.rs b/libcitadel/src/flatpak/bubblewrap.rs
new file mode 100644
index 0000000..8850918
--- /dev/null
+++ b/libcitadel/src/flatpak/bubblewrap.rs
@@ -0,0 +1,221 @@
+use std::ffi::OsStr;
+use std::{fs, io};
+use std::fs::File;
+use std::os::fd::AsRawFd;
+use std::os::unix::process::CommandExt;
+use std::path::Path;
+use std::process::Command;
+
+use crate::{Logger, LogLevel, Result, verbose};
+
+const BWRAP_PATH: &str = "/usr/libexec/flatpak-bwrap";
+
+pub struct BubbleWrap {
+    command: Command,
+}
+
+impl BubbleWrap {
+
+    pub fn new() -> Self {
+        BubbleWrap {
+            command: Command::new(BWRAP_PATH),
+        }
+    }
+
+    fn add_arg<S: AsRef<OsStr>>(&mut self, arg: S) -> &mut Self {
+        self.command.arg(arg);
+        self
+    }
+
+    fn add_args<S: AsRef<OsStr>>(&mut self, args: &[S]) -> &mut Self {
+        for arg in args {
+            self.add_arg(arg.as_ref());
+        }
+        self
+    }
+
+    pub fn ro_bind(&mut self, path_list: &[&str]) -> &mut Self {
+        for &path in path_list {
+            self.add_args(&["--ro-bind", path, path]);
+        }
+        self
+    }
+
+    pub fn ro_bind_to(&mut self, src: &str, dest: &str) -> &mut Self {
+        self.add_args(&["--ro-bind", src, dest])
+    }
+
+    pub fn bind_to(&mut self, src: &str, dest: &str) -> &mut Self {
+        self.add_args(&["--bind", src, dest])
+    }
+
+    pub fn create_dirs(&mut self, dir_list: &[&str]) -> &mut Self {
+        for &dir in dir_list {
+            self.add_args(&["--dir", dir]);
+        }
+        self
+    }
+
+    pub fn create_symlinks(&mut self, links: &[(&str, &str)]) -> &mut Self {
+        for (src,dest) in links {
+            self.add_args(&["--symlink", src, dest]);
+        }
+        self
+    }
+
+    pub fn mount_dev(&mut self) -> &mut Self {
+        self.add_args(&["--dev", "/dev"])
+    }
+
+    pub fn mount_proc(&mut self) -> &mut Self {
+        self.add_args(&["--proc", "/proc"])
+    }
+
+    pub fn dev_bind(&mut self, path: &str) -> &mut Self {
+        self.add_args(&["--dev-bind", path, path])
+    }
+
+    pub fn clear_env(&mut self) -> &mut Self {
+        self.add_arg("--clearenv")
+    }
+
+    pub fn set_env_list(&mut self, env_list: &[&str]) -> &mut Self {
+        for line in env_list {
+            if let Some((k,v)) = line.split_once("=") {
+                self.add_args(&["--setenv", k, v]);
+            } else {
+                eprintln!("Warning: environment variable '{}' does not have = delimiter. Ignoring", line);
+            }
+        }
+        self
+    }
+
+    pub fn unshare_all(&mut self) -> &mut Self {
+        self.add_arg("--unshare-all")
+    }
+
+    pub fn share_net(&mut self) -> &mut Self {
+        self.add_arg("--share-net")
+    }
+
+    pub fn log_command(&self) {
+        let mut buffer = String::new();
+        verbose!("{}", BWRAP_PATH);
+        for arg in self.command.get_args() {
+            if let Some(s) = arg.to_str() {
+                if s.starts_with("-") {
+                    if !buffer.is_empty() {
+                        verbose!("    {}", buffer);
+                        buffer.clear();
+                    }
+                }
+                if !buffer.is_empty() {
+                    buffer.push(' ');
+                }
+                buffer.push_str(s);
+            }
+        }
+        if !buffer.is_empty() {
+            verbose!("    {}", buffer);
+        }
+    }
+
+    pub fn status_file(&mut self, status_file: &File) -> &mut Self {
+        // Rust sets O_CLOEXEC when opening files so we create
+        // a new descriptor that will remain open across exec()
+        let dup_fd = unsafe {
+            libc::dup(status_file.as_raw_fd())
+        };
+        if dup_fd == -1 {
+            warn!("Failed to dup() status file descriptor: {}", io::Error::last_os_error());
+            warn!("Skipping --json-status-fd argument");
+            self
+        } else {
+            self.add_arg("--json-status-fd")
+                .add_arg(dup_fd.to_string())
+        }
+    }
+
+    pub fn launch<S: AsRef<OsStr>>(&mut self, cmd: &[S]) -> Result<()> {
+        if Logger::is_log_level(LogLevel::Verbose) {
+            self.log_command();
+            let s = cmd.iter().map(|s| format!("{} ", s.as_ref().to_str().unwrap())).collect::<String>();
+            verbose!("    {}", s)
+        }
+        self.add_args(cmd);
+        let err = self.command.exec();
+        bail!("failed to exec bubblewrap: {}", err);
+    }
+}
+
+#[derive(Deserialize,Clone)]
+#[serde(rename_all="kebab-case")]
+pub struct BubbleWrapRunningStatus {
+    pub child_pid: u64,
+    pub cgroup_namespace: u64,
+    pub ipc_namespace: u64,
+    pub mnt_namespace: u64,
+    pub pid_namespace: u64,
+    pub uts_namespace: u64,
+}
+
+#[derive(Deserialize,Clone)]
+#[serde(rename_all="kebab-case")]
+pub struct BubbleWrapExitStatus {
+    pub exit_code: u32,
+}
+
+#[derive(Clone)]
+pub struct BubbleWrapStatus {
+    running: BubbleWrapRunningStatus,
+    exit: Option<BubbleWrapExitStatus>,
+}
+
+impl BubbleWrapStatus {
+    pub fn parse_file(path: impl AsRef<Path>) -> Result<Option<Self>> {
+        if !path.as_ref().exists() {
+            return Ok(None)
+        }
+
+        let s = fs::read_to_string(path)
+            .map_err(context!("error reading status file"))?;
+
+        let mut lines = s.lines();
+        let running = match lines.next() {
+            None => return Ok(None),
+            Some(s) => serde_json::from_str::<BubbleWrapRunningStatus>(s)
+                .map_err(context!("failed to parse status line ({})", s))?
+        };
+
+        let exit = match lines.next() {
+            None => None,
+            Some(s) => Some(serde_json::from_str::<BubbleWrapExitStatus>(s)
+                .map_err(context!("failed to parse exit line ({})", s))?)
+        };
+
+        Ok(Some(BubbleWrapStatus {
+            running,
+            exit
+        }))
+    }
+
+    pub fn is_running(&self) -> bool {
+        self.exit.is_none()
+    }
+
+    pub fn running_status(&self) -> &BubbleWrapRunningStatus {
+        &self.running
+    }
+
+    pub fn child_pid(&self) -> u64 {
+        self.running.child_pid
+    }
+
+    pub fn pid_namespace(&self) -> u64 {
+        self.running.pid_namespace
+    }
+
+    pub fn exit_status(&self) -> Option<&BubbleWrapExitStatus> {
+        self.exit.as_ref()
+    }
+}
\ No newline at end of file
diff --git a/libcitadel/src/flatpak/launcher.rs b/libcitadel/src/flatpak/launcher.rs
new file mode 100644
index 0000000..0fa1719
--- /dev/null
+++ b/libcitadel/src/flatpak/launcher.rs
@@ -0,0 +1,259 @@
+use std::{fs, io};
+use std::fs::File;
+use std::os::unix::fs::FileTypeExt;
+use std::os::unix::prelude::CommandExt;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::{Realm, Result, util};
+use crate::flatpak::{BubbleWrap, BubbleWrapStatus, SANDBOX_STATUS_FILE_DIRECTORY, SandboxStatus};
+use crate::flatpak::netns::NetNS;
+
+
+const FLATPAK_PATH: &str = "/usr/bin/flatpak";
+
+const ENVIRONMENT: &[&str; 7] = &[
+    "HOME=/home/citadel",
+    "USER=citadel",
+    "XDG_RUNTIME_DIR=/run/user/1000",
+    "XDG_DATA_DIRS=/home/citadel/.local/share/flatpak/exports/share:/usr/share",
+    "TERM=xterm-256color",
+    "GTK_A11Y=none",
+    "FLATPAK_USER_DIR=/home/citadel/realm-flatpak",
+];
+
+const FLATHUB_URL: &str = "https://dl.flathub.org/repo/flathub.flatpakrepo";
+
+pub struct GnomeSoftwareLauncher {
+    realm: Realm,
+    status: Option<BubbleWrapStatus>,
+    netns: NetNS,
+    run_shell: bool,
+}
+impl GnomeSoftwareLauncher {
+
+    pub fn new(realm: Realm) -> Result<Self> {
+        let sandbox_status = SandboxStatus::load(SANDBOX_STATUS_FILE_DIRECTORY)?;
+        let status = sandbox_status.realm_status(&realm);
+        let netns = NetNS::new(NetNS::GS_NETNS_NAME);
+        Ok(GnomeSoftwareLauncher {
+            realm,
+            status,
+            netns,
+            run_shell: false,
+        })
+    }
+
+    pub fn set_run_shell(&mut self) {
+        self.run_shell = true;
+    }
+
+    fn ensure_flatpak_dir(&self) -> Result<()> {
+        let flatpak_user_dir = self.realm.base_path_file("flatpak");
+        if !flatpak_user_dir.exists() {
+            if let Err(err) = fs::create_dir(&flatpak_user_dir) {
+                bail!("failed to create realm flatpak directory ({}): {}", flatpak_user_dir.display(), err);
+            }
+            util::chown_user(&flatpak_user_dir)?;
+        }
+        Ok(())
+    }
+
+    fn add_flathub(&self) -> Result<()> {
+        let flatpak_user_dir = self.realm.base_path_file("flatpak");
+
+        match Command::new(FLATPAK_PATH)
+            .env("FLATPAK_USER_DIR", flatpak_user_dir)
+            .arg("remote-add")
+            .arg("--user")
+            .arg("--if-not-exists")
+            .arg("flathub")
+            .arg(FLATHUB_URL)
+            .status() {
+            Ok(status) => {
+                if status.success() {
+                    Ok(())
+
+                } else {
+                    bail!("failed to add flathub repo")
+                }
+            },
+            Err(err) =>  bail!("error running flatpak command: {}", err),
+        }
+    }
+
+    fn scan_tmp_directory(path: &Path) -> io::Result<Option<String>> {
+        for entry in fs::read_dir(&path)? {
+            let entry = entry?;
+            if entry.file_type()?.is_socket() {
+                if let Some(filename) = entry.path().file_name() {
+                    if let Some(filename) = filename.to_str() {
+                        if filename.starts_with("dbus-") {
+                            return Ok(Some(format!("/tmp/{}", filename)));
+                        }
+                    }
+                }
+            }
+        }
+        Ok(None)
+    }
+
+    fn find_dbus_socket(&self) -> Result<String> {
+        let pid = self.running_pid()?;
+        let tmp_dir = PathBuf::from(format!("/proc/{}/root/tmp", pid));
+        if !tmp_dir.is_dir() {
+            bail!("no /tmp directory found for process pid={}", pid);
+        }
+
+        if let Some(s) = Self::scan_tmp_directory(&tmp_dir)
+            .map_err(context!("error reading directory {}", tmp_dir.display()))? {
+            Ok(s)
+
+        } else {
+            bail!("no dbus socket found in /tmp directory for process pid={}", pid);
+        }
+    }
+
+    fn launch_sandbox(&self, status_file: &File) -> Result<()> {
+        self.ensure_flatpak_dir()?;
+        if let Err(err) = self.netns.nsenter() {
+            bail!("Failed to enter 'gnome-software' network namespace: {}", err);
+        }
+        verbose!("Entered network namespace ({})", NetNS::GS_NETNS_NAME);
+
+        if let Err(err) = util::drop_privileges(1000, 1000) {
+            bail!("Failed to drop privileges to uid = gid = 1000: {}", err);
+        }
+        verbose!("Dropped privileges (uid=1000, gid=1000)");
+
+        self.add_flathub()?;
+        let flatpak_user_dir = self.realm.base_path_file("flatpak");
+        let flatpak_user_dir = flatpak_user_dir.to_str().unwrap();
+
+        let cmd = if self.run_shell { "/usr/bin/bash" } else { "/usr/bin/gnome-software"};
+        verbose!("Running command in sandbox: {}", cmd);
+
+        BubbleWrap::new()
+            .ro_bind(&[
+                "/usr/bin",
+                "/usr/lib",
+                "/usr/libexec",
+                "/usr/share/dbus-1",
+                "/usr/share/icons",
+                "/usr/share/mime",
+                "/usr/share/X11",
+                "/usr/share/glib-2.0",
+                "/usr/share/xml",
+                "/usr/share/drirc.d",
+                "/usr/share/fontconfig",
+                "/usr/share/fonts",
+                "/usr/share/zoneinfo",
+                "/usr/share/swcatalog",
+
+                "/etc/passwd",
+                "/etc/machine-id",
+                "/etc/nsswitch.conf",
+                "/etc/fonts",
+                "/etc/ssl",
+                "/sys/dev/char", "/sys/devices",
+                "/run/user/1000/wayland-0",
+            ])
+            .ro_bind_to("/run/NetworkManager/resolv.conf", "/etc/resolv.conf")
+            .bind_to(flatpak_user_dir, "/home/citadel/realm-flatpak")
+            .create_symlinks(&[
+                ("usr/lib", "/lib64"),
+                ("usr/bin", "/bin"),
+                ("/tmp", "/var/tmp"),
+            ])
+            .create_dirs(&[
+                "/var/lib/flatpak",
+                "/home/citadel",
+                "/tmp",
+                "/sys/block", "/sys/bus", "/sys/class",
+            ])
+
+
+            .mount_dev()
+            .dev_bind("/dev/dri")
+            .mount_proc()
+            .unshare_all()
+            .share_net()
+
+            .clear_env()
+            .set_env_list(ENVIRONMENT)
+
+            .status_file(status_file)
+
+            .launch(&["dbus-run-session", "--", cmd])?;
+        Ok(())
+    }
+
+    pub fn new_realm_status_file(&self) -> Result<File> {
+        let path = Path::new(SANDBOX_STATUS_FILE_DIRECTORY).join(self.realm.name());
+        File::create(&path)
+            .map_err(context!("failed to open sandbox status file {}", path.display()))
+    }
+
+    pub fn launch(&self) -> Result<()> {
+        self.netns.ensure_exists()?;
+        if self.is_running() {
+            let cmd = if self.run_shell { "/usr/bin/bash" } else { "/usr/bin/gnome-software"};
+            self.launch_in_running_sandbox(&[cmd])?;
+        } else {
+            let status_file = self.new_realm_status_file()?;
+            self.ensure_flatpak_dir()?;
+            self.launch_sandbox(&status_file)?;
+        }
+        Ok(())
+    }
+
+    pub fn quit(&self) -> Result<()> {
+        if self.is_running() {
+            self.launch_in_running_sandbox(&["/usr/bin/gnome-software", "--quit"])?;
+        } else {
+            warn!("No running sandbox found for realm {}", self.realm.name());
+        }
+        Ok(())
+    }
+
+    pub fn is_running(&self) -> bool {
+        self.status.as_ref()
+            .map(|s| s.is_running())
+            .unwrap_or(false)
+    }
+
+    fn running_pid(&self) -> Result<u64> {
+        self.status.as_ref()
+            .map(|s| s.child_pid())
+            .ok_or(format_err!("no sandbox status available for realm '{}',", self.realm.name()))
+    }
+
+    fn dbus_session_address(&self) -> Result<String> {
+        let dbus_socket = Self::find_dbus_socket(&self)?;
+        Ok(format!("unix:path={}", dbus_socket))
+    }
+
+    fn launch_in_running_sandbox(&self, command: &[&str]) -> Result<()> {
+        let dbus_address = self.dbus_session_address()?;
+
+        let pid = self.running_pid()?.to_string();
+        let mut env = ENVIRONMENT.iter()
+            .map(|s| s.split_once('=').unwrap())
+            .collect::<Vec<_>>();
+        env.push(("DBUS_SESSION_BUS_ADDRESS", dbus_address.as_str()));
+
+        let err = Command::new("/usr/bin/nsenter")
+            .env_clear()
+            .envs( env )
+            .args(&[
+                "--all",
+                "--target", pid.as_str(),
+                "--setuid", "1000",
+                "--setgid", "1000",
+            ])
+            .args(command)
+            .exec();
+
+        Err(format_err!("failed to execute nsenter: {}", err))
+    }
+}
\ No newline at end of file
diff --git a/libcitadel/src/flatpak/mod.rs b/libcitadel/src/flatpak/mod.rs
new file mode 100644
index 0000000..fd55774
--- /dev/null
+++ b/libcitadel/src/flatpak/mod.rs
@@ -0,0 +1,16 @@
+
+pub(crate) mod setup;
+pub(crate) mod status;
+
+pub(crate) mod bubblewrap;
+
+pub(crate) mod launcher;
+
+pub(crate) mod netns;
+
+pub use status::SandboxStatus;
+
+pub use bubblewrap::{BubbleWrap,BubbleWrapStatus,BubbleWrapRunningStatus,BubbleWrapExitStatus};
+pub use launcher::GnomeSoftwareLauncher;
+
+pub const SANDBOX_STATUS_FILE_DIRECTORY: &str = "/run/citadel/realms/gs-sandbox-status";
diff --git a/libcitadel/src/flatpak/netns.rs b/libcitadel/src/flatpak/netns.rs
new file mode 100644
index 0000000..4488c1c
--- /dev/null
+++ b/libcitadel/src/flatpak/netns.rs
@@ -0,0 +1,132 @@
+use std::ffi::OsStr;
+use std::path::Path;
+use std::process::Command;
+
+use crate::{util,Result};
+
+
+const BRIDGE_NAME: &str = "vz-clear";
+const VETH0: &str = "gs-veth0";
+const VETH1: &str = "gs-veth1";
+const IP_ADDRESS: &str = "172.17.0.222/24";
+const GW_ADDRESS: &str = "172.17.0.1";
+
+
+pub struct NetNS {
+    name: String,
+}
+
+impl NetNS {
+    pub const GS_NETNS_NAME: &'static str = "gnome-software";
+    pub fn new(name: &str) -> Self {
+        NetNS {
+            name: name.to_string(),
+        }
+    }
+
+    fn create(&self) -> crate::Result<()> {
+        Ip::new().link_add_veth(VETH0, VETH1).run()?;
+        Ip::new().link_set_netns(VETH0, &self.name).run()?;
+        Ip::new().link_set_master(VETH1, BRIDGE_NAME).run()?;
+        Ip::new().link_set_dev_up(VETH1).run()?;
+
+        Ip::new().ip_netns_exec_ip(&self.name).addr_add(IP_ADDRESS, VETH0).run()?;
+        Ip::new().ip_netns_exec_ip(&self.name).link_set_dev_up(VETH0).run()?;
+        Ip::new().ip_netns_exec_ip(&self.name).route_add_default(GW_ADDRESS).run()?;
+
+        Ok(())
+    }
+    pub fn ensure_exists(&self) -> Result<()> {
+        if Path::new(&format!("/run/netns/{}", self.name)).exists() {
+            verbose!("Network namespace ({}) exists", self.name);
+            return Ok(())
+        }
+        verbose!("Setting up network namespace ({})", self.name);
+
+        Ip::new().netns_add(&self.name).run()
+            .map_err(context!("Failed to add network namespace '{}'", self.name))?;
+
+        if let Err(err) = self.create() {
+            Ip::new().netns_delete(&self.name).run()?;
+            Err(err)
+        } else {
+            Ok(())
+        }
+    }
+
+    pub fn nsenter(&self) -> Result<()> {
+        util::nsenter_netns(&self.name)
+    }
+}
+const IP_PATH: &str = "/usr/sbin/ip";
+struct Ip {
+    command: Command,
+}
+
+impl Ip {
+
+    fn new() -> Self {
+        let mut command = Command::new(IP_PATH);
+        command.env_clear();
+        Ip { command }
+    }
+
+    fn add_args<S: AsRef<OsStr>>(&mut self, args: &[S]) -> &mut Self {
+        for arg in args {
+            self.command.arg(arg);
+        }
+        self
+    }
+
+    pub fn netns_add(&mut self, name: &str) -> &mut Self {
+        self.add_args(&["netns", "add", name])
+    }
+
+    pub fn netns_delete(&mut self, name: &str) -> &mut Self {
+        self.add_args(&["netns", "delete", name])
+    }
+
+    pub fn link_add_veth(&mut self, name: &str, peer_name: &str) -> &mut Self {
+        self.add_args(&["link", "add", name, "type", "veth", "peer", "name", peer_name])
+    }
+
+    pub fn link_set_netns(&mut self, iface: &str, netns_name: &str) -> &mut Self {
+        self.add_args(&["link", "set", iface, "netns", netns_name])
+    }
+
+    pub fn link_set_master(&mut self, iface: &str, bridge_name: &str) -> &mut Self {
+        self.add_args(&["link", "set", iface, "master", bridge_name])
+    }
+
+    pub fn link_set_dev_up(&mut self, iface: &str) -> &mut Self {
+        self.add_args(&["link", "set", "dev", iface, "up"])
+    }
+
+    pub fn ip_netns_exec_ip(&mut self, netns_name: &str) -> &mut Self {
+        self.add_args(&["netns", "exec", netns_name, IP_PATH])
+    }
+
+    pub fn addr_add(&mut self, ip_address: &str, dev: &str) -> &mut Self {
+        self.add_args(&["addr", "add", ip_address, "dev", dev])
+    }
+
+    pub fn route_add_default(&mut self, gateway: &str) -> &mut Self {
+        self.add_args(&["route", "add", "default", "via", gateway])
+    }
+
+    fn run(&mut self) -> crate::Result<()> {
+        verbose!("{:?}", self.command);
+        match self.command.status() {
+            Ok(status) => {
+                if status.success() {
+                    Ok(())
+                } else {
+                    bail!("IP command ({:?}) did not succeeed.", self.command);
+                }
+            }
+            Err(err) => {
+                bail!("error running ip command ({:?}): {}", self.command, err);
+            }
+        }
+    }
+}
diff --git a/libcitadel/src/flatpak/setup.rs b/libcitadel/src/flatpak/setup.rs
new file mode 100644
index 0000000..a1385f3
--- /dev/null
+++ b/libcitadel/src/flatpak/setup.rs
@@ -0,0 +1,58 @@
+use std::path::Path;
+use crate::{Realm, Result, util};
+
+const GNOME_SOFTWARE_DESKTOP_TEMPLATE: &str = "\
+[Desktop Entry]
+Name=Software
+Comment=Add, remove or update software on this computer
+Icon=org.gnome.Software
+Exec=/usr/libexec/launch-gnome-software --realm $REALM_NAME
+Terminal=false
+Type=Application
+Categories=GNOME;GTK;System;PackageManager;
+Keywords=Updates;Upgrade;Sources;Repositories;Preferences;Install;Uninstall;Program;Software;App;Store;
+StartupNotify=true
+";
+
+const APPLICATION_DIRECTORY: &str = "/home/citadel/.local/share/applications";
+
+pub struct FlatpakSetup<'a> {
+    realm: &'a Realm,
+}
+
+impl <'a> FlatpakSetup<'a> {
+
+    pub fn new(realm: &'a Realm) -> Self {
+        Self { realm }
+    }
+
+    pub fn setup(&self) -> Result<()> {
+        self.write_desktop_file()?;
+        self.ensure_flatpak_directory()?;
+        Ok(())
+    }
+
+
+    fn write_desktop_file(&self) -> Result<()> {
+        let appdir = Path::new(APPLICATION_DIRECTORY);
+        if !appdir.exists() {
+            util::create_dir(appdir)?;
+            if let Some(parent) = appdir.parent().and_then(|p| p.parent()) {
+                util::chown_tree(parent, (1000,1000), true)?;
+            }
+        }
+        let path = appdir.join(format!("realm-{}.org.gnome.Software.desktop", self.realm.name()));
+        util::write_file(path, GNOME_SOFTWARE_DESKTOP_TEMPLATE.replace("$REALM_NAME", self.realm.name()))?;
+        Ok(())
+    }
+
+    fn ensure_flatpak_directory(&self) -> Result<()> {
+        let path = self.realm.base_path_file("flatpak");
+        if !path.exists() {
+            util::create_dir(&path)?;
+            util::chown_user(&path)?;
+        }
+        Ok(())
+    }
+
+}
diff --git a/libcitadel/src/flatpak/status.rs b/libcitadel/src/flatpak/status.rs
new file mode 100644
index 0000000..4633f3e
--- /dev/null
+++ b/libcitadel/src/flatpak/status.rs
@@ -0,0 +1,144 @@
+use std::collections::HashMap;
+use std::fs::File;
+use std::path::{Path, PathBuf};
+use std::time::SystemTime;
+use crate::flatpak::bubblewrap::BubbleWrapStatus;
+use crate::{Realm, Result, util};
+
+
+/// Utility function to read modified time from a path.
+fn modified_time(path: &Path) -> Result<SystemTime> {
+    path.metadata().and_then(|meta| meta.modified())
+        .map_err(context!("failed to read modified time from '{}'", path.display()))
+}
+
+/// Utility function to detect if current modified time of a path
+/// matches an earlier recorded modified time.
+fn modified_changed(path: &Path, old_modified: SystemTime) -> bool {
+    if !path.exists() {
+        // Path existed at some earlier point, so something changed
+        return true;
+    }
+
+    match modified_time(path) {
+        Ok(modified) => old_modified != modified,
+        Err(err) => {
+            // Print a warning but assume change
+            warn!("{}", err);
+            true
+        },
+    }
+}
+
+/// Records the content of single entry in a sandbox status directory.
+///
+/// The path to the status file as well as the last modified time are
+/// recorded so that changes in status of a sandbox can be detected.
+struct StatusEntry {
+    status: BubbleWrapStatus,
+    path: PathBuf,
+    modified: SystemTime,
+}
+
+
+impl StatusEntry {
+
+    fn load_timestamp_and_status(path: &Path) -> Result<Option<(SystemTime, BubbleWrapStatus)>> {
+        if path.exists() {
+            let modified = modified_time(path)?;
+            if let Some(status) = BubbleWrapStatus::parse_file(path)? {
+                return Ok(Some((modified, status)));
+            }
+        }
+        Ok(None)
+    }
+
+    fn load(base_dir: &Path, name: &str) -> Result<Option<Self>> {
+        let path = base_dir.join(name);
+        let result = StatusEntry::load_timestamp_and_status(&path)?
+            .map(|(modified, status)| StatusEntry { status, path, modified });
+        Ok(result)
+    }
+
+    fn is_modified(&self) -> bool {
+        modified_changed(&self.path, self.modified)
+    }
+}
+
+
+/// Holds information about entries in a sandbox status directory.
+///
+/// Bubblewrap accepts a command line argument that asks for status
+/// information to be written as a json structure to a file descriptor.
+///
+pub struct SandboxStatus {
+    base_dir: PathBuf,
+    base_modified: SystemTime,
+    entries: HashMap<String, StatusEntry>,
+}
+
+impl SandboxStatus {
+
+    pub fn need_reload(&self) -> bool {
+        if modified_changed(&self.base_dir, self.base_modified) {
+            return true;
+        }
+        self.entries.values().any(|entry| entry.is_modified())
+    }
+
+    fn process_dir_entry(&mut self, dir_entry: PathBuf) -> Result<()> {
+        fn realm_name_for_path(path: &Path) -> Option<&str> {
+            path.file_name()
+                .and_then(|name| name.to_str())
+                .filter(|name| Realm::is_valid_name(name))
+
+        }
+        if dir_entry.is_file() {
+            if let Some(name) = realm_name_for_path(&dir_entry) {
+                if let Some(entry) = StatusEntry::load(&self.base_dir, name)? {
+                    self.entries.insert(name.to_string(), entry);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    pub fn reload(&mut self) -> Result<()> {
+        self.entries.clear();
+        self.base_modified = modified_time(&self.base_dir)?;
+        let base_dir = self.base_dir.clone();
+        util::read_directory(&base_dir, |entry| {
+            self.process_dir_entry(entry.path())
+        })
+    }
+
+    fn new(base_dir: &Path) -> Result<Self> {
+        let base_dir = base_dir.to_owned();
+        let base_modified = modified_time(&base_dir)?;
+        Ok(SandboxStatus {
+            base_dir,
+            base_modified,
+            entries: HashMap::new(),
+        })
+    }
+
+    pub fn load(directory: impl AsRef<Path>) -> Result<SandboxStatus> {
+        let base_dir = directory.as_ref();
+        if !base_dir.exists() {
+            util::create_dir(base_dir)?;
+        }
+        let mut status = SandboxStatus::new(base_dir)?;
+        status.reload()?;
+        Ok(status)
+    }
+
+    pub fn realm_status(&self, realm: &Realm) -> Option<BubbleWrapStatus> {
+        self.entries.get(realm.name()).map(|entry| entry.status.clone())
+    }
+
+    pub fn new_realm_status_file(&self, realm: &Realm) -> Result<File> {
+        let path = self.base_dir.join(realm.name());
+        File::create(&path)
+            .map_err(context!("failed to open sandbox status file {}", path.display()))
+    }
+}
\ No newline at end of file
diff --git a/libcitadel/src/lib.rs b/libcitadel/src/lib.rs
index 2c90f2f..23849e8 100644
--- a/libcitadel/src/lib.rs
+++ b/libcitadel/src/lib.rs
@@ -21,6 +21,8 @@ mod realm;
 pub mod terminal;
 mod system;
 
+pub mod flatpak;
+
 pub use crate::config::OsRelease;
 pub use crate::blockdev::BlockDev;
 pub use crate::cmdline::CommandLine;
diff --git a/libcitadel/src/log.rs b/libcitadel/src/log.rs
index 4d72819..d9dc8ed 100644
--- a/libcitadel/src/log.rs
+++ b/libcitadel/src/log.rs
@@ -62,6 +62,11 @@ impl Logger {
         logger.level = level;
     }
 
+    pub fn is_log_level(level: LogLevel) -> bool {
+        let logger = LOGGER.lock().unwrap();
+        logger.level >= level
+    }
+
     pub fn set_log_output(output: Box<dyn LogOutput>) {
         let mut logger = LOGGER.lock().unwrap();
         logger.output = output;
diff --git a/libcitadel/src/realm/config.rs b/libcitadel/src/realm/config.rs
index d069f9e..2a3df0c 100644
--- a/libcitadel/src/realm/config.rs
+++ b/libcitadel/src/realm/config.rs
@@ -77,6 +77,9 @@ pub struct RealmConfig {
     #[serde(rename="use-fuse")]
     pub use_fuse: Option<bool>,
 
+    #[serde(rename="use-flatpak")]
+    pub use_flatpak: Option<bool>,
+
     #[serde(rename="use-gpu")]
     pub use_gpu: Option<bool>,
 
@@ -201,6 +204,7 @@ impl RealmConfig {
             wayland_socket: Some("wayland-0".to_string()),
             use_kvm: Some(false),
             use_fuse: Some(false),
+            use_flatpak: Some(false),
             use_gpu: Some(false),
             use_gpu_card0: Some(false),
             use_network: Some(true),
@@ -233,6 +237,7 @@ impl RealmConfig {
             wayland_socket: None,
             use_kvm: None,
             use_fuse: None,
+            use_flatpak: None,
             use_gpu: None,
             use_gpu_card0: None,
             use_network: None,
@@ -267,6 +272,14 @@ impl RealmConfig {
         self.bool_value(|c| c.use_fuse)
     }
 
+    /// If `true` flatpak directory will be mounted into realm
+    /// and a desktop file will be created to launch gnome-software
+    ///
+    pub fn flatpak(&self) -> bool {
+        self.bool_value(|c| c.use_flatpak)
+    }
+
+
     /// If `true` render node device /dev/dri/renderD128 will be added to realm.
     ///
     /// This enables hardware graphics acceleration in realm.
diff --git a/libcitadel/src/realm/launcher.rs b/libcitadel/src/realm/launcher.rs
index ea4383c..3eaffe7 100644
--- a/libcitadel/src/realm/launcher.rs
+++ b/libcitadel/src/realm/launcher.rs
@@ -60,7 +60,7 @@ impl <'a> RealmLauncher <'a> {
         if config.kvm() {
             self.add_device("/dev/kvm");
         }
-        if config.fuse() {
+        if config.fuse() || config.flatpak() {
             self.add_device("/dev/fuse");
         }
 
@@ -153,6 +153,10 @@ impl <'a> RealmLauncher <'a> {
             writeln!(s, "BindReadOnly=/run/user/1000/{}:/run/user/host/wayland-0", config.wayland_socket())?;
         }
 
+        if config.flatpak() {
+            writeln!(s, "BindReadOnly={}:/var/lib/flatpak", self.realm.base_path_file("flatpak").display())?;
+        }
+
         for bind in config.extra_bindmounts() {
             if Self::is_valid_bind_item(bind) {
                 writeln!(s, "Bind={}", bind)?;
diff --git a/libcitadel/src/realm/manager.rs b/libcitadel/src/realm/manager.rs
index cabc1bd..54e77cb 100644
--- a/libcitadel/src/realm/manager.rs
+++ b/libcitadel/src/realm/manager.rs
@@ -4,6 +4,8 @@ use std::sync::{Arc, RwLock, RwLockReadGuard, RwLockWriteGuard};
 use posix_acl::{ACL_EXECUTE, ACL_READ, PosixACL, Qualifier};
 
 use crate::{Mountpoint, Result, Realms, RealmFS, Realm, util};
+use crate::flatpak::GnomeSoftwareLauncher;
+use crate::flatpak::setup::FlatpakSetup;
 use crate::realm::pidmapper::{PidLookupResult, PidMapper};
 use crate::realmfs::realmfs_set::RealmFSSet;
 
@@ -21,6 +23,7 @@ struct Inner {
     events: RealmEventListener,
     realms: Realms,
     realmfs_set: RealmFSSet,
+    pid_mapper: PidMapper,
 }
 
 impl Inner {
@@ -28,7 +31,8 @@ impl Inner {
         let events = RealmEventListener::new();
         let realms = Realms::load()?;
         let realmfs_set = RealmFSSet::load()?;
-        Ok(Inner { events, realms, realmfs_set })
+        let pid_mapper = PidMapper::new()?;
+        Ok(Inner { events, realms, realmfs_set, pid_mapper })
     }
 }
 
@@ -230,6 +234,10 @@ impl RealmManager {
             self.ensure_run_media_directory()?;
         }
 
+        if realm.config().flatpak() {
+            FlatpakSetup::new(realm).setup()?;
+        }
+
         self.systemd.start_realm(realm, &rootfs)?;
 
         self.create_realm_namefile(realm)?;
@@ -268,6 +276,15 @@ impl RealmManager {
         self.run_in_realm(realm, &["/usr/bin/ln", "-s", "/run/user/host/wayland-0", "/run/user/1000/wayland-0"], false)
     }
 
+    fn stop_gnome_software_sandbox(&self, realm: &Realm) -> Result<()> {
+        let launcher = GnomeSoftwareLauncher::new(realm.clone())?;
+        if launcher.is_running() {
+            info!("Stopping GNOME Software sandbox for {}", realm.name());
+            launcher.quit()?;
+        }
+        Ok(())
+    }
+
     pub fn stop_realm(&self, realm: &Realm) -> Result<()> {
         if !realm.is_active() {
             info!("ignoring stop request on realm '{}' which is not running", realm.name());
@@ -276,6 +293,12 @@ impl RealmManager {
 
         info!("Stopping realm {}", realm.name());
 
+        if realm.config().flatpak() {
+            if let Err(err) = self.stop_gnome_software_sandbox(realm) {
+                warn!("Error stopping GNOME Software sandbox: {}", err);
+            }
+        }
+
         realm.set_active(false);
         self.systemd.stop_realm(realm)?;
         realm.cleanup_rootfs();
@@ -335,8 +358,8 @@ impl RealmManager {
     }
 
     pub fn realm_by_pid(&self, pid: u32) -> PidLookupResult {
-        let mapper = PidMapper::new(self.active_realms(false));
-        mapper.lookup_pid(pid as libc::pid_t)
+        let realms = self.realm_list();
+        self.inner_mut().pid_mapper.lookup_pid(pid as libc::pid_t, realms)
     }
 
     pub fn rescan_realms(&self) -> Result<(Vec<Realm>,Vec<Realm>)> {
diff --git a/libcitadel/src/realm/pidmapper.rs b/libcitadel/src/realm/pidmapper.rs
index e50471a..cea0a51 100644
--- a/libcitadel/src/realm/pidmapper.rs
+++ b/libcitadel/src/realm/pidmapper.rs
@@ -1,6 +1,7 @@
 use std::ffi::OsStr;
 use procfs::process::Process;
-use crate::Realm;
+use crate::{Result, Realm};
+use crate::flatpak::{SANDBOX_STATUS_FILE_DIRECTORY, SandboxStatus};
 
 pub enum PidLookupResult {
     Unknown,
@@ -9,14 +10,15 @@ pub enum PidLookupResult {
 }
 
 pub struct PidMapper {
-    active_realms: Vec<Realm>,
+    sandbox_status: SandboxStatus,
     my_pid_ns_id: Option<u64>,
 }
 
 impl PidMapper {
-    pub fn new(active_realms: Vec<Realm>) -> Self {
+    pub fn new() -> Result<Self> {
+        let sandbox_status = SandboxStatus::load(SANDBOX_STATUS_FILE_DIRECTORY)?;
         let my_pid_ns_id = Self::self_pid_namespace_id();
-        PidMapper { active_realms, my_pid_ns_id }
+        Ok(PidMapper { sandbox_status, my_pid_ns_id })
     }
 
     fn read_process(pid: libc::pid_t) -> Option<Process> {
@@ -72,7 +74,30 @@ impl PidMapper {
         Self::read_process(ppid)
     }
 
-    pub fn lookup_pid(&self, pid: libc::pid_t) -> PidLookupResult {
+    fn refresh_sandbox_status(&mut self) -> Result<()> {
+        if self.sandbox_status.need_reload() {
+            self.sandbox_status.reload()?;
+        }
+        Ok(())
+    }
+
+    fn search_sandbox_realms(&mut self, pid_ns: u64, realms: &[Realm]) -> Option<Realm> {
+        if let Err(err) = self.refresh_sandbox_status() {
+            warn!("error reloading sandbox status directory: {}", err);
+            return None;
+        }
+
+        for r in realms {
+            if let Some(status) = self.sandbox_status.realm_status(r) {
+                if status.pid_namespace() == pid_ns {
+                    return Some(r.clone())
+                }
+            }
+        }
+        None
+    }
+
+    pub fn lookup_pid(&mut self, pid: libc::pid_t, realms: Vec<Realm>) -> PidLookupResult {
         const MAX_PARENT_SEARCH: i32 = 8;
         let mut n = 0;
 
@@ -92,13 +117,17 @@ impl PidMapper {
                 return PidLookupResult::Citadel;
             }
 
-            if let Some(realm) = self.active_realms.iter()
-                .find(|r| r.has_pid_ns(pid_ns_id))
+            if let Some(realm) = realms.iter()
+                .find(|r| r.is_active() && r.has_pid_ns(pid_ns_id))
                 .cloned()
             {
                 return PidLookupResult::Realm(realm)
             }
 
+            if let Some(r) = self.search_sandbox_realms(pid_ns_id, &realms) {
+                return PidLookupResult::Realm(r)
+            }
+
             proc = match Self::parent_process(proc) {
                 Some(proc) => proc,
                 None => return PidLookupResult::Unknown,
@@ -108,5 +137,4 @@ impl PidMapper {
         }
         PidLookupResult::Unknown
     }
-
 }
diff --git a/libcitadel/src/realm/realm.rs b/libcitadel/src/realm/realm.rs
index 7dbcbb4..2f7f048 100644
--- a/libcitadel/src/realm/realm.rs
+++ b/libcitadel/src/realm/realm.rs
@@ -279,6 +279,9 @@ impl Realm {
         symlink::write(&rootfs, self.rootfs_symlink(), false)?;
         symlink::write(mountpoint.path(), self.realmfs_mountpoint_symlink(), false)?;
         symlink::write(self.base_path().join("home"), self.run_path().join("home"), false)?;
+        if self.config().flatpak() {
+            symlink::write(self.base_path().join("flatpak"), self.run_path().join("flatpak"), false)?;
+        }
 
         Ok(rootfs)
     }
@@ -300,6 +303,9 @@ impl Realm {
         Self::remove_symlink(self.realmfs_mountpoint_symlink());
         Self::remove_symlink(self.rootfs_symlink());
         Self::remove_symlink(self.run_path().join("home"));
+        if self.config().flatpak() {
+            Self::remove_symlink(self.run_path().join("flatpak"));
+        }
 
         if let Err(e) = fs::remove_dir(self.run_path()) {
             warn!("failed to remove run directory {}: {}", self.run_path().display(), e);
diff --git a/libcitadel/src/realm/systemd.rs b/libcitadel/src/realm/systemd.rs
index d479748..23f720e 100644
--- a/libcitadel/src/realm/systemd.rs
+++ b/libcitadel/src/realm/systemd.rs
@@ -31,6 +31,28 @@ impl Systemd {
         if realm.config().ephemeral_home() {
             self.setup_ephemeral_home(realm)?;
         }
+        if realm.config().flatpak() {
+            self.setup_flatpak_workaround(realm)?;
+        }
+        Ok(())
+    }
+
+    // What even is this??
+    //
+    // Good question.
+    //
+    // https://bugzilla.redhat.com/show_bug.cgi?id=2210335#c10
+    //
+    fn setup_flatpak_workaround(&self, realm: &Realm) -> Result<()> {
+        let commands = &[
+            vec!["/usr/bin/mount", "-m", "-t","proc", "proc", "/run/flatpak-workaround/proc"],
+            vec!["/usr/bin/chmod", "700", "/run/flatpak-workaround"],
+        ];
+
+        for cmd in commands {
+            Self::machinectl_shell(realm, cmd, "root", false, true)?;
+        }
+
         Ok(())
     }
 
diff --git a/libcitadel/src/util.rs b/libcitadel/src/util.rs
index e12f2f9..7f11aeb 100644
--- a/libcitadel/src/util.rs
+++ b/libcitadel/src/util.rs
@@ -7,6 +7,7 @@ use std::env;
 use std::fs::{self, File, DirEntry};
 use std::ffi::CString;
 use std::io::{self, Seek, Read, BufReader, SeekFrom};
+use std::os::fd::AsRawFd;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use walkdir::WalkDir;
@@ -217,7 +218,8 @@ where
 ///
 pub fn remove_file(path: impl AsRef<Path>) -> Result<()> {
     let path = path.as_ref();
-    if path.exists() {
+    let is_symlink = fs::symlink_metadata(path).is_ok();
+    if is_symlink || path.exists() {
         fs::remove_file(path)
             .map_err(context!("failed to remove file {:?}", path))?;
     }
@@ -368,9 +370,38 @@ pub fn touch_mtime(path: &Path) -> Result<()> {
 
     utimes(path, meta.atime(),mtime)?;
     Ok(())
-
-
-
-
-
 }
+
+pub fn nsenter_netns(netns: &str) -> Result<()> {
+    let mut path = PathBuf::from("/run/netns");
+    path.push(netns);
+    if !path.exists() {
+        bail!("Network namespace '{}' does not exist", netns);
+    }
+    let f = File::open(&path)
+        .map_err(context!("error opening netns file {}", path.display()))?;
+
+    let fd = f.as_raw_fd();
+
+    unsafe {
+        if libc::setns(fd, libc::CLONE_NEWNET) == -1 {
+            let err = io::Error::last_os_error();
+            bail!("failed to setns() into network namespace '{}': {}", netns, err);
+        }
+    }
+    Ok(())
+}
+
+pub fn drop_privileges(uid: u32, gid: u32) -> Result<()> {
+    unsafe {
+        if libc::setgid(gid) == -1 {
+            let err = io::Error::last_os_error();
+            bail!("failed to call setgid({}): {}", gid, err);
+
+        } else if libc::setuid(uid) == -1 {
+            let err = io::Error::last_os_error();
+            bail!("failed to call setuid({}): {}", uid, err);
+        }
+    }
+    Ok(())
+}
\ No newline at end of file
diff --git a/systemd/citadel-desktop-watcher.path b/systemd/citadel-desktop-watcher.path
index 4b5fcd4..3c790d9 100644
--- a/systemd/citadel-desktop-watcher.path
+++ b/systemd/citadel-desktop-watcher.path
@@ -4,6 +4,6 @@ StartLimitIntervalSec=0
 
 [Path]
 PathChanged=/run/citadel/realms/current/current.realm/rootfs/usr/share/applications
-PathChanged=/run/citadel/realms/current/current.realm/rootfs/var/lib/flatpak/exports/share/applications
+PathChanged=/run/citadel/realms/current/current.realm/flatpak/exports/share/applications
 PathChanged=/run/citadel/realms/current/current.realm/home/.local/share/applications
 PathChanged=/run/citadel/realms/current/current.realm/home/.local/share/flatpak/exports/share/applications