EOS Todo production candidate. Requires Linux x64, glibc, GTK4 and WebKitGTK 6.0 (Ubuntu 24.04+).
Install dependencies: sudo apt install libgtk-4-1 libwebkitgtk-6.0-4
Run ./install-user.sh, then launch from the application menu. Data is retained on upgrades.
Menu icon: ~/.local/share/eos-todo/eos-todo.png (absolute Icon= path, not the icon theme).
Sized copies are also installed under ~/.local/share/icons/hicolor at 48/128/256/512.
A failed gtk-update-icon-cache on that shared theme does not remove the menu icon.
If the window fails to appear under Wayland, try: WEBKIT_DISABLE_COMPOSITING_MODE=1

Ubuntu 24.04 user namespaces
----------------------------

kernel.apparmor_restrict_unprivileged_userns = 1

WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1

EOS Todo sets it only when that sysctl is 1 and a user namespace cannot be
created (`bwrap --ro-bind / / true`, or `unshare -Ur true` if bwrap is
absent). The desktop Exec line is updated the same way. install-user.sh and
in-app updates regenerate the .desktop file from a template; after writing
it they must run:

On Ubuntu 24.04 the sandbox failure happens first. Fix that before judging
compositing.

A user install does not need root. An administrator can instead allow user
namespaces for this executable with an AppArmor profile (userns permission
only), or turn the restriction off:

sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

When bubblewrap can create a user namespace again, EOS Todo leaves the
sandbox enabled.
