fix gateway restart for hermes

updates.d/72-sandbox.sh

@@ -3,9 +3,18 @@
 COREDESKTOP="$HOME/.local/share/coredesktop"
 
 run_update() {
-  local status=0
+  local status=0 gateway=0
   bash "$COREDESKTOP/sandbox/setup.sh" || status=1
 
+  # Hermes update asks a running gateway to finish its work and restart, but
+  # that signal (SIGUSR1) reaches srt, not the gateway inside its sandbox, so
+  # the update would wait half an hour. Stop the gateway for the update instead;
+  # starting it afterwards also loads new sandbox rules and dependencies.
+  if systemctl --user is-active --quiet hermes-gateway.service; then
+    gateway=1
+    systemctl --user stop hermes-gateway.service || status=1
+  fi
+
   # The real command, not the sandboxed one in sandbox/bin: updating Hermes
   # writes outside what its sandbox allows
   if [ -x "$HOME/.local/bin/hermes" ]; then
@@ -13,11 +22,9 @@ run_update() {
     "$HOME/.local/bin/hermes" update < /dev/null || status=1
   fi
 
-  # The gateway reads its sandbox rules and loads new dependencies only when it
-  # starts, and Hermes restarts it only for new code
-  if systemctl --user is-active --quiet hermes-gateway.service; then
-    echo "Restarting Hermes' gateway..."
-    systemctl --user restart hermes-gateway.service || status=1
+  if [ "$gateway" = 1 ]; then
+    echo "Starting Hermes' gateway..."
+    systemctl --user start hermes-gateway.service || status=1
   fi
   return $status
 }