0launch 0.42

A new release of Zero Install (0.42) is now available:

 http://0install.net/injector.html

(source only at the moment; a Debian package has been uploaded to
unstable and the RPMs are building)

New features

- Connect to a key-server to look up trust hints. By default, this is
  a service hosted on Google AppEngine, at http://keylookup.appspot.com/
  Before, we used a built-in database, which couldn't be updated easily.
  The new system also allows us to use a much larger source of information;
  in particular the server can tell you if a package is signed by a
  member of the Debian project. Hopefully, this can be expanded in future
  to include packagers from Fedora, Ubuntu, etc.

- Allow multiple versions of each distribution package (Anders F
  Bjorklund). On RPM-based systems, 32-bit and 64-bit versions of a
  package may have the same package name, so store a list of (version,
  arch) pairs for each name.

Changes

- Always run the built-in copy of the GUI. Originally, the GUI was a
  separate program that 0launch downloaded when needed. Later, a copy of
  the GUI was bundled to improve the experience for first-time use, but
  updates were downloaded. In recent years, the only purpose of this has
  been to add new GPG keys to the hints database. Having the GUI as a
  separate program added unnecessary complexity, made it harder to