DrewNaylor
Generate the current date and time at startup and use it as a "key" to determine if the current instance of guinget is the one that's currently using the package list cache.
This would help both with refreshing the cache as well as modifying the sources in a graphical sources manager app, as each instance of, say, guinget gets started at a slightly different time even if it's the same EXE file. This "key" can be passed to the graphical sources manager app when started from guinget so it can determine if it's allowed to modify the sources. If guinget is running and this manager app is started outside guinget, it'll first see if it has any command-line args. If it does, it'll compare the "key" and calling app ID (in this case that would be "guinget" to keep it simple) to what's in the "lock file" to see if it can start. If it has no args, it'll check if there's a "lock file", start if there is none and create the "lock file", but refuse to start if there is one.
This "key" thing isn't very secure, but that's not really the point as opposed to making sure no two (behaving) apps (can even be different instances of the same one) access the files at the same time.
This'll have to have a way to allow the user to clear the "key" in case of crashes. Maybe it won't be the best idea.