EmiBSD 2026.11.2 (pre-release, signed)

The third EmiBSD release for arm64 and the first signed one, again a pre-release: the
install media install EmiBSD in QEMU, the installer verifies the sets against the medium's
signature, and the installed system boots to login:. It has not yet been compared with a real
OpenBSD (diff-openbsd, step 5 of the checklist).

Not for production. EmiBSD is an experiment. It runs only in QEMU, and its crypto,
network and storage code is unaudited.

What changed since 2026.11.1

• Signed. EmiBSD has its own signify keys. The medium's 8.0/arm64/SHA256 and this
  release's SHA256 are signed with emibsd-80-base into SHA256.sig; the installer checks
  the sets against it (Signature Verified) and no longer asks Continue without verification?.
  The public key: keys/emibsd-80-base.pub,
  RWR7BZgzESUf6vppLWNF/Q83e1OvjRIDJ4kNBtzh0gPMW889JsfGSjU3.
• Userland 2026.11.3: the base system is OpenBSD's renamed EmiBSD at build time (messages,
  manuals, URLs, contact addresses at emibsd.org); its binaries carry the ELF note name EmiBSD
  and .emibsd.* sections; /etc/signify and the installer carry only EmiBSD's keys; the
  installer finds its mirror list at ftplist1.emibsd.org through DNS.
• Kernel 20261107-b2a15ba6: it accepts the ELF note name EmiBSD, which those binaries need.
• DevTools llvm-23.1.4+emibsd.2: lld maps the .emibsd.* sections as the .openbsd.* ones.
• The mirror: the release's 8.0/arm64/ tree is also on https://cdn.emibsd.org/pub/EmiBSD/8.0/arm64/,
  and kept as pub/EmiBSD/releases/2026.11.2/arm64/.

The media

• emibsd-2026.11.2-arm64-install.iso: for QEMU and VMs; cd9660 with an EFI El Torito image.
• emibsd-2026.11.2-arm64-install.img: a USB stick image, laid out as OpenBSD's arm64 install80.img.
• SHA256 and SHA256.sig: the sums of both, and their signature.

Both carry the sets, so the install needs no network. How to run it in QEMU, step by step:
README.

V=2026.11.2
U=https://github.com/EmiBSD/OS/releases/download/$V
curl -fLO $U/emibsd-$V-arm64-install.iso -fLO $U/SHA256 -fLO $U/SHA256.sig &&
  shasum -a 256 --ignore-missing -c SHA256
# with signify and the public key above:
signify -C -p emibsd-80-base.pub -x SHA256.sig emibsd-$V-arm64-install.iso

What it assembles

	Pin
Kernel	release 20261107-b2a15ba6: bsd.mp and bsd.RAMDISK, with the ABI linked in; BOOTAA64.EFI
Userland	release 2026.11.3, signed: the base80, comp80, game80 and man80 sets (.tar.zst), miniroot80.fs, INSTALL.arm64
DevTools	832bb279392f, llvm-23.1.4+emibsd.2; Rust 1.99.1+emibsd.1
OpenBSD	3ce1f3f79392, the pin Kernel, Userland and LandingZone share

unsafe in Kernel (cargo xtask unsafe-report at d2107de6, the close of N6.0, one commit
before the pin): kernel 0, abi 0, hal 205, bsd 8825.

Checked

• just check, just fetch, just smoke: the pins exist and match their sums, Userland's
  signature verifies, the released kernel boots.
• just media twice from the manifest commit: the same images and the same SHA256.sig.
• just smoke-media: each image installs all four sets onto a fresh disk in QEMU virt
  (EDK2, cortex-a72), the installer reports Signature Verified, and the installed disk boots
  alone to login:; uname -a gives EmiBSD emibsd.my.domain 8.0 GENERIC#1827 arm64.

Known gaps

• No diff-openbsd yet: the installed system has not been compared with a real OpenBSD.
• The comp set has no cc, ld or ar yet (DevTools' T3), so reorder_libs, the
  ssh-agent relink and reorder_kernel fail at boot, without harm.
• Network installs and sysupgrade from the mirror are untested; the media install from local sets.
• ISO installs print newfs_msdos: /dev/r0000000000000000.i: No such file or directory
  during disk setup: OpenBSD 8.0 prints the same line with a CD attached; the install is not affected.
• Tested only in QEMU's virt machine; real hardware is untried.
• arm64 only; amd64 waits for Kernel's N10.