Skip to content

kuma v0.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 23:37
v0.17.0
fb231df

Fixed

  • A credential file is no longer executed as root. kuma install --restore writes a repository password to /var/lib/kuma/secrets/restore.env, and the first-boot restore used to read it with a shell, which runs whatever is on the right-hand side. A value like $(...) executed as root before anybody logged in. Both that unit and kuma backup now parse the file instead. If your repository password contains a $, a backtick, a quote or a backslash, kuma will now refuse it by name, because those characters meant different things to different readers of the same file. A repository created before this release was encrypted with the expanded value, so change its password with restic passwd before rewriting the file.

  • kuma doctor no longer reports a working swapfile as missing. The hibernate check reads the swapfile through sudo, and a declined or unpromptable sudo graded the same as a broken file. It now says it could not ask. This was invisible in a terminal, where sudo prompts, and reliable for anything reading doctor --json.

  • Nothing suspends into an unlocked session. The desktop shell owns idle lock, the lock keybind and lock-before-suspend, and it used to be started in a way that could not restart it. It now runs supervised, and a machine whose shell is gone ends the session rather than sleeping with the desktop on screen. A shell that hangs rather than exits is still not covered.

  • The desktop locks on idle again. Every kuma niri machine has shipped an idle lock at 15 minutes and screen-off at 16 that never armed: the shell needs each idle behavior to name an action, and kuma set only a timeout, so both were dropped at startup. The config validated, noctalia config export merged showed both timeouts, and the machine never locked. It says so once in the journal (idle behavior 'lock' ignored: needs an action), which is where this was found. Rebuild and reboot to arm it; if you have set idle behaviors of your own in ~/.local/state/noctalia/settings.toml, check each one names an action. kuma doctor grades this now, from the shell's journal, since that is the only place a refused behavior is reported.

  • A mounted disk image is refused again. kuma install --disk <file> claimed to check whether the image was already mounted and could not: lsblk refuses a file path. It resolves the loop device now.

  • The install no longer widens your password hash. For two process spawns, the account hash and the backup password were readable by every local account on the machine.

Changed

  • kuma doctor says when your desktop is running something other than what the image set. Settings you change in the shell are yours and the image will not overwrite them, but kuma cannot read that file, so kuma diff never mentioned it. Doctor now names the keys and points at noctalia config export merged.

  • kuma doctor fails a desktop whose shell is drawing its own defaults. The shell reads kuma's config only because the service that starts it hands over the path, and one that comes up without it has a different bar, no palette taken from the wallpaper, and a first-run wizard. Doctor reads the running process rather than any file, because every file on such a machine still says the right thing.

  • kuma build is about four seconds faster. It deleted the image it replaced by sweeping the whole store; it deletes that one image now.

  • SECURITY.md says that sshd is enabled on every image and that the firewall lets it through, which means the account's password answers a prompt on port 22. That was true before and undocumented. Turn it off with [services] disable = ["sshd.service"] if you do not want it.

  • The examples added Trayscale, and the niri example removed TextEditor. A machine rebuilt from an updated example gains Trayscale, and a niri one loses TextEditor, because convergence removes what it installed. Keep TextEditor by naming it in your own declaration.

Static x86_64 binary, no runtime dependencies.

$ curl -LO https://github.com/Letdown2491/kuma-linux/releases/download/v0.17.0/kuma-x86_64-unknown-linux-musl
$ chmod +x kuma-x86_64-unknown-linux-musl && sudo mv kuma-x86_64-unknown-linux-musl /usr/local/bin/kuma

Verify it came from this workflow:

$ cosign verify-blob \
    --bundle kuma-x86_64-unknown-linux-musl.bundle \
    --certificate-identity-regexp '^https://github.com/Letdown2491/kuma-linux/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    kuma-x86_64-unknown-linux-musl

Built from fb231dfefe8d1df37d647c89cf65583f52de3da8.

Assets 8
Loading