SibillaOS v0.4.0

The supply chain release: this cycle is about being able to answer, with evidence, the questions a security review asks. Who can call the API, how updates arrive, whether the model you serve is the one that was reviewed, and what exactly is inside the images.

Upgrading from 0.3.0 still means reinstalling once: from this release onward, installed systems receive llmd package updates through apt.

What is new

API key lifecycle. The gateway accepts multiple keys: sudo sibilla key add NAME creates one per client or teammate, revoke kills it on the next request, rotate replaces the default. Revocation is immediate. The gateway also writes structured JSON access logs to /var/log/caddy/sibilla-access.log, so "who called what, when" has an answer.

APT repository. Each release publishes a GPG-signed package repository on GitHub Pages. Freshly installed systems come preconfigured (the source activates itself at first boot, once the repository answers) and sudo apt update && sudo apt upgrade keeps the llmd stack current between reinstalls. Manual setup for existing systems is one keyring and one sources file, documented in apt/README.md.

Signed catalog, verified models. The curated model catalog is signed with the project key and verified before every use: a tampered catalog is refused everywhere. Catalog entries now record the sha256 of the model artifacts (the same digest Hugging Face publishes and ollama stores blobs under): sibilla model use refuses to serve an artifact that does not match, and first boot warns loudly if the downloaded model differs from the reviewed one.

SBOM and CVE scanning. Every release attaches a Software Bill of Materials (SPDX and CycloneDX) for the packages this project builds, plus the full package inventory of a system actually installed by the CI install test. CI scans that inventory for vulnerabilities on every push; the gate and the triage policy are documented in docs/supply-chain.md.

Secure Boot, verified. CI now boots every ISO under UEFI firmware with Secure Boot enforced and Microsoft keys enrolled, and requires the kernel itself to report Secure Boot active. The signed shim and GRUB chain from Ubuntu survives the SibillaOS repack, provably, on every push. Reports from physical Secure Boot machines remain welcome.

Reliability work that this cycle forced: the installer now pins the apt mirror (no geoip redirect), skips apt Translation indexes (a mid-sync CDN serving one stale localization file used to fail the whole install), retries transient fetches, and dumps real diagnostics to the serial console if it ever fails, powering off instead of hanging. The cloud image bake gained the same robustness.

What has been verified

The full pipeline on every push: ISO build, BIOS, UEFI and UEFI-Secure-Boot boots, unattended install, real chat completion, TLS and the complete auth matrix (missing key, wrong key, added key, revoked key, rotated default), multi-model serving, model digest verification against the catalog, webui plumbing, metrics endpoint, firewall and sandbox assertions, access log content, package inventory capture, SBOM generation and the CVE gate; plus the cloud image built and deployed on amd64 and arm64. Known limits stay as documented: the Open WebUI login flow and vLLM on physical GPUs remain outside CI, and arm64 token generation is exercised but not asserted under emulation.

Installation

From the ISO (amd64): download all .part files and SHA256SUMS, reassemble, verify, write to a USB drive:

$ cat sibillaos-0.4.0-amd64.iso.part* > sibillaos-0.4.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.4.0-amd64.iso of=/dev/sdX bs=4M status=progress

From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, then boot the qcow2 with your cloud-init user-data as usual.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Gateway rate limiting is not implemented yet. Model digests currently cover the CI-verified entry; the tooling to extend them to the whole catalog ships in tools/. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• Release/0.4 by @engineering87 in #3

Full Changelog: v0.3.0...v0.4.0