SibillaOS v0.5.0

The adoption release: this cycle is about lowering the cost of trying SibillaOS. You no longer need to reinstall a machine to evaluate it, and walking away is as clean as arriving. This is also the first release where the upgrade promise from 0.4.0 is exercised: systems installed from the previous images receive these llmd packages through a plain sudo apt update && sudo apt upgrade.

What is new

Zero-reinstall path. An existing Ubuntu 24.04 machine becomes the appliance with two commands: sudo apt install llmd from the project repository, then sudo sibilla setup. Setup detects the hardware, installs the pinned engine if it is missing, pulls a fitting model and serves the authenticated API on port 8080 - the same stack the images ship, without touching the disk layout. It behaves as a guest, not an owner: no firewall changes, no package source flips, no appliance takeover (those behaviors stay exclusive to the installed images). If the machine already runs Caddy, the existing configuration is backed up before the gateway is rendered.

Reversible trial: sibilla remove. The teardown removes only what SibillaOS put on the machine - services, downloaded models, configuration, keys, the llmd packages themselves, and the engine only if sibilla setup installed it - then restores anything it displaced, including a pre-existing Caddy configuration. It shows an inventory (with the disk space coming back) and asks before acting; --yes skips the prompt for scripts. CI proves the promise on every push: after removal it asserts that no llmd package, no configuration, no model store and no engine binary remain, and that the gateway port is dead.

sibilla doctor. One command collects what a bug report needs - OS, kernel, hardware, package versions, configuration (paths only), unit states, endpoint probes, storage, recent service logs - into a single paste-ready report. The report contains no secrets by construction: every configured API key is scrubbed from the whole output before it reaches the terminal, and CI asserts on every push that the key never appears. This matters more than it looks: the packaged Caddy unit starts with --environ, which dumps the process environment (gateway keys included) into the journal, exactly the kind of leak a naive log excerpt would paste into a public issue.

sibilla connect --write. The connection kit could already print ready-to-paste configuration for VS Code (Continue, Cline), aider and any OpenAI-compatible client; with --write it now places the Continue configuration directly in the invoking user's home (the user behind sudo, not root), backing up any existing file first and restricting permissions on the result, since it contains the key.

README and first-run experience. The README now leads with the two-command quick start, shows an example session up front and carries a proper architecture diagram. Issue templates were already in place; sibilla doctor gives reporters something precise to paste into them.

What has been verified

The full pipeline on every push, now including a complete guest lifecycle on a plain Ubuntu runner: repository install of the llmd metapackage, sibilla setup, gateway up with mandatory auth, an authenticated API call, a doctor report asserted complete and free of the API key, the Continue configuration written for the sudo user, and sibilla remove followed by proof of a clean machine. Alongside it, everything the previous releases established: ISO build, BIOS, UEFI and UEFI-Secure-Boot boots, unattended install, real chat completion, TLS and the complete auth matrix, multi-model serving, model digest verification, webui plumbing, metrics, firewall and sandbox assertions, SBOM generation and the CVE gate, and the cloud image built and deployed on amd64 and arm64. Known limits stay as documented: the Open WebUI login flow and vLLM on physical GPUs remain outside CI, and arm64 token generation is exercised but not asserted under emulation.

Installation

On an existing Ubuntu 24.04 machine (new in this release):

$ curl -fsSL https://engineering87.github.io/sibillaos/apt/sibillaos-archive-key.asc \
    | sudo gpg --dearmor -o /usr/share/keyrings/sibillaos-archive-keyring.gpg
$ printf 'Types: deb\nURIs: https://engineering87.github.io/sibillaos/apt/\nSuites: ./\nSigned-By: /usr/share/keyrings/sibillaos-archive-keyring.gpg\n' \
    | sudo tee /etc/apt/sources.list.d/sibillaos.sources
$ sudo apt update && sudo apt install llmd
$ sudo sibilla setup

From the ISO (amd64): download all .part files and SHA256SUMS, reassemble, verify, write to a USB drive:

$ cat sibillaos-0.5.0-amd64.iso.part* > sibillaos-0.5.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.5.0-amd64.iso of=/dev/sdX bs=4M status=progress

From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, then boot the qcow2 with your cloud-init user-data as usual.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Gateway rate limiting is not implemented yet. sibilla setup targets Ubuntu 24.04, the same base the images build on. Model digests currently cover the CI-verified entry; the tooling to extend them to the whole catalog ships in tools/. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• release: v0.5.0 - adoption: zero-reinstall path and the good-guest lifecycle by @engineering87 in #4

Full Changelog: v0.4.0...v0.5.0