Release LordOS 0.8.1-beta · lordbasex/LordOS

A maintenance and polish release on top of 0.8.0-beta, and the first one that installed systems can update to in place: from here on, new versions arrive through Store → Updates (or apt) from a signed LordOS repository, with no reinstall. It also brings a Dock you arrange yourself, remote login over SSH from Settings, Restart and Shut Down in the crown menu, process actions and complete traffic accounting in Monitor, Bluetooth on the Raspberry Pi 5, and fixes for typing lag and black windows on the GPU path and for legacy BIOS boot in virtual machines.

Added

A Dock you arrange yourself. Drag any app (a LordOS app, an installed package or a Linux app such as Firefox) from the app launcher onto the Dock and it lands where you drop it; drag icons along the Dock to reorder them (the neighbours slide aside); drag one away and hold it for a moment to remove it with a "poof", or use Keep in Dock / Remove from Dock in the menus. Files stays first and the Trash last (it shows when it is full, opens in Files, takes files dropped from Files and empties after a confirmation); Files, Settings and the app launcher can't be removed. The Dock's menu starts with quick actions: an app's own (Settings' sections, Files' folders, Mail's New Message, Monitor's tabs) or a Linux app's desktop actions from its .desktop file. Settings → Desktop & Dock → Reset Dock to defaults puts the theme's apps back. The Classic theme's taskbar works the same way, with a drop line. The arrangement from 0.8.0 is migrated on first login (docs/DOCK.md).
Update LordOS from the Store, without reinstalling. Store → Updates now shows "LordOS is available" with the release notes and an Update button, next to Debian's updates; files, settings and accounts are kept, and a "Restart required" notice appears when the new version (or a new kernel) is installed. It works the same on the ISO install, the Raspberry Pi image, Debian with install.sh and servers, and sudo apt update && sudo apt upgrade does the same. An optional daily check (on by default, never installs anything) notifies when something new is available (docs/UPDATES.md).
Settings → Sharing → Remote login (SSH). A new switch, off by default on every install, turns the standard SSH server on and off for good (systemctl enable --now / disable --now). The first time, it installs openssh-server through the package engine (the Store's path). The page shows ssh <user>@<address> for this computer and its ED25519 host key fingerprint, and lets you allow all users or only administrators. Root never logs in (PermitRootLogin no in a drop-in shipped by the lordos package). The Raspberry Pi image's ssh switch file keeps working and shows up as on (docs/REMOTE.md).
Restart… and Shut Down… in the crown menu (and behind a Power button in the Classic theme's start menu); before, they were only on the login screen. Each opens a confirmation that does it by itself after 60 seconds unless cancelled, lists the apps still open and warns when other users are logged in. The session asks lord-sessiond, which only accepts those two words: any user may do it alone, and only an administrator while other users have sessions open (docs/SESSIONS.md).
Monitor → Processes: stop a process and Get Info. Select a row and use the new Stop and Info buttons, the right-click menu, a double click, ❖/Ctrl+I or Delete. Stop asks first, with Quit (SIGTERM), Force Quit (SIGKILL) and Cancel. Your own processes are signalled by the session itself with pidfd_send_signal after checking the process's start time, so a reused PID is never hit; another user's or root's need an administrator and go through two new fixed, validated root helper actions (proc-signal, proc-info). PID 1, kernel threads, your session, LordOS's services and helpers and PipeWire can't be stopped: the sheet explains why. Get Info shows memory (real, virtual, shared, private, proportional), statistics (parent, group, CPU time, threads, context switches, page faults, start time, nice, control group and LordOS restrictions), open files and ports (with the addresses of each socket), the executable and the command line, updated every second (docs/MONITOR.md).
Bluetooth on the Raspberry Pi 5 image. The on-board CYW43455 controller (on a UART, brought up by the kernel) now works out of the box: the image ships BlueZ, the chip's firmware patch (bluez-firmware), headset audio in PipeWire (libspa-0.2-bluetooth) and a small helper of our own, lordos-rpi-bt@hciN, that routes call audio (SCO) over HCI so headset microphones work. Settings → Bluetooth uses it as on a PC. Scanning is verified on a Pi 5; pairing a device on the board is still to be tested (docs/RASPBERRY.md).
Guest tools on VMware. The ISO (and so every installed system) ships open-vm-tools: shutdown and restart from the hypervisor, time sync and the guest's IP address. Its services only run under VMware. Shared clipboard and automatic screen resize are not supported yet (docs/ISO.md).
A signed LordOS package repository at https://lordos.org/apt (suite stable, amd64 and arm64), signed with a dedicated OpenPGP key (Ed25519, fingerprint 1DDA F390 107D F264 FA8A 0918 3972 CC6D E4DA 2336) shipped as /usr/share/keyrings/lordos-archive-keyring.gpg; the lordos package adds /etc/apt/sources.list.d/lordos.sources and removes it when uninstalled. Built and signed on the maintainer's machine by tools/release/apt-repo.sh, tested on a staging path first.
Migrations between versions. The package's postinst applies each version's system changes once and in order (/usr/lib/lordos/migrate, packaging/migrations/), so skipping versions converges to the same state; each user's settings get the same treatment at login (sdk/settings.js). The first two enable per-app network permissions where they were left off, and keep root's SSH key login on servers upgraded from 0.8.0 (0.8.1 turns root login off).
Local repositories in the package engine: a file:/path source (a disk or a USB stick) is read like a download, as nobody, and checked the same way.
tools/diag/keylag.sh: where does the typing delay come from? In two minutes it reports the composition mode, the VM and its guest tools and Chromium's complaints, and with lordos.inputdebug=1 on the kernel line (one boot, root only) it times each stage of a key in ms: read by lord-server, delivered to the app, the app's answer, on screen. The trace holds timings only (no key, character or modifier), only for keys sent to Linux apps (never LordOS's own fields, the Terminal, Passwords, login or lock), in a 0600 file in the session's runtime folder, and stops after 120 s (docs/TROUBLESHOOTING.md).
verify-board checks Bluetooth and the BPF LSM on a freshly flashed board: the controller on its UART, bluetoothd, the SCO helper, the board address, bpf in the LSM list, the kernel's BTF and lord-netperm.

Changed

Monitor → Network: a fluid traffic chart. The sparse per-second bars are now a continuous mirrored strip for the last 60 s: sent above the baseline, received below, one bar per second on a faint track, scrolling smoothly at 4 samples per second, auto-scaled, with the minute's totals as pills. The selected app gets the same chart, each app row a small live activity indicator, and the summary shows "↓ received · ↑ sent" per app and destination (docs/MONITOR.md).
Monitor → Network: the map shows which way the traffic flows. Dots travel along each arc, sent from "This computer" to the place and received back, more and faster with the rate; idle arcs are dimmed. Reduce motion shows still markers instead; the animation runs at 12 frames per second, only on screen, and stops when the window is minimized.
More audio headroom in virtual machines. When LordOS runs in a VM, emulated sound outputs get 8 periods of 1024 frames, 8192 frames of headroom and interrupt-driven scheduling (a WirePlumber rule that only matches in a VM; real hardware keeps its low latency). On VMware this stopped YouTube stuttering in Chromium (docs/SOUND.md).
Background work yields to the desktop after login. Mail sync runs at nice 19 with idle I/O and the thumbnail worker at the lowest I/O priority, so they don't compete with sound and the first windows.
The input level meter in Settings → Sound reads a normal 48 kHz stream instead of a 25 Hz peak stream, which in PipeWire ran as a node with a quantum of 1.
The LordOS Raspberry Pi kernel gains the BPF LSM, BTF and Yama (6.18.57-2+lordos, same Raspberry Pi source as 0.8.0's -1): CONFIG_BPF_LSM, CONFIG_DEBUG_INFO_BTF (from pahole; modules stripped, no debug package) and CONFIG_SECURITY_YAMA. The active LSM list on the Pi is now capability,landlock,yama,bpf.

Fixed

Typing no longer lags in Chromium and Firefox on GPU composition. A Linux app's new frame is only a texture on the GPU path, and a display with no other change was not flipped, so a typed character appeared only when something else on the screen moved (up to ~1 s later; Firefox looked frozen), and Chromium logged "buggy presentation feedback". Every GPU display now presents an app's new content in the next frame; a frame shown by a modeset gets its presentation feedback at once; and with nothing drawn (screen off, session away from the monitor) apps still get their frame callbacks once a second. Measured with Chromium: p50/p95 from the key to the screen 949/1866 ms before, 18/25 ms after; also in 0.8.0. Seen on VMware, reproduced on Proxmox (docs/TROUBLESHOOTING.md).
Linux app windows are no longer black after the login screen or a lock. With GPU composition, coming back to the monitor creates a new GPU context, but each window's buffers were still drawn with their textures from the old one: Chromium's window stayed black while its audio kept playing. Imports now belong to one context and are made again, windows keep their last frame while the session is off the monitor, and apps get the new dmabuf formats (docs/GPU.md).
Monitor → Network counts all of an app's traffic, UDP and QUIC included. Per-app bytes came only from the TCP sockets open at that moment, so UDP — and with it QUIC: HTTP/3, a browser playing a video — counted nothing, and a closed connection took its bytes with it (a browser streaming music showed 13 KB). lord-netperm now counts every packet of each app's sockets in the kernel (two cgroup_skb programs, both directions, loopback excluded) and sends bytes and rates per app and per address every second: 98.7–98.8 % of the interface's counters in the tests (an HTTP/3 download, a browser on a video site), about 0.5 µs per packet and no measurable cost on TCP (docs/FIREWALL.md).
The menu bar names a Linux app, not its window. Next to the crown it showed the window title (for a browser, the whole page title); it now shows the app's short name, "Chromium", in every language. The Dock tooltip and Linux app notifications use the same short name; a real translation of the name (e.g. "Archivos") still shows, and a window without a .desktop file is named after its app id. The window's own title bar keeps the title.
Menus are always above the Dock. With the Dock on the left, the crown menu opened underneath it and the Dock took its clicks; select lists inside apps (Passwords' category list) were drawn under the form fields after them. The desktop now has one stacking order, in layers (Dock < menu bar < fullscreen < launcher < menus and popovers < sheets < notifications < tooltips < drag images < system prompts), and clicks follow it, in every Dock position, light and dark, RTL and the Classic theme (docs/LAYERS.md).
No lighter band in the menu bar after a menu or the Control Center closes. The menu bar's background blur read the screen around it, and outside the repainted area that still held the bar's previous frame, so the repainted part came out lighter until something else redrew the bar. Now a change that touches a blurred surface, or the margin its blur reads, repaints the whole surface (the GPU path composites the same canvas; engine-test checks it against a full repaint).
The Network tab's detail panel no longer hides values under its scroll bar. The panel keeps a strip for the bar, and a label and value that don't fit on one line go on two instead of running over the next row (es/en/pt, right to left, minimum window size).
The live ISO boots with legacy BIOS again. 0.8.0 triple-faulted on VMware (and hung at the boot menu on QEMU's VMware-compatible display) when booting with BIOS firmware: GRUB's graphical terminal corrupted its own memory at 640×480 with the theme's proportional font. The theme now uses GRUB's fixed-width font for the terminal and BIOS boots ask for 1024×768 first; UEFI is unchanged. Installed systems get the same theme fix (docs/ISO.md).
No silent black screen without a KMS display. When there is no display device with kernel modesetting (for example QEMU's VMware-compatible display), the text console now says so and suggests a display that works; vmwgfx only loads on VMware itself, so the console stays visible elsewhere.

Security

"No Bluetooth" for Linux apps is enforced on the Raspberry Pi 5 (a known issue in 0.8.0): lord-netperm loads its Bluetooth socket program there as on a PC (npverify-test 37/37 on the board), and a process in a restricted app's scope gets EPERM from socket(AF_BLUETOOTH) while the same call outside it works.
kernel.yama.ptrace_scope = 1 applies on the Raspberry Pi 5: 0.8.0's Pi kernel had no Yama, so any process could attach to another of the same user there.
Root can't log in over SSH by default. The lordos package ships /etc/ssh/sshd_config.d/10-lordos.conf with PermitRootLogin no, for the new SSH switch and for an SSH server installed any other way; a server upgraded from 0.8.0 that is administered as root with a key keeps key-only root login (see Upgrading).

Known issues and limitations

On the Raspberry Pi 5, pairing a Bluetooth device and a headset's audio have not been tested on the board yet; scanning works. The Pi 4 kernel in the image (-rpi-v8) is still 0.8.0's, without the BPF LSM, so "No Bluetooth" is not enforced on a Pi 4 (docs/RASPBERRY.md).
Kernel updates on the Raspberry Pi come with a new image, not through Store → Updates: the LordOS Pi kernel is not in the repository until the image can fall back to the previous kernel (docs/UPDATES.md). The lordos package itself updates on the Pi like anywhere else.
On VMware, shared clipboard and automatic screen resize are not supported yet (open-vm-tools-desktop targets X11). QEMU's VMware-compatible display has no kernel modesetting: use the standard VGA or virtio display there.
No metered-connection setting yet: turn off Store → Updates → Check for updates automatically on a metered link.
The other known issues of 0.8.0 still apply, except the two fixed above (the Pi 5's "No Bluetooth" and the built-in updater).

Upgrading

From 0.8.0 (once): run curl -fsSL https://lordos.org/install.sh | sh again (a system installed from the 0.8.0 ISO has no curl: run sudo apt update && sudo apt install -y curl first). It upgrades in place (keeps users, settings and the login setup) and its package adds the LordOS repository; from then on new versions come through Store → Updates or apt. Or add the repository by hand and sudo apt update && sudo apt install lordos (docs/UPDATES.md).
On a server administered as root with an SSH key, the upgrade keeps root's key login (/etc/ssh/sshd_config.d/09-lordos-root-keys.conf) even though 0.8.1's default is no root login; delete that file to apply the default.
From 0.8.1 on, Store → Updates shows each new version with its notes and installs it; sudo apt update && sudo apt upgrade does the same. Each version's changes to the system run once as migrations (ls /var/lib/lordos/migrations lists the ones applied), so skipping a version is fine. A restart finishes the update.

Downloads

File	What it is
`lordos-live-0.8.1-amd64.iso`	Live and installable image for 64-bit PCs (UEFI and BIOS). Write it to a USB stick as is; Secure Boot off.
`lordos-0.8.1-rpi5-arm64.img.xz`	Image for the Raspberry Pi 5, for Raspberry Pi Imager ("Use custom"), an SD card or an NVMe drive.
`lordos_0.8.1_amd64.deb`	The LordOS package for an existing Debian 13 on a PC (installed by `install.sh`, or with `apt install ./…`).
`lordos_0.8.1_arm64.deb`	The same package for Debian 13 on arm64.
`install.sh`	The one-line installer for Debian 13: `curl -fsSL https://lordos.org/install.sh \| sh`. It checks the signature before installing.
`SHA256SUMS`	The SHA-256 of every file in this release.
`SHA256SUMS.sig`	The Ed25519 signature of `SHA256SUMS` with the LordOS release key (base64).
`lordos_0.8.1_<arch>.spdx.json`	Software bill of materials (SPDX 2.3) for each package: what it bundles and the Debian packages it depends on.

Verifying the downloads

The LordOS release public key is lordos-release.pub.pem (in the repository, or at https://lordos.org/lordos-release.pub.pem). Its fingerprint, the SHA-256 of the DER public key, is:

c7155b8e6bbbb180f907381994d06af76d333016cd6f3facf67cadd053ea108e

With OpenSSL 3, in the folder with the downloads:

openssl pkey -pubin -in lordos-release.pub.pem -outform DER | sha256sum   # must match the fingerprint
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.bin
openssl pkeyutl -verify -pubin -inkey lordos-release.pub.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.bin
sha256sum -c --ignore-missing SHA256SUMS

"Signature Verified Successfully" and "OK" for each downloaded file mean the files are the ones we published. Details: docs/SIGNING.md.

Navigation Menu

Repository navigation

LordOS 0.8.1-beta

Choose a tag to compare

Sorry, something went wrong.