Skip to content

LordOS 0.8.2-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@lordbasex lordbasex released this 19 Oct 09:38
· 64 commits to main since this release
v0.8.2-beta
dcb8293

Added

  • New wallpapers. Eleven original LordOS wallpapers in three categories: Signature (Crystal Crown, Eternal Dawn, Royal Flow, Royal Waves, Violet Horizon), Lumo (Celestial, Aurora) and Cosmos (Event Horizon, Infinite Galaxy, Solar Odyssey, Stellar Voyage), created by iPERFEX with an AI image generator. Settings → Wallpaper now lists every wallpaper grouped by category, with the previous four gradients as "Gradients". They are installed once in /usr/share/backgrounds/lordos/ as high-quality JPEG (about 4 MB in total) with small thumbnails for the pickers, and a higher-resolution version added later is used automatically on the screens that need it.
  • Suggested for your computer. Store → Discover now starts with packages for the hardware LordOS finds in the computer, each with the reason it appears ("We detected a printer from HP connected by USB"): the guest tools of a VMware or QEMU virtual machine, the proprietary graphics driver for an NVIDIA card (labeled as not free software, never preselected, with what changes: DKMS, Secure Boot key enrollment, older cards, and that the free nouveau driver stays the default), vendor drivers for USB printers and scanners, driverless USB printing (ipp-usb), the Raspberry Pi 5's board tools, and the firmware package a Wi-Fi, Bluetooth, network or graphics device asked for and didn't find. One click shows the usual plan and installs through the package engine; "Don't suggest again" hides a card for good. When something new is suggested, the Store's Discover item shows a count and one notification says so. For a VirtualBox virtual machine the card explains that its guest utilities aren't part of Debian 13. Detection only reads the kernel's hardware files; nothing is sent anywhere. The rules are data (assets/store/suggestions.json); see docs/PACKAGES.md.
  • Monitor → Disks: each disk's temperature and health. The Disks tab now shows every physical disk's live temperature, read from the kernel without root: NVMe and M.2 drives through the nvme driver's own sensor (also on a Raspberry Pi 5 with an M.2 HAT), SATA disks through the drivetemp module, which the lordos package now loads at boot. Memory cards, virtual disks and adapters without a sensor say "No sensor", never a made-up value. The chosen disk gets a 30-minute temperature chart with the drive's own limits when it reports them, and an OK / Check / Failing light from a cached SMART summary, with "Open in Disks". Spinning disks are only read while they are in use, so a resting disk is never woken up (docs/MONITOR.md).
  • Disks: the full SMART report with smartmontools. The first time, the health card offers to install Debian's smartmontools through the Store's package engine (an administrator). Then it shows the overall health and why in plain words, temperature and limits, SSD wear (% of its rated life used), power-on hours and cycles, reallocated and pending sectors, every attribute with a plain name, the NVMe health log, the error log, the disk's own temperature history, and short and long self-tests with progress and results. USB disks behind adapters that pass SMART through work too. smartctl runs only through four new closed, validated root helper actions (smart-info, smart-health, smart-test, smart-abort) on real whole disks, at a fixed path, with JSON output (docs/SYSTEM.md).
  • Notifications when a disk gets too hot or its health gets worse, at most once per disk every 30 minutes for heat, and only when the health is worse than last seen. On by default, with a switch in Monitor → Disks.
  • Smooth video in the browser without hardware decoding. Video sites that send VP9 or AV1 make the browser decode them on the processor when the graphics card can't (virtual machines, older PCs, the Raspberry Pi 5), and the video stutters. LordOS now checks at every boot what the hardware decodes (VA-API profiles through lord-media, V4L2 memory-to-memory decoders on ARM, virtual graphics cards count as "no"; cached per boot) and, when VP9 or AV1 is missing, asks the browsers for H.264 instead, which is far lighter to decode. Settings → Displays → Video in the browser: "Optimize video for this computer" (Automatic by default, Always, Never) and "Lower quality automatically when video stutters" (off by default). Nothing is sent anywhere (docs/VIDEO.md).
  • Our own small browser extension (/usr/share/chromium/extensions/lordos-video, MIT), loaded by Debian's Chromium: on YouTube it reports VP9/AV1 as unsupported so the site sends H.264, and when a video keeps dropping frames it shows a small notice that offers a lower quality (or lowers it by itself, if enabled). Its settings come from a managed policy written by the closed admin action video-optimize (fixed text, no user text). Firefox ESR only loads signed extensions, so for now it gets AV1 turned off through a default preference (it then uses VP9); the extension for Firefox waits for signing.
  • Allow or block each destination inside Monitor's app rows. Open an app in Monitor → Network and every name it reached (or address, when the system resolver gave no name) has its own allow/block switch, showing what the app's rules decide for it right now and why ("By the rule *.example.com", "Follows this app's default", "Blocked by this app's restrictions"). A click writes, flips or removes the rule for exactly that name, the same rule Settings → Privacy → Network rules by app shows, and lord-netperm applies it at once. Long lists show eight and "N more…"; rows keep their place while the list is open (docs/MONITOR.md).
  • Traffic history. The Network tab's chart now zooms out from the live minute to 1 hour, 24 hours, 7 days and 30 days, steps back and forward one window at a time and has Now; with an app selected its own chart follows the same window, and the summary lists the apps that moved the most in it. Your session records bytes received and sent per minute (7 days) and per hour (30 days), for the computer and for each of your apps, in a small file in your home folder (~/.local/state/lordos/net-history.bin): never an address, a name or a country. Settings → Privacy → Monitor has Keep a traffic history (on) and Clear History (docs/MONITOR.md).
  • About LordOS shows a "System app" badge and the state of the system code: "Verified", or "Development build" for an unsigned development tree.
  • lord-server --check-code [<folder>] checks a whole installed tree against the signed manifest (troubleshooting, and the .deb build).
  • SHA-256 uses the CPU's SHA-256 instructions on the Raspberry Pi 5 (5× faster there), and the portable code is about twice as fast.
  • Design study: an immutable LordOS with A/B system images (docs/IMMUTABLE.md). It compares dm-verity system partitions, fs-verity, composefs, OSTree, A/B root partitions and btrfs snapshots against Debian 13, the Store, the Raspberry Pi 5 and LordOS's threat model, and recommends a separate, optional edition: a read-only /usr verified by dm-verity in two slots, one signed boot image per version, automatic fallback to the previous version when an update doesn't start, and /etc and the home folders kept on their own partition. The classic edition, install.sh and in-place updates stay as they are; there is no conversion of existing systems.
  • Experimental build of that design (tools/immutable/, not part of the regular ISO or Raspberry Pi image): a disk image for UEFI virtual machines with the A/B layout, a signed update into the other slot, and a scripted demonstration in which a deliberately broken version fails three times and the machine returns to the previous version on its own. Its payload is a minimal Debian 13, not the LordOS desktop yet; the rest of the plan moves to later versions.

Changed

  • New default wallpaper: new users start on Celestial; anyone who already chose a wallpaper keeps it. The login screen (and the remote login page) now shows Crystal Crown.
  • The Control Center shows the current wallpaper and three from the collection; the rest are in Settings → Wallpaper (Change Wallpaper…).
  • The map's moving dots are cheaper to draw: they are small ready-made images and the map's frame is opaque, so a repaint starts there. Repainting several small rectangles per frame instead of the one box around every change (which halved the animation's cost in our measurements) is in this version but off by default: in one test a minimized window left a grey rectangle on the screen, and correctness comes first. LORD_DAMAGE=multi in lord-server's environment turns it on for testing (docs/MONITOR.md).
  • Isolated apps start faster: the app host is compiled to bytecode once per session, so an app's JavaScript loads in ~23 ms instead of ~110 ms (Mail's window: ~145 ms from the click to its first frame on a 1.8 GHz test machine).
  • The Dock's quick actions and New window now work for the apps that run in their own process; Passwords stays a single window.
  • An isolated app's process is named after the app (mail), not exe, in ps and Monitor.
  • Releases: tools/release/sign-code.sh signs the system-code manifest on the maintainer's machine before the build; make -C server RELEASE=1 builds a lord-server that only runs signed code, and tools/iso/mkdeb.sh refuses to package bundles that don't match (docs/RELEASING.md).

Fixed

  • Long notes no longer overlap. In a row with a part that grows (a list item's text next to its bullet), the layout engine measured that part's wrapped height at the whole row's width, so the last line of a long bullet could be drawn over the next one (Store → Updates, "What's new", and any Markdown list). It is now measured at the width it is drawn at.
  • The app host's read and hash for isolated apps' bytecode moved off the main thread at session start (about 15 ms on a cold start); the bytecode is still compiled from exactly the verified bytes.
  • Package lists after enabling a component. Adding a component (such as non-free-firmware) or a source whose signed release file hadn't changed upstream left the package list as it was ("already up to date"); the index is now rebuilt whenever the set of lists it is built from changes.
  • Isolated apps showed times in UTC instead of the local time zone.
  • Trusting a self-signed certificate for an SMTP server on port 465 pinned it as the IMAP server's, so sending kept failing.

Security

  • Keys typed into LordOS's own prompts no longer reach the Linux app in front. What you typed into the search, the app launcher, a sheet or a system prompt (the keyring password, a permission prompt, the file chooser) was also delivered to the Linux (Wayland) app whose window was in front, so that app could read a password typed into the keyring prompt. While any of them is open, Linux apps now get no keys at all; menus and the clipboard and emoji panels still type into the app (docs/PRIVACY.md).
  • Mail, Calendar, Contacts and Reminders run in their own sandboxed process. Like Passwords and installed apps, each one is now lord-server --app <id> with Landlock, seccomp, no network and its own cgroup scope, instead of running inside the desktop's process. Mail's window can read only its own data folder; your files reach it only through the system's open/save dialog; it cannot open sockets, read the mail cache, the accounts file, ~/.ssh or other apps' data (checked from inside the running process). They reach lord-maild only through lord-server, each with its own list of allowed requests (Calendar cannot read mail) and its own replies and events. Notifications, alarms, Dock quick actions, several windows and opening attachments keep working. Monitor shows each app as its own process with its name and icon, and the firewall's per-app restrictions (lpk:mail, …) apply to it (docs/PRIVACY.md).
  • LordOS checks its own code before running it. Every bundle LordOS runs as its own code — the themes with the shell and every native app, the login screen, the app host of isolated apps and the system apps that run as their own process — is listed with its SHA-256 in /usr/lib/lordos/code-manifest.json, signed with the LordOS release key (Ed25519). lord-server verifies the signature with the public key compiled in, and the hash of each bundle as it loads it, from the same read (no window to swap the file). A bundle that doesn't match is not run: the desktop falls back to another theme and shows "This LordOS component was modified and was not loaded"; with nothing left to load (or at the login screen) a built-in recovery screen explains it and how to repair it, never a blank screen. It protects against changes by non-root processes and offline modification; root can still replace lord-server itself, which phase 3 (fs-verity, A/B images) will cover. Cost on a session start: about 7 ms on a Raspberry Pi 5, 18–34 ms on a 1.8 GHz Xeon VM (docs/SIGNING.md).
  • System apps can't be removed. Store → Installed shows "System app — part of LordOS" instead of Remove for the apps that come with LordOS, and the lordos package is marked Protected so the Store's package engine refuses to remove it.

Known issues and limitations

  • City names on the map. Debian 13 only ships country-level IP databases (geoip-database) and LordOS's own is country-level too, so labels stay countries; no large download was added.
  • Repainting several small rectangles per frame is off by default (see Changed): in one of five tries a window minimized over Monitor's animated map left a grey rectangle until it came back, and the cause is still being looked for. The desktop repaints as in 0.8.1.
  • Firefox ESR gets AV1 turned off but not the video extension, which needs signing first.
  • The immutable edition is a study and an experimental image for virtual machines; its payload is not the LordOS desktop yet.
  • The other known issues of 0.8.1 still apply.

Upgrading

  • From 0.8.1: Store → Updates shows "LordOS 0.8.2 is available" with these notes; Update installs it, and a restart finishes it. sudo apt update && sudo apt upgrade does the same. The update runs migration 003 once (it loads the drivetemp module for SATA disk temperatures); ls /var/lib/lordos/migrations lists the ones applied. Your settings are kept, and a wallpaper you chose stays; the new default (Celestial) is for new users.
  • From 0.8.0 (once): run curl -fsSL https://lordos.org/install.sh | sh (a system installed from the 0.8.0 ISO has no curl: run sudo apt update && sudo apt install -y curl first). It upgrades in place to 0.8.2, runs migrations 001 to 003 and adds the LordOS repository; from then on new versions come through Store → Updates.

Downloads

File What it is
lordos-live-0.8.2-amd64.iso Live and installable image for 64-bit PCs (UEFI and BIOS). Write it to a USB stick as is; Secure Boot off.
lordos-0.8.2-rpi5-arm64.img.xz Image for the Raspberry Pi 5, for Raspberry Pi Imager ("Use custom"), an SD card or an NVMe drive.
lordos_0.8.2_amd64.deb The LordOS package for an existing Debian 13 on a PC (installed by install.sh, or with apt install ./…).
lordos_0.8.2_arm64.deb The same package for Debian 13 on arm64.
install.sh The one-line installer for Debian 13: curl -fsSL https://lordos.org/install.sh | sh. It checks the signature before installing.
SHA256SUMS The SHA-256 of every file in this release.
SHA256SUMS.sig The Ed25519 signature of SHA256SUMS with the LordOS release key (base64).
lordos_0.8.2_<arch>.spdx.json Software bill of materials (SPDX 2.3) for each package: what it bundles and the Debian packages it depends on.

Verifying the downloads

The LordOS release public key is lordos-release.pub.pem (in the repository, or at https://lordos.org/lordos-release.pub.pem). Its fingerprint, the SHA-256 of the DER public key, is:

c7155b8e6bbbb180f907381994d06af76d333016cd6f3facf67cadd053ea108e

With OpenSSL 3, in the folder with the downloads:

openssl pkey -pubin -in lordos-release.pub.pem -outform DER | sha256sum   # must match the fingerprint
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.bin
openssl pkeyutl -verify -pubin -inkey lordos-release.pub.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.bin
sha256sum -c --ignore-missing SHA256SUMS

"Signature Verified Successfully" and "OK" for each downloaded file mean the files are the ones we published. Details: docs/SIGNING.md.

Links

Assets 12
Loading