SynapseOS 1.0.1

SynapseOS 1.0.1 — a point release on top of 1.0. It is a rolling release: an
installed machine keeps taking updates through syn-update, and the number on
an ISO only says which image a machine was installed from.

Most of what is here is the security pass that 1.0 did not have time for:
updates that are signed and checked, a firewall that asks about a network
instead of trusting every private address, a kernel monitor that sees the
things it used to miss, and a malware scanner that says what it found. The
assistant also learned to leave her window, and a night of audio no longer
keeps the screen awake.

49 commits.

Updates are signed, and checked before anything is built

syn-update verifies that every commit it is about to build is signed by the
SynapseOS update key, back to a fixed point in the history. An unsigned or
differently-signed commit stops the update there: what has already been
verified still installs, and the rest waits.

The key ships with the distribution, so the check works on a machine with no
special setup, and the signature is checked against that copy rather than
against anything the source came with. The key also carries a certification
from the release-signing key, which is the one that has signed the ISOs all
along, so the two identities are tied together.

The sources that SynapseOS publishes for use on plain Arch are signed the same
way.

SECURITY.md has the fingerprint and how to check an update yourself.

The firewall trusts a network, not every private address

The firewall used to let in anything coming from a private address — the
10/8, 172.16/12 and 192.168/16 ranges. On a home network that is what people
expect. On café or hotel Wi-Fi, every other guest is also on a private address,
and every one of them was let through.

A network is now untrusted until it is marked. An unmarked network gets replies
to connections this machine made, ICMP and DHCP, and nothing else. The first
time a network is joined, a notification asks. Settings ▸ Network has a
Trusted / Not trusted choice per network, and synnet --trust-network does it
from a terminal.

Traffic arriving over Tailscale is trusted automatically: a tailnet is a set of
machines you have already paired, not whoever is nearby.

⚠ On upgrade, the network each machine is currently on is marked trusted, so a
home setup keeps working without being asked.

The kernel monitor sees what it used to miss

synguard's watches are enforced in the kernel through BPF-LSM, and its
reports now come from the kernel's own resolved path. A file reached by a
relative path, through a symlink, with .. in it, or opened with openat2 or
io_uring used to pass unseen; each one is reported now.

The kernel module gained probes for the syscalls it had none for: the setuid
and setgid families, capset, mount and move_mount, and hostile signals
sent to the system's own daemons.

The gate is armed by default, and Settings ▸ Security is where a machine
declines it.

Two kernel crashes found on the way are fixed, and the suites that found them
now run in a VM against a stock kernel rather than skipping.

What the AI can say about an alert is now fixed vocabulary. The model picks
from a list of concerns and SynapseOS writes the words; a benign answer shows
nothing at all. The model's own sentence goes to the audit log and never to the
bar, the security feed or the assistant.

The command bar no longer runs what a page asks it to. It used to hand any
CMD: line in a model's answer straight to a shell, and Super+Backspace
puts the focused window's title into the prompt — so a web page's title could
name a command. Found while writing the threat model, which is now in
docs/THREAT-MODEL.md.

The malware scanner says what it found

syn-scan status --weekly lists what the weekly sweep found, from your own
account, and the scanner's window opens on that list. Settings ▸ Malware
Scanning shows each finding as a row under the count: the file — or the
engine, for a rootkit check — with the verdict, what the engine said, and when.
The count used to be the whole answer, with no way to see what was behind it.

An engine that stopped part-way is listed as did not finish and is not
counted as a finding. rkhunter's complaint about its own log file was being
counted as one, which is the kind of finding that makes people ignore the real
ones. It writes its log somewhere it is allowed to write now, and a sweep that
finds something no longer stops before the file scan.

The scanner's window also gets its own icon in the dock.

chibi

Buddy mode: the star control, F4 or chibi --buddy puts her on a
click-through overlay, where she walks the bottom edge of the screen, floats
onto the tops of windows, talks in a bubble, and can be petted, typed to,
carried and sent home with the mouse. Voice and the model keep running.

Replies are sized to what was asked. A story is told whole, the news comes
back as a rundown, and chat stays a line or two; a long reply scrolls in the
bubble instead of being cut off.

Drawn icons instead of empty boxes. The weather panel's and status bar's
symbols were emoji the monospace font does not have. The panel's lines are
measured now, so they no longer overlap on a desktop-sized window, and rain and
snow reach the bottom of it.

The camera aspect and the evening archive question are off by default, and
the question only arrives when somebody is actually in the room, waits three
minutes for an answer, and has to be answered by name — a television playing in
the background used to be filed as the day's memory.

The package is also 288 MB smaller: it was shipping a stale copy of the speech
libraries that synapse-voice already owns.

The desktop

• A screen coming back from standby brings its windows back. A monitor in
  standby drops its link, which moves its windows to a screen that still
  exists; they used to stay there. Both the normal layout and Duplicate return
  them now.
• Audio playing no longer holds the screen awake. Sound coming out of the
  speakers says nothing about whether anybody is at the desk, and it was
  disarming dim, blank, lock and suspend together — four nights of a machine
  that never slept. Remote viewing still holds the screen on, which is what
  that inhibitor is for.
• The system monitor widget has a GPU row. It never had one: the figures
  live behind a library only the compositor can reach, and synui publishes them
  for the widget now.
• A panel that asks for the keyboard after it opens gets it, instead of
  typing going to the window underneath.

Everything else

• Boot no longer waits for the network. NetworkManager-wait-online was
  being enabled implicitly and cost 7.6 seconds of a 13.2-second userspace boot
  on a wifi install, with the desktop queued behind it.
• syn-clean's root categories work. The package cache, the system journal
  and the system trash were offered, counted toward the total, and then refused
  for every command line including sudo — 27.3 GB of the 44.4 GB it offered
  on a real machine was unreclaimable.
• A failed move to the trash says why. synfiles reported "done" when
  nothing had moved.
• The AI pane says how fast the machine actually is, with a Measure button,
  instead of naming the backend library and leaving you to guess.
• The assistant does not have to run its model on this machine. vibe host <name> points it at another box's synapd, the way chibi already could.
• A busy graphics card is left alone. The offload policy could see free
  VRAM and nothing about GPU load, so it would reload a model into a card that
  was pinned at 100%, which takes the model away for a minute.
• Builds are reproducible. Every package is stamped with a date taken from
  its last commit instead of the clock, built at a fixed path, and there are
  two checkers that build a component twice and compare.
• The image is published whole, as well as in parts. GitHub caps an asset
  at 2 GiB, which is the only reason the ISO ships split; it is now also on
  Cloudflare R2 and the Internet Archive, with a torrent.

---

Download

⬇ SynapseOS 1.0.1 — the whole ISO, one file

4.6 GiB. Resumable, and nothing to reassemble.

Mirror: Internet Archive —
which also carries a torrent for the same image.

Then check what you got, in the folder you downloaded to:

curl -O https://dl.soslinux.org/SynapseOS-1.0.1-x86_64.iso.sha256
sha256sum -c SynapseOS-1.0.1-x86_64.iso.sha256

On macOS the checksum tool is spelled differently — shasum -a 256 -c SynapseOS-1.0.1-x86_64.iso.sha256.
On Windows, certutil -hashfile SynapseOS-1.0.1-x86_64.iso SHA256 prints the hash to compare
against the contents of that file.

Or download it in parts, from this release page

GitHub caps a release asset at 2 GiB, so the copy attached to this page is split
into .part* files. The mirrors above carry the image whole and are the
easier road; this one needs no third-party host.

Download all .part* files into one folder, then join them back into a
single ISO and check it. Joining is a plain byte-for-byte concatenation, so any
tool that does not "help" works; the checksum is what tells you it worked.

Linux / macOS

cat SynapseOS-1.0.1-x86_64.iso.part* > SynapseOS-1.0.1-x86_64.iso
sha256sum -c SynapseOS-1.0.1-x86_64.iso.sha256

(Optionally verify each part before reassembly: sha256sum -c SynapseOS-1.0.1-x86_64.iso.parts.sha256)

Windows

Open Command Prompt in the folder you downloaded the parts to (Shift+right-click
the folder ▸ Open in Terminal, or cd to it) and run:

copy /b SynapseOS-1.0.1-x86_64.iso.part00 + SynapseOS-1.0.1-x86_64.iso.part01 + SynapseOS-1.0.1-x86_64.iso.part02 SynapseOS-1.0.1-x86_64.iso
certutil -hashfile SynapseOS-1.0.1-x86_64.iso SHA256

/b is not optional: without it copy works in text mode and stops at
the first 0x1A byte, which in an ISO is a few hundred KB in. You get a short
file, no error, and a stick that will not boot.

certutil prints the hash; compare it against the one inside
SynapseOS-1.0.1-x86_64.iso.sha256. To have Windows do the comparison instead, use PowerShell:

(Get-FileHash -Algorithm SHA256 .\SynapseOS-1.0.1-x86_64.iso).Hash -eq (((Get-Content .\SynapseOS-1.0.1-x86_64.iso.sha256) -split '\s+')[0]).ToUpper()

That prints True when the join is good. (Get-FileHash returns uppercase
hex and sha256sum writes lowercase, which is why the file's copy is upper-cased
before the compare — the bytes are the same either way.)

If copy /b gives you trouble, PowerShell can do the join on its own, and it
never has a text mode to fall into:

$out = [System.IO.File]::Create((Join-Path $PWD 'SynapseOS-1.0.1-x86_64.iso'))
Get-ChildItem 'SynapseOS-1.0.1-x86_64.iso.part*' | Sort-Object Name | ForEach-Object {
  $in = [System.IO.File]::OpenRead($_.FullName); $in.CopyTo($out); $in.Close()
}
$out.Close()

Write to USB

This erases the USB stick. It is written as a raw disk image, not copied as a
file, so whatever was on it is gone.

Linux / macOS

sudo dd if=SynapseOS-1.0.1-x86_64.iso of=/dev/sdX bs=4M status=progress oflag=sync

Check /dev/sdX with lsblk first, and write to the disk
(/dev/sdb), not a partition on it (/dev/sdb1).

Windows

Use one of:

• Rufus — pick the ISO, leave the defaults, click START.
  It will ask whether to write in ISO Image mode or DD Image mode: choose
  DD Image mode. This is a hybrid image and DD mode writes it unaltered;
  ISO mode rebuilds the boot files and has no reason to get this one right.
• balenaEtcher — select image, select drive,
  Flash. Nothing to configure; it only ever writes raw.
• Ventoy — if you already run a Ventoy stick,
  just copy SynapseOS-1.0.1-x86_64.iso onto it and pick it from the boot menu. Nothing is erased
  and other ISOs on the stick keep working.

Then reboot and choose the USB stick from your firmware's boot menu (usually
F12, F11, Esc or Del at power-on). Secure Boot must be off, or SynapseOS enrolled
— see the wiki's Secure Boot page.