SynapseOS 1.0.2

SynapseOS 1.0.2 — a point release on top of 1.0.1. It is a rolling release: an
installed machine keeps taking updates through syn-update, and the number on
an ISO only says which image a machine was installed from.

The new piece is syn-mouse, which rebinds a gaming mouse's extra buttons per
game without the vendor's app. The big screen opens YouTube and Jellyfin in
their television interfaces and gains four streaming services, the video editor
gets title templates, masks and moving effects, and remote play pairs with the
current Sunshine. Under that is a display pass, mostly multi-monitor and
NVIDIA, and a round of security fixes: synpkg checks signatures now, and
synguard no longer checks an exec against another process's file.

88 commits.

Mouse buttons, rebound per game

A gaming mouse's extra buttons are normally programmed by a Windows-only vendor
tool. syn-mouse takes them over while a game you name has focus and turns
each one into a key:

Mode	What the button does
key	holds a key (or a combination like shift+2) while it is held
repeat	taps the key every N seconds while it is held
toggle	one click starts tapping every N seconds, the next stops it
latch	one click holds the key down, the next lets it go
off	nothing

The bindings stop the moment another window comes to the front, and resume when
the game does. With no profile in force the mouse is left alone. The cursor,
the wheel and every button you did not bind behave exactly as before.

A button that the mouse's own memory makes send a key instead of a button
event is bound the same way, as key:<name>. syn-mouse status lists which
keys the mouse has sent.

syn-mouse bind <profile> <button> <mode> from a terminal, or syn-mouse gui
for the window. It is a Mouse Buttons row in both installers, and it is
translated into all thirteen languages.

The big screen

• YouTube and Jellyfin open their television interfaces. Arrows walk the
  grid, OK presses, Back goes back. Each runs in a browser profile of its own,
  so the desktop browser is untouched. Under Firefox, YouTube's TV interface
  ignores the remote's Play, Stop, rewind and fast-forward. Pause works, and OK
  on the player's play button resumes.
• Netflix, Paramount+, Prime Video and Crunchyroll are web apps, with a
  tile each on the Media shelf. They are on unless a webapps list is already
  written, in which case they start off.
• Every tile on a shelf can be switched off. big tiles <id> off, the
  Tiles row on the Big screen tab of syn-arcade gui, or Start ▸ Settings ▸
  Tiles on the television. A program installed later still gets its tile.
• A remote's Back goes back in YouTube, Jellyfin and the browser, including
  a Media Center remote whose Back is an Exit key. Clear pressed twice
  closes the application in front.
• big guide off takes effect at the next press, also while a game is
  running, so the Guide button belongs to Steam's overlay.
• A media server on this machine opens on loopback, so a Jellyfin that
  announced itself on a VPN address still opens once the VPN is down.
• A remote stays open between rescans instead of being reopened every two
  seconds, which had been flooding synguard with device-open alerts.

Remote play

• Pairing works against Sunshine 2026.10, which wants the waiting request
  named. With more than one client waiting, give the address:
  syn-remote stream pair <PIN> <address>.
• The Sunshine menu entry starts SynapseOS's streaming server instead of a
  second Sunshine that has none of your pairings.
• A stream opens at the size of the screen it opens on, instead of
  Moonlight's 1080p default stretched over a larger monitor.
  syn-remote resolution moonlight hands the size back to Moonlight's own
  settings.
• The remote-desktop password sign-in is now documented correctly: it has no
  lockout after failed attempts.

The video editor

• Title templates. Five ship (lower bar, name plate, chapter, corner tag,
  quote), and your own go in ~/.config/synstudio/titles.
• A title's size and colour, and 33 of the 40 effect knobs, can move over
  time, with the same keys, eases and curve editor as opacity.
• Masks on a clip's grade: up to four linear or radial masks, each with its
  own adjustments, as the darkroom has for photographs.
• Every video delivery is tagged BT.709. Deliveries went out untagged, so a
  player showed colours a little off from the monitor. A project can also be
  made for a BT.1886 display, and EXR exports are now truly linear.

Displays

• NVIDIA: a suspend no longer hangs with the monitors dark. On nvidia-open,
  the console handover at suspend could wait forever on the GPU, and only a
  reboot recovered. The NVIDIA driver's text console is off by default now. The
  graphical login and the disk-unlock prompt are unchanged.
• NVIDIA: the boot framebuffer no longer becomes a second, phantom screen
  drawn in software, with every monitor corrupted and the compositor on eight
  cores.
• A machine with no GPU acceleration draws a clean picture. In a VM without
  3D, the bar shredded and tiles of one window landed on another.
• Each monitor keeps its own settings, saved by the monitor's identity
  rather than the port it is plugged into, so a TV and a desk monitor that
  take turns on one HDMI port no longer inherit each other's mode. Existing
  layouts carry over.
• Leaving Duplicate gives each screen its exact mode back, refresh rate
  included.
• A screen turned off and back on draws where the layout says it is.
• The application page scales with the screen, so it fills a 4K display
  instead of sitting small in the middle, and icons are sharp: a theme with
  only a small picture no longer wins over one with a full-size version.
• An idle desktop uses about half the CPU it did with blur and the desktop
  cat on: the screen is no longer re-blurred every frame, the cat steps at
  60 Hz instead of the refresh rate, and redrawn panels update their texture
  in place.
• The image viewer no longer leaks memory. Each repaint left a full-screen
  image behind, which came to gigabytes over a long session.

Security

• synpkg checks package and database signatures the way pacman does. It
  verified nothing before: a package installed through it was checked only
  against a database whose own signature was never checked.
• synguard judges an exec under its own path. Under a preemptible kernel,
  another process's file open could overwrite the path an exec was checked
  against, so execs were reported, and could be acted on by a rule, under the
  wrong file. The fix needs Linux 6.10 or newer. On an older kernel the
  in-kernel gate does not load, and synguard status says so.
• The kernel monitor sees setuid(0), setgid(0), setfsuid(0) and
  setfsgid(0) on the CachyOS kernel, where they had gone unreported.
  32-bit callers are covered too.
• Malware scans see the newest signatures. A scan run from your own account
  was skipping the daily signature file it could not read, and still said "OK".
  A path that does not exist is refused instead of reported clean, Scan
  Downloads finds the Downloads folder in any language, and the scanner is
  translated into all thirteen languages.
• rkhunter keeps its baseline current across upgrades, so an upgraded
  package is not reported as tampered while a file changed outside pacman still
  is. A file an engine could not read is listed, not counted as a finding.
• Fewer false alarms from synguard. A DNS lookup is no longer a port
  scan, Syncthing's relay check is exempt (/etc/synguard/netwatch-exempt
  lists programs by path), and a quiet event stream during a game no longer
  reads as the reader falling behind.
• synguard's rules are installed once, in the directory that keeps them from
  other users. A second, world-readable copy is removed on upgrade.

Updates

• Every component on the ISO now updates on an installed machine, including
  llama.cpp (now b11612, built on each machine for the backend it runs) and
  linux-wallpaperengine. The limine snapshot and boot hooks come from
  [cachyos] and take its updates; local copies that would hide them are moved
  aside.
• A component broken by a system library update is rebuilt at the version
  it has, as when ffmpeg 8 became 9.
• syn-update help no longer runs pacman.
• Background user services stay off the login screen.

Everything else

• chibi opens YouTube and plays music when asked.
• A weather location set at runtime takes effect without logging out.
• syn-rgb works with OpenRGB 1.0, instead of waiting about 42 seconds on
  every wallpaper change.
• syn-gfn opens NVIDIA's own GeForce NOW app when it is installed, with
  --web for the browser.
• On a limine install, the boot random seed nothing reads is no longer written
  at each boot, and the two journal errors about it are gone.
• synfiles find no longer says it stopped at the limit when it did not, and
  synpkg's Arsenal screen prints its category count.
• The Updates window's name column fits the longest name.

---

Download

⬇ SynapseOS 1.0.2 — the whole ISO, one file

4.7 GiB. Resumable, and nothing to reassemble.

Mirror: Internet Archive —
which also carries a torrent for the same image.

Then check what you got, in the folder you downloaded to:

curl -O https://dl.soslinux.org/SynapseOS-1.0.2-x86_64.iso.sha256
sha256sum -c SynapseOS-1.0.2-x86_64.iso.sha256

On macOS the checksum tool is spelled differently — shasum -a 256 -c SynapseOS-1.0.2-x86_64.iso.sha256.
On Windows, certutil -hashfile SynapseOS-1.0.2-x86_64.iso SHA256 prints the hash to compare
against the contents of that file.

Or download it in parts, from this release page

GitHub caps a release asset at 2 GiB, so the copy attached to this page is split
into .part* files. The mirrors above carry the image whole and are the
easier road; this one needs no third-party host.

Download all .part* files into one folder, then join them back into a
single ISO and check it. Joining is a plain byte-for-byte concatenation, so any
tool that does not "help" works; the checksum is what tells you it worked.

Linux / macOS

cat SynapseOS-1.0.2-x86_64.iso.part* > SynapseOS-1.0.2-x86_64.iso
sha256sum -c SynapseOS-1.0.2-x86_64.iso.sha256

(Optionally verify each part before reassembly: sha256sum -c SynapseOS-1.0.2-x86_64.iso.parts.sha256)

Windows

Open Command Prompt in the folder you downloaded the parts to (Shift+right-click
the folder ▸ Open in Terminal, or cd to it) and run:

copy /b SynapseOS-1.0.2-x86_64.iso.part00 + SynapseOS-1.0.2-x86_64.iso.part01 + SynapseOS-1.0.2-x86_64.iso.part02 SynapseOS-1.0.2-x86_64.iso
certutil -hashfile SynapseOS-1.0.2-x86_64.iso SHA256

/b is not optional: without it copy works in text mode and stops at
the first 0x1A byte, which in an ISO is a few hundred KB in. You get a short
file, no error, and a stick that will not boot.

certutil prints the hash; compare it against the one inside
SynapseOS-1.0.2-x86_64.iso.sha256. To have Windows do the comparison instead, use PowerShell:

(Get-FileHash -Algorithm SHA256 .\SynapseOS-1.0.2-x86_64.iso).Hash -eq (((Get-Content .\SynapseOS-1.0.2-x86_64.iso.sha256) -split '\s+')[0]).ToUpper()

That prints True when the join is good. (Get-FileHash returns uppercase
hex and sha256sum writes lowercase, which is why the file's copy is upper-cased
before the compare — the bytes are the same either way.)

If copy /b gives you trouble, PowerShell can do the join on its own, and it
never has a text mode to fall into:

$out = [System.IO.File]::Create((Join-Path $PWD 'SynapseOS-1.0.2-x86_64.iso'))
Get-ChildItem 'SynapseOS-1.0.2-x86_64.iso.part*' | Sort-Object Name | ForEach-Object {
  $in = [System.IO.File]::OpenRead($_.FullName); $in.CopyTo($out); $in.Close()
}
$out.Close()

Write to USB

This erases the USB stick. It is written as a raw disk image, not copied as a
file, so whatever was on it is gone.

Linux / macOS

sudo dd if=SynapseOS-1.0.2-x86_64.iso of=/dev/sdX bs=4M status=progress oflag=sync

Check /dev/sdX with lsblk first, and write to the disk
(/dev/sdb), not a partition on it (/dev/sdb1).

Windows

Use one of:

• Rufus — pick the ISO, leave the defaults, click START.
  It will ask whether to write in ISO Image mode or DD Image mode: choose
  DD Image mode. This is a hybrid image and DD mode writes it unaltered;
  ISO mode rebuilds the boot files and has no reason to get this one right.
• balenaEtcher — select image, select drive,
  Flash. Nothing to configure; it only ever writes raw.
• Ventoy — if you already run a Ventoy stick,
  just copy SynapseOS-1.0.2-x86_64.iso onto it and pick it from the boot menu. Nothing is erased
  and other ISOs on the stick keep working.

Then reboot and choose the USB stick from your firmware's boot menu (usually
F12, F11, Esc or Del at power-on). Secure Boot must be off, or SynapseOS enrolled
— see the wiki's Secure Boot page.