DuDuClaw OS v0.2.0

DuDuClaw OS v0.2.0 — duduclaw-qemux86-64 and duduclaw-genericx86-64 images, embedded DuDuClaw platform v1.63.0.

What changed since v0.1.0: the vendored platform moved to v1.63.0 (account credential hardening, ten bundled AI CLIs + llama.cpp, provider-aware accounts, local models), the OS layer gained scripts/sync-platform.sh for one-shot platform sync, and release-os.sh now chains the release overlay, compresses with zstd -19 --long=27 and refuses assets over GitHub's 2 GiB limit. Full list: CHANGELOG.md.

Verify before flashing or burning (same key for every asset):
minisign -V -P RWQyI00ugZ/+WVisQ2ZnKeTqFs8Ze8h2X11FO9Z8le0YubFMXYTwQD7n -m
shasum -a 256 -c .sha256

Whole-disk images (flash directly with bmaptool or dd):

• duduclaw-os-duduclaw-qemux86-64-v0.2.0.wic.zst (+ .sha256, .minisig, .manifest.json) — appliance image for QEMU; booted to a login prompt under headless QEMU before signing.
• duduclaw-os-duduclaw-genericx86-64-v0.2.0.wic.zst (+ .sha256, .minisig, .manifest.json) — same image for real x86-64 hardware; config-audited, not QEMU-smoke-tested (no QEMU profile for this machine).
  Decompress with zstd -d <file>; the archives use --long=27 (128 MiB window), which is within zstd's default decompression limit, so no extra flag is needed on a current zstd. If your zstd asks for it, add --long=27.
  The .manifest.json files are build provenance only and are not part of the trust chain.

Live installer ISOs (write to USB or burn, boot, follow the wizard; both variants use the same A/B GPT layout on the target disk):

• duduclaw-os-installer-duduclaw-qemux86-64-v0.2.0.iso / duduclaw-os-installer-duduclaw-genericx86-64-v0.2.0.iso (+ .sha256, .minisig) — installs the headless gateway + dashboard image (duduclaw-image-ab).
• duduclaw-os-installer-desktop-duduclaw-qemux86-64-v0.2.0.iso / duduclaw-os-installer-desktop-duduclaw-genericx86-64-v0.2.0.iso (+ .sha256, .minisig) — installs the full desktop appliance image (same content as the .wic.zst above: A/B update chain, duduclaw-comp/duduclaw-shell desktop, Flatpak-preloaded Chromium/LibreOffice/Steam, fcitx5 IME, bundled AI runtimes).
  The installer payload inside both ISO variants is zstd -19 --long=27 compressed as of this release (previously -3), which is what keeps the desktop edition under 2 GiB.

Rollback: v0.1.0 (platform v1.62.0) remains available under its own tag.

DuDuClaw OS v0.1.0

DuDuClaw OS v0.1.0 — first tagged bring-up release (pre-GA).

Two machines × three artifact forms. Every file has a .sha256 and a minisign .minisig; verify before flashing:

minisign -V -P RWQyI00ugZ/+WVisQ2ZnKeTqFs8Ze8h2X11FO9Z8le0YubFMXYTwQD7n -m <file>
shasum -a 256 -c <file>.sha256

Artifacts

Machine	Form	File	What it installs
duduclaw-qemux86-64 (QEMU bring-up target)	whole-disk image	duduclaw-os-duduclaw-qemux86-64-v0.1.0.wic.zst	Desktop edition duduclaw-image-appliance — A/B update chain, own compositor/shell, Chromium / LibreOffice / Steam, IME, app compatibility layer, read-only root, firewall, login hardening. zstd -d, then dd / bmaptool to the target disk.
	installer ISO, desktop edition (added 2026-09-04)	duduclaw-os-installer-desktop-duduclaw-qemux86-64-v0.1.0.iso	The same desktop edition, written to the internal SSD by the graphical installer.
	installer ISO, base image	duduclaw-os-installer-duduclaw-qemux86-64-v0.1.0.iso	Base image duduclaw-image-ab — same A/B layout, desktop shell and gateway, without the app layer, read-only root or firewall. A bring-up artifact.
duduclaw-genericx86-64 (real x86-64 hardware, x86-64-v3)	whole-disk image	duduclaw-os-duduclaw-genericx86-64-v0.1.0.wic.zst	Desktop edition, as above.
	installer ISO, desktop edition (added 2026-09-04)	duduclaw-os-installer-desktop-duduclaw-genericx86-64-v0.1.0.iso	Desktop edition via the installer.
	installer ISO, base image	duduclaw-os-installer-duduclaw-genericx86-64-v0.1.0.iso	Base image via the installer.

*.manifest.json files are build provenance for the whole-disk images (not part of the trust chain).

Verification status

• duduclaw-qemux86-64: whole-disk image and both ISOs boot-verified under QEMU (the desktop-edition ISO to the live login prompt from a virtual CD-ROM; the installer's disk-write flow was exercised in earlier bring-up rounds, not re-run for the desktop payload).
• duduclaw-genericx86-64: config-audited only. It cannot be booted under QEMU, and no artifact of this release has been booted on real hardware yet.

Read this before flashing

• Boot with Secure Boot off. The UKIs and systemd-boot in this release are not signed, and the images carry no dm-verity partition and no TPM stack. Secure Boot signing, dm-verity and TPM2 + LUKS exist in the build layer as opt-in overlays (kas/sb-signing.yml, kas/tpm-luks.yml) and were not enabled for these builds. Read-only root (desktop edition), A/B update with rollback, and minisign-signed release artifacts are in.
• The base-image ISO is a bring-up artifact; if you want the machine described in the README, use the desktop edition (whole-disk image or installer-desktop ISO).
• Hardware requirements, editions and the desktop are documented in the repo README and in the platform docs (docs/features/50-duduclaw-os-appliance.md, 52-desktop-edition.md).