Download
Upgrade
Alternatively, an in-place release upgrade is possible using the Kicksecure repository.
This release would not have been possible without the numerous supporters of Kicksecure!
Please Donate!
Please Contribute!
Major Changes
- General:
- Responsibly disclosed a number of security issues (CVEs) to upstream projects: Security Research by Kicksecure
- introduced Kicksecure Vulnerability Disclosure Policy
- Internal security review
- GitHub Dependabot configuration
- GitHub settings hardening
- Port to Sequoia-PGP ("sq") (GnuPG ("gpg") replacement) - OpenPGP
- use Sequoia git (`sq-git`)
- mitigate Executable MIME handler risks
- Improved input sanitization and Unicode handling.
- Add github native CI for builds (Thanks to @Mycobee!)
- VirtualBox
- work in progress fixing clipboard sharing host to VM and VM to host → How to enable Shared Clipboard & Drag-and-Drop features inside VirtualBox with Whonix-LXQt-18.0.8.7 ? - #99 by Patrick - VirtualBox - Whonix Forum
- Replace virtualbox-guest-x11 and virtualbox-guest-utils with virtualbox-guest-additions-iso or a sufficiently new Oracle build of VirtualBox (Thanks to @ArrayBolt3!)
- new package uploaded to Kicksecure repository: virtualbox-guest-additions-iso (from Oracle)
- VirtualBox sound setting: AC97 → Intel HDA
- CodeQL, and fuzzing:
- helper-scripts (its python portion)
- msgcollector (dito)
- security-misc’s file manager shim
- anon-apt-sources-list:
- Disable Debian Fast Track repository by default (Thanks to @ArrayBolt3!)
- apparmor-profile-torbrowser:
- maintenance fixes
- bindp:
- Add more compiler hardening flags (Thanks to @ArrayBolt3!)
- bootclockrandomization:
- Make startup on QubesOS require a NetVM (Thanks to @ArrayBolt3!)
- browser-choice:
- Fix logic bug that prevented use in unrestricted admin mode (Thanks to @ArrayBolt3!)
- debug-misc:
- sysctl: add cd-rom/dvd debugging settings (Thanks to @raja!)
- desktop-config-dist:
- Document rationale for GDK_BACKEND and QT_QPA_PLATFORM variables in 15_desktop-config-dist.sh (Thanks to @ArrayBolt3!)
- Set labwc icon theme properly, use a non-Python logo for livecheck (Thanks to @ArrayBolt3!)
- Adjust default terminal size to work better on small screens (Thanks to @ArrayBolt3!)
- dist-base-files:
- Add account ‘user’ to group ‘privleap’ during initial installation (Thanks to @ArrayBolt3!)
- kicksecure-base-files:
- Fix the default archiver application (Thanks to @ArrayBolt3!)
- kicksecure-meta-packages:
- Stop including qps on LXQt systems by default (Thanks to @ArrayBolt3!)
- Add dummy packages for more Secure Boot-related packages (Thanks to @ArrayBolt3!)
- Remove dummy-dependency-fwupd-signed metapackage, because fwupd-signed is a virtual package (Thanks to @ArrayBolt3!)
- Add dependency on mokutil, add additional dummy packages, split firmware-nonfreedom into arch-specific and arch-independent metapackages (Thanks to @ArrayBolt3!)
- fix: gpg-from-sq vs uwt
- legacy-dist:
- Use debug-kicksecure-enabled helper in fixes script (Thanks to @ArrayBolt3!)
- Enable set -x when debug-kicksecure qvm-service is enabled (Thanks to @ArrayBolt3!)
- Fix default archiver setting for existing users, fix a broken shellcheck include (Thanks to @ArrayBolt3!)
- Mark qps for autoremoval (Thanks to @ArrayBolt3!)
- Avoid error if dummy-dependency is not installed at upgrade time (Thanks to @ArrayBolt3!)
- Comments, avoid error if xscreensaver is not installed at upgrade time (Thanks to @ArrayBolt3!)
- deprecate version 17
- Fix kloak failing to start after a Whonix-Workstation 17 release upgrade (Thanks to @ArrayBolt3!)
- Fix release upgrade bug caused by usability-misc’s policy-rc.d disappearing mid-upgrade (Thanks to @ArrayBolt3!)
- mediawiki-shell
- major improvements and hardening
- KVM:
- Port to QEMU Session (Thanks to @HulaHoop!)
- sdwdate:
- Add more compiler hardening flags (Thanks to @ArrayBolt3!)
- Fix sleep duration calculation (Thanks to @ArrayBolt3!)
- Replace os.system() with subprocess.run() for safer URL handling (adapted from Claude Code) (Thanks to @ArrayBolt3!)
- Make startup on QubesOS require a NetVM (Thanks to @ArrayBolt3!)
- sdwdate-gui:
- Reliability improvements.
- Make startup on QubesOS require a NetVM (Thanks to @ArrayBolt3!)
- security-misc:
- D-Bus shim for org.freedesktop.FileManager1: fm-shim-frontend (Thanks to @ArrayBolt3!)
- Prevent using systemd-journald to write text to other user’s terminals (Thanks to @ArrayBolt3!)
- sysctl: add cd-rom/dvd hardening settings (Thanks to @raja!)
- Add reference on IOMMU vulnerabilities (Thanks to @raja!)
- Merge Meltdown mitigtions for ARM64 and X86_64 CPUs (Thanks to @raja!)
- Reorder panic settings (Thanks to @raja!)
- Add minor notices to panic on oopses and warnings (Thanks to @raja!)
- Update docs on
proc_mem.force_override(Thanks to @raja!) - Add KSPP partial compliance notice for
proc_mem.force_override=ptrace(Thanks to @raja!)
- serial-console-enable (opt-in package):
- grub: set GRUB_TERMINAL=serial unconditionally
- fix use of GRUB boot menu through serial console
- sysmaint-panel:
- Use sysmaint-panel’s start menu icon as a window icon as well (Thanks to @ArrayBolt3!)
- systemcheck:
- improved log analysis in
systemcheck --verbose - Add CLI metapackages to check_packages.bsh (Thanks to @ArrayBolt3!)
- Add test for if /etc, /var, and /usr are ephemeral in AppVMs (Thanks to @ArrayBolt3!)
- fix: do not report missing tirdad kernel module on non-Intel/AMD64 as error because it is expected and not actionable by users Often systemcheck errors notifications. whonix 18lxqt - Unsupported Platforms - Whonix Forum tirdad - TCP ISN CPU Information Leak Protection
- Downgrade some network-related errors to warnings, don’t exit prematurely if the qube has no NetVM (Thanks to @ArrayBolt3!)
- Check previous boot’s logs for critical messages (Thanks to @ArrayBolt3!)
- improved log analysis in
- tb-updater:
- sandbox, resume and security improvements
- fixed ARM64 download link detection
- tirdad:
- Fix tirdad on kernel 6.12.94+ (Thanks to @ArrayBolt3!)
- tor-ctrl:
- Harden against command injection (Thanks to @ArrayBolt3!)
- usability-misc:
/etc/profile.d/30_path.sh: prepend/usr/local/sbin/usr/sbinand/sbintoPATHenvironment variable No longer using zsh for that. No longer modify PATH in/etc/zsh/zshenv. Why/sbin? See: I Challenge Thee I Challenge Thee PATH overwritten by /etc/zsh/zshrc zsh: consolidate PATH setup in zshenv by assisted-by-ai · Pull Request #5 · assisted-by-ai/usability-misc · GitHub- remove
/usr/share/safe-rm/binfromPATHenvironment variable by default PATH overwritten by /etc/zsh/zshrc - undo modprobe
options kvm enable_virt_at_load=0Recent versions of VirtualBox (7.1.18, 7.2.8) can cause a system crash during package upgrades, VMs may fail to start Vboxdrv.service fails to start - fix:
/etc/profile.d/30_path.sh: prepend/usr/local/sbin/usr/sbinand/sbintoPATHenvironment variable
- user-sysmaint-split:
- Add startup helper script and use labwc --startup. System Maintenance Panel not showing up - #17 by eternity (Thanks to eterniTTY!)
- sysmaint-boot-unrestricted-qubes: improve reliability of unrestricted admin mode boot
Wants=spice-vdagentd.socket- Harden against command injection (Thanks to @ArrayBolt3!)
- Move the sysmaint locked password migration earlier to avoid spurious error messages caused by running autologinchange later (Thanks to @ArrayBolt3!)
- Add account ‘sysmaint’ to group ‘privleap’ during initial installation (Thanks to @ArrayBolt3!)
- vm-config-dist:
- VirtualBox Intel HD Audio and PipeWire Incompatibility / Audio broken after increasing ram to 5 GB / No sound after latest updates - PipeWire Bug? - VirtualBox - Whonix Forum
- fix: do not enable software rendering simply because
lvmpipeis required. In case a known, hardcoded graphic card provider renderer string is detected, skip enabling software rendering. Kdenlive monitor issue solved by AI - Debian 13 KDE Plasma _ Kicksecure.cli Hardened - Properly handle disabled displays in wlr-resize-watcher (Thanks to @ArrayBolt3!)
- Restart wlr-resize-watcher when logging out and back in (Thanks to @ArrayBolt3!)
- Restart wlr-resize-watcher if it crashes (Thanks to @ArrayBolt3!)
- derivative-maker:
- improved cross-build support
- Apple
M#Silicon (ARM64) build system improvements: VirtualBox operations were moved from the host into anamd64cowbuilder chroot, allowing ARM64 hosts such as Apple Silicon systems to produce VirtualBox images without requiring VirtualBox packages on the host.
- developer-meta-files:
- github-org-clone: Bulk-clones repositories from an GitHub organization into a local directory.
- github-org-fork: Bulk-forks a GitHub organization.
- github-org-push: Bulk-push.
- dm-github-fork-sync:
- dm-github-org-policy: Applies and audits organization-wide GitHub security and governance policy.
- dm-github-personal-policy: Applies equivalent policy controls to personally owned repositories.
- dm-github-org-metadata-sync: Synchronizes repository descriptions, homepages, and topics from a central metadata file.
- dm-github-org-security-report: Produces a Markdown report on repository and organization security settings or gaps.
- dm-github-token-test: Checks whether a GitHub token is present, safely stored, and has the expected access.
- Reusable GitHub workflows:
- Scorecard (investigated, checkup using OpenSSF supply-chain security checker completed)
- Harden GitHub workflows
- unicode and control character resistant git review tools
- Cleanup:
- deprecate ro-mode-init (initramfs-only) (ported to dracut)
- deprecate gpg-bash-lib (port to sq)
Full difference of all changes
(This forum post was previously a call for testers. No release critical bugs where found during the testing period. This forum post was therefore transformed into a stable release announcement. See edit history.)