Kicksecure 18.2.4.2 - Point Release!

News
1

Download

(What is a point release?)

Upgrade

Alternatively, an in-place release upgrade is possible using the Kicksecure repository.

This release would not have been possible without the numerous supporters of Kicksecure!

Please Donate!

Please Contribute!

Security Vulnerability Fixes

  • Fixed a local privilege escalation vulnerability in a script in the legacy-dist package. (Thanks to Uladzislau Hryharovich for responsibly disclosing this security vulnerability!)
    • (The fixed legacy-dist package was already available in the stable repository before this release announcement.)
    • A full write-up by the reporter will be linked here once published.

Major Changes

  • Ported the ISO build process from live-build (run through derivative-maker) to native derivative-maker (without live-build).
  • Progress towards reproducible builds.
    • Packages built by Kicksecure are already reproducible. Independent reproduction of packages and comparison of official builds with reproduced builds are welcome so that potential issues can be identified and resolved.
    • Non-Qubes-Whonix: the next release might be reproducible.
    • (Qubes-Whonix: reproducibility depends on Qubes, not Qubes-Whonix.)
  • Internal code review and fixes.
  • Major progress on automated testing.
  • derivative-maker: opt-in, disabled-by-default SMBIOS reader that allows kernel parameters to be configured at the virtualizer level.

Notable Changes

  • desktop-config-dist:
    • Removed the QTerminal drop-down keybinding.
    • Ported livecheck to Qt6; added D-Bus activation to launch new instances from the Start Menu.
    • Restricted livecheck to one running instance at a time; the Start Menu entry now raises the existing livecheck window.
    • Hidden the gparted Start Menu entry in user sessions by default (non-functional due to user-sysmaint-split).
  • developer-meta-files (build and maintenance tooling):
    • dm-review-branch: review changes on a git branch before merging.
    • dm-reproducible-compare-artifacts: compare two builds artifact-by-artifact to verify that they are identical.
    • dm-nbd-cleanup: clean up leftover block devices after a build.
    • bash-style-guide: project coding style guide for shell scripts.
    • dm-reproducible-buildinfo: record the exact build inputs needed to reproduce a build.
    • dm-reproducible-fetch: fetch build sources deterministically so everyone starts with the same inputs.
    • dm-reproducible-verify: rebuild and verify that the result matches the official release bit-for-bit.
    • dm-normalize-fat-partition: remove nondeterministic FAT filesystem metadata to make images reproducible.
    • dm-debconf-normalize-owners: normalize debconf database ownership for reproducible packaging.
    • dm-update-frozen-snapshot: update the pinned package repository snapshot used by the build.
    • dm-github-org-security-report: collect open security alerts across the GitHub organization.
    • dm-github-org-policy: apply a standard security policy across the GitHub organization’s repositories.
  • dist-system-metadata:
    • New dist-system-metadata package.
      System metadata has been split out of tb-updater so that frequently changing
      data (pinned Tor Browser versions and the Tor Project signing key) can
      migrate between suites independently of the larger code packages.
      • usr/share/dist-system-metadata/tb-updater/{tbb_hardcoded_version_stable,
        tbb_hardcoded_version_alpha,tbb-team.asc}
      • Minimal dependencies allow it to migrate to the stable repository quickly.
  • helper-scripts:
    • dpkg-reconfigure-noninteractive: reconfigure a package without interactive prompts.
    • Fixed qubes-dom0-update over sys-whonix.
      Can't update dom0 over sys-whonix in QubesOS - Qubes-Whonix - Whonix Forum
    • check-ref-commits: check git commit references for validity.
    • lockfile.sh: simple file-locking helper to prevent concurrent runs (to be renamed to lockfile.bsh).
    • detect-software-rendering: detect whether the GPU is using software (CPU) rendering.
    • vbox-ova-reproducible-normalize: normalize a VirtualBox .ova for reproducible builds.
  • GRUB:
    • Theme: pin the theme variant instead of detecting the build host’s firmware, improving reproducibility.
    • Improved support for /boot (symlinks, FAT32), with further improvements planned for the next version.
  • live-config-dist:
    • argument-squashfs-pack: build an optional compressed (squashfs) filesystem for a live system to be installed by the Calamares installer. (Development tool)
    • persistence-setup: set up persistent storage for live systems. (Development tool)
    • mok-enroll-opt-in: enable opt-in Secure Boot key (MOK) enrollment via the MOK_ENROLL=1 environment variable. (Development tool)
  • security-misc:
    • SSH client and server configuration: restricted key exchange to post-quantum algorithms.
  • usability-misc:
    • console-setup: run only when a framebuffer is available (skip on serial/headless systems).
      On a headless or serial-only boot (no GPU and therefore no /dev/fb0), setupcon’s setfont
      cannot work and repeatedly logs ‘setfont: ERROR ioctl(KDFONTOP): Invalid argument’
      in the journal. The console-setup.service drop-in is now gated by
      ConditionPathExists=/dev/fb0, allowing it to be skipped cleanly in these environments.
      Normal graphical boots have /dev/fb0 and remain unaffected.
  • vm-config-dist:
    • Improved detection of whether software rendering is enabled.

Full difference of all changes