Download
Upgrade
Alternatively, an in-place release upgrade is possible using the Kicksecure repository.
This release would not have been possible without the numerous supporters of Kicksecure!
Please Donate!
Please Contribute!
Security Vulnerability Fixes
- Fixed a local privilege escalation vulnerability in a script in the legacy-dist package. (Thanks to Uladzislau Hryharovich for responsibly disclosing this security vulnerability!)
- (The fixed legacy-dist package was already available in the stable repository before this release announcement.)
- A full write-up by the reporter will be linked here once published.
Major Changes
- Ported the ISO build process from live-build (run through derivative-maker) to native derivative-maker (without live-build).
- Progress towards reproducible builds.
- Packages built by Kicksecure are already reproducible. Independent reproduction of packages and comparison of official builds with reproduced builds are welcome so that potential issues can be identified and resolved.
- Non-Qubes-Whonix: the next release might be reproducible.
- (Qubes-Whonix: reproducibility depends on Qubes, not Qubes-Whonix.)
- Internal code review and fixes.
- Major progress on automated testing.
- derivative-maker: opt-in, disabled-by-default SMBIOS reader that allows kernel parameters to be configured at the virtualizer level.
Notable Changes
- desktop-config-dist:
- Removed the QTerminal drop-down keybinding.
- Ported livecheck to Qt6; added D-Bus activation to launch new instances from the Start Menu.
- Restricted livecheck to one running instance at a time; the Start Menu entry now raises the existing livecheck window.
- Hidden the gparted Start Menu entry in user sessions by default (non-functional due to user-sysmaint-split).
- developer-meta-files (build and maintenance tooling):
- dm-review-branch: review changes on a git branch before merging.
- dm-reproducible-compare-artifacts: compare two builds artifact-by-artifact to verify that they are identical.
- dm-nbd-cleanup: clean up leftover block devices after a build.
- bash-style-guide: project coding style guide for shell scripts.
- dm-reproducible-buildinfo: record the exact build inputs needed to reproduce a build.
- dm-reproducible-fetch: fetch build sources deterministically so everyone starts with the same inputs.
- dm-reproducible-verify: rebuild and verify that the result matches the official release bit-for-bit.
- dm-normalize-fat-partition: remove nondeterministic FAT filesystem metadata to make images reproducible.
- dm-debconf-normalize-owners: normalize debconf database ownership for reproducible packaging.
- dm-update-frozen-snapshot: update the pinned package repository snapshot used by the build.
- dm-github-org-security-report: collect open security alerts across the GitHub organization.
- dm-github-org-policy: apply a standard security policy across the GitHub organization’s repositories.
- dist-system-metadata:
- New dist-system-metadata package.
System metadata has been split out of tb-updater so that frequently changing
data (pinned Tor Browser versions and the Tor Project signing key) can
migrate between suites independently of the larger code packages.- usr/share/dist-system-metadata/tb-updater/{tbb_hardcoded_version_stable,
tbb_hardcoded_version_alpha,tbb-team.asc} - Minimal dependencies allow it to migrate to the stable repository quickly.
- usr/share/dist-system-metadata/tb-updater/{tbb_hardcoded_version_stable,
- New dist-system-metadata package.
- helper-scripts:
- dpkg-reconfigure-noninteractive: reconfigure a package without interactive prompts.
- Fixed qubes-dom0-update over sys-whonix.
Can't update dom0 over sys-whonix in QubesOS - Qubes-Whonix - Whonix Forum - check-ref-commits: check git commit references for validity.
- lockfile.sh: simple file-locking helper to prevent concurrent runs (to be renamed to lockfile.bsh).
- detect-software-rendering: detect whether the GPU is using software (CPU) rendering.
- vbox-ova-reproducible-normalize: normalize a VirtualBox .ova for reproducible builds.
- GRUB:
- Theme: pin the theme variant instead of detecting the build host’s firmware, improving reproducibility.
- Improved support for /boot (symlinks, FAT32), with further improvements planned for the next version.
- live-config-dist:
- argument-squashfs-pack: build an optional compressed (squashfs) filesystem for a live system to be installed by the Calamares installer. (Development tool)
- persistence-setup: set up persistent storage for live systems. (Development tool)
- mok-enroll-opt-in: enable opt-in Secure Boot key (MOK) enrollment via the MOK_ENROLL=1 environment variable. (Development tool)
- security-misc:
- SSH client and server configuration: restricted key exchange to post-quantum algorithms.
- usability-misc:
- console-setup: run only when a framebuffer is available (skip on serial/headless systems).
On a headless or serial-only boot (no GPU and therefore no /dev/fb0), setupcon’s setfont
cannot work and repeatedly logs ‘setfont: ERROR ioctl(KDFONTOP): Invalid argument’
in the journal. The console-setup.service drop-in is now gated by
ConditionPathExists=/dev/fb0, allowing it to be skipped cleanly in these environments.
Normal graphical boots have /dev/fb0 and remain unaffected.
- console-setup: run only when a framebuffer is available (skip on serial/headless systems).
- vm-config-dist:
- Improved detection of whether software rendering is enabled.