Kicksecure 18 Released! Major Release Upgrade!

News
1

Download

(What is a release upgrade?)

Upgrade

Alternatively, an in-place release upgrade is possible using the instructions: Release Upgrade Kicksecure 17 to Kicksecure 18

This release would not have been possible without the numerous supporters of Kicksecure!

Please Donate!

Please Contribute!

Major Changes

Changelog up to 18.0.8.7

  • bootclockrandomization:
    • Fix output on non-English locale systems
  • desktop-config-dist:
    • Fix taskbar and screen background if broken due to unclean shutdown.
  • developer-meta-files:
    • Check if on expected branch
    • Check for empty directories
  • helper-scripts:
    • set keymap scripts: port to localectl-static for higher reliability inside chroot
    • luks-path-check: fix detection when using Btrfs (to fix swap-file-creator on Btrfs failing to detect encrypted LUKS device)
    • Optimize stsponge memory usage, add NUL byte check to stdisplay malicious Unicode test
    • set-system-keymap now also runs set-grub-keymap
    • Rename strip-html → strip-markup
    • Refactor strip_markup and sanitize_string libraries, add tests
    • Check if Tor is dormant and re-activate Tor
    • Add tor-dormant-check
    • Add tor-signal-newnym
    • Keyboard layout script and localectl-static fixes / optimization
  • kicksecure-meta-packages:
    • Install tor-ctrl by default.
    • Add firmware-carl9170
    • Add new meta package firmware-freedom
  • rads:
  • ram-wipe:
    • Code simplification
    • Fix: no longer enable kexec because ram-wipe fortunately no longer requires kexec. The new default (set by security-misc) is to keep kexec disabled even if ram-wipe is installed, which is installed by default.
    • Fix false-positive detection of remaining encrypted disk still being mounted (Question about RAM Wipe)
  • sdwdate-gui:
    • Make sdwdate-gui-qubes-proxy much less likely to fail, to avoid systemd showing the system as degraded incorrectly
    • Fix cosmetic issue in Qubes sys-net journal: sdwdate-gui-qubes@0-1443-1000.service: Failed with result 'protocol'.
  • security-misc:
    • Fix block-unsafe-logins when running as non-root, add swaylock to list of safe auth services
    • Documentation improvements.
    • Remove the option to reduce the MCE tolerance level
    • Provide options to enable AMD SME and SEV
    • Provide options to panic upon receiving NMIs
    • Set net.ipv4.tcp_tw_reuse=0
    • Add docs on logging martian packets
    • Set bdev_allow_write_mounted=0
    • Set kpti=1
    • Set proc_mem.force_override=ptrace
    • Add another method to disable 32-bit legacy vsyscalls
  • serial-console-enable:
    • Remove gfxterm, as it results in multiple conflicting GRUB menu displays under KVM
  • swap-file-creator:
    • Fix swap file creation on Btrfs filesystem.
    • Also parse .conf files in /etc/default/swap-file-creator.d and /usr/local/etc/default/swap-file-creator.d folders
  • systemcheck:
    • Fix crypt-check to work (Systemcheck incorrectly warns that full disk encryption (FDE) is absent)
    • Check both systemd system and systemd user units that are hung in state failed, activating, or deactivating
    • Silence SRSO warning when running in VMs or containers
    • Fix systemcheck first line (header) when running in non-US languages
    • Fix: no longer matching debug: in critical messages
    • Improve notification of critical kernel messages related to hardware errors
  • tb-updater:
  • tb-starter:
  • tor-ctrl:
    • Fix end-of-options parsing
  • usability-misc:
    • Add optional check-user-slice-on-shutdown.service systemd unit for debugging stuck user processes in session-c1 slice on shutdown
    • Disable orca-kill-at-shutdown.service by default because it might slow down shutdown
  • user-sysmaint-split:
    • Show a notification and log an entry to the system journal if a qrexec action is blocked in sysmaint mode
    • Better error handling in case the disk is read-only without ephemeral overlay
  • sysmaint-panel:
    • Lowercase names of packages being installed, update apt lists if the package isn’t initially found
  • derivative-maker:
    • Fix: avoid need for localectl on the build host
    • ISO builds: require command line parameter --freedom true or --freedom false by default for --architecture amd64 (and i386) only. (Other architectures do not need this as there are no nonfreedom firmware packages installed in any case.)
    • Always install meta package firmware-freedom / firmware-nonfreedom on the ISO by default for official builds. See also: Non-Freedom Firmware and Drivers
  • anon-connection-wizard:
    • Sync hardcoded bridges with Tor Browser, rename meek-azure → meek since the current Meek bridge does not appear to use Azure
  • tor-control-panel:
    • Rename meek-azure → meek since the current Meek bridge does not appear to use Azure

Changelog up to 18.0.7.5 (testers-only version)

  • anon-apt-sources-list:

    • Replace Xfce with LXQt where appropriate.
    • Switch to using deb822 sources.

  • anon-connection-wizard:

    • Remove remaining pkexec references, use privleap only.
    • Avoid an either/or dependency bug.

  • anon-shared-build-apt-sources-tpo:

    • Switch to using deb822 sources.

  • bindp:

    • Use a Makefile when building bindp in the postinst script.
    • Improve security and clean up the code.

  • bootclockrandomization:

    • Remove features from msgcollector that do not work with Wayland.

  • browser-choice:

    • Port to package-installed-check.
    • Add dependency on helper-scripts.
    • Use apt-get-noninteractive.
    • Fix Tor Browser plugin behavior and disable the install option for packages that are already installed.
    • Explain how to install Tor Browser in the user account without installing it into the sysmaint account.
    • fix: No longer depend on tb-updater and tb-starter.
    • Use the Qubes update proxy for all HTTP requests when running in a TemplateVM.
    • Add notifications when a browser installation or removal completes.
    • Fix privileged vs unprivileged execution logic.
    • Do not offer to start a browser in a Qubes TemplateVM.
    • Fix the user session warning message on Qubes OS.
    • Switch to using deb822 sources.

  • calamares-settings-debian:

    • Double the length of most timeouts to accommodate slow installation target media.

  • debug-misc:

  • desktop-config-dist:

    • Prevent lxqt-powermanagement from overriding system-wide defaults with auto-configuration.
    • Redirect output from greeter-launched labwc sessions to the system journal to make debugging easier.
    • Fix a black screen issue for users who had already triggered it.
    • Fix a black screen issue when the first user session reboot or shutdown is done via the command line.
    • Run livecheck-lsblk.service after systemd-tmpfiles-setup.service.
    • Refuse to log into a full graphical session in sysmaint mode or as the sysmaint user.
    • Update default power management settings.
    • Prevent more than one livecheck window from being open at the same time.
    • Improve backlight-tool-dist debug messages and make messaging clearer when there is no brightness to restore.
    • Add a generic lock screen background.
    • Move Waybar configuration for sysmaint sessions to *-base-files packages.
    • Avoid greetd getting stuck on a black screen when authentication fails.
    • Add missing dependencies for wlr-resize-watcher, python3-pyudev and wlr-randr.
    • Create a backlight helper tool, bind it to brightness keys and enable brightness restore on login.
    • Switch greetd labwc configuration to a configuration directory so keyboard layout can be changed in the greeter.
    • Disable the color change on Waybar’s volume widget when hovering.
    • Move swaylock configuration out of desktop-config-dist.
    • Move zsh configuration to usability-misc.
    • Make the battery indicator in sysmaint sessions detect AC plug/unplug events more quickly.
    • Fix Qt application theming under Qubes OS.
    • Slow down the mouse pointer; the previous configuration made it too fast.
    • Signal to the system when the Wayland session has started.
    • Export XDG_CONFIG_DIRS and XDG_DATA_DIRS correctly.
    • Hide unnecessary error output (stderr) where appropriate.
    • Set WLR_RENDERER only on non-Qubes and non-VM systems.
    • Under Qubes OS, do not set GDK_BACKEND and QT_QPA_PLATFORM because Qubes does not support Wayland yet. See Use Wayland instead of X11 to increase performance and improve security · Issue #3366 · QubesOS/qubes-issues · GitHub
    • Fix xdg-desktop-portal support in sysmaint sessions and remove unnecessary dependencies.
    • Make Ctrl+Alt+T launch QTerminal.
    • Turn off the empty tooltip on the Waybar clock.
    • Add a volume widget to Waybar.
    • Make the Waybar clock update every second.
    • Do not run the greetd configuration builder in Qubes.
    • Add desktop configuration for LXQt + labwc.
    • Show a notification about the system’s live state at login when not booting in persistent mode.

  • developer-meta-files:

    • Reject cache directories.
    • Check for empty directories.
    • Add more maintenance automation.
    • Install qubes-core-agent-dom0-updates by default in Kicksecure for Qubes.
    • Add a wrapper for dm-tor-update-repository to dm-packaging-helper-script.
    • Create the dm-tor-update-repository script.
    • Automatically update the VirtualBox Windows SHA256 file.
    • Automatically update the Windows download link.
    • Support scripted git push for Windows-related components.
    • Support scripted git push for Qubes templates.

  • dist-base-files:

  • genmkfile:

    • Check for empty directories.
    • Fix genmkfile deb-cleanup to also delete orig.tar.xz.
    • Delete the genmkfile temporary directory at the end.
    • Add a feature to auto-generate debian/*.install files based on # (hash) in filenames.
    • Make deb-cleanup work with dh_clean.
    • Fix running genmkfile installcheck as non-root.

  • grub-live:

    • Switch back to the overlay-root module and rootovl parameter for live boot; rd.live.overlay.overlayfs is broken with BTRFS.
    • Set the nohibernate kernel parameter (thanks to @desi_fubu for the suggestion). See Support for hibernation? - #6 by desi_fubu
    • Fix a live-hardener submount edge case, improve performance of submount detection and add regression tests (mostly done by ChatGPT Codex).
    • Improve regression test coverage of live-hardener, fix bugs and avoid misleading error messages in logs.
    • Ensure the dmsquash-live module is present in the initramfs and omit the Debian-specific overlay-root module.
    • Remove support for initramfs-tools.
    • Place live-hardener’s overlay repository under /run to avoid issues when /var is on a separate partition.
    • Fix live-hardener behavior when dealing with mount points under non-root mount points.

  • helper-scripts:

    • Add /usr/libexec/helper-scripts/system-ready-check-user.
    • Try to prevent /tmp/user/100* from becoming owned by root because of lockfile.sh.
    • Add /usr/libexec/helper-scripts/systemd-notify.bsh.
    • curl-prgrs: also handle the -o argument.
    • /usr/libexec/helper-scripts/curl-prgrs: fix argument quoting.
    • Port to package-installed-check.
    • Split out /usr/libexec/helper-scripts/package_installed_check and /usr/libexec/helper-scripts/package_installed_check.sh.
    • Add a --no-update-grub option to set-grub-keymap, and refactor and improve the help output in set-keyboard-layout.sh.
    • Adjust how standard input is read in the GRUB keyboard layout setter.
    • Add the set-grub-keymap script and refactor localectl availability checks in set-keyboard-layout.sh.
    • set-system-console: improve the code that regenerates the initramfs.
    • Keyboard layout scripts: use standard output for informational messages, regenerate initramfs images during layout changes, make non-standard options work in interactive mode, enable pipefail, and change --persist to --no-persist.
    • Add luks-path-check.
    • dummy-dependency: use apt-get-noninteractive (but keep --yes opt-in).
    • set-console-keymap: restart keyboard-setup.service.
    • Handle more cases where localectl is unavailable.
    • /usr/libexec/helper-scripts/sudo-tools-enable: add su-to-root.
    • Import br_add_to_file from systemcheck.
    • Fix return codes of linux_user_account_shell_to_zsh. This fixes a bug when installing user-sysmaint-split.
    • set-system-keymap: improve error handling.
    • Reload labwc keyboard layout after changing the system keyboard layout.
    • Improve system-ready-check.
    • /usr/libexec/helper-scripts/pkg_manager_running_check function check_package_manager_running_helper: change API to return 0 on success and non-zero on error.
    • Add tests for the run_as_target_user function.
    • Remove unneeded TMP=/tmp.
    • tor-circuit-established-check: exit with status 0 if a circuit is established, and non-zero otherwise.
    • Create query-sock-pid script and library.
    • Improve read_integer_file.
    • Import read_integer_file from desktop-config-dist.
    • Improve lock screen notifications and their integration with LXQt.
    • Move the lock-screen script to /usr/bin/.
    • Use systemctl --no-pager --no-block where appropriate to avoid blocking on output.
    • Split Tor service wait logic out of qubes.UpdatesProxy.anondist into try-wait-for-tor-service-running.
    • Add leaprun system-ready-check.
    • Code simplification: use ischroot and remove /usr/libexec/helper-scripts/in-chroot.sh.
    • Add set-console-keymap script.
    • Add git.sh.
    • Use standardized detection of kernel_cmdline.
    • Import user-sysmaint-split-check from browser-choice.
    • Add new function sudo_error_exit_if_unavailable.
    • Add in-chroot.sh library and avoid calling localectl in a chroot in set-keyboard-layout.sh.
    • Display keyboard layout change success messages in both interactive and non-interactive modes.
    • Add disallowed-test.
    • Reload labwc if it is running, and show output.
    • Add explicit checks for running as root vs non-root.
    • Improve error handling.
    • set-system-keymap: filter out spurious error messages:
      cat: '/sys/bus/usb/devices/*:*/bInterfaceClass': No such file or directory
cat: '/sys/bus/usb/devices/*:*/bInterfaceSubClass': No such file or directory
cat: '/sys/bus/usb/devices/*:*/bInterfaceProtocol': No such file or directory
    • Show /etc/default/keyboard contents before executing dpkg-reconfigure --frontend=noninteractive keyboard-configuration.
    • Add a set-keymap test plan.
    • Add /usr/libexec/helper-scripts/boot-session-detection.sh and refactor related code.
    • Fix bugs in set-keyboard-layout.sh.
    • Apply an ephemeral keyboard layout change fix from ChatGPT Codex with minor adjustments and set the executable bit on set-keyboard-layout.sh.
    • Refactor set-labwc-keymap into a library and two frontends.
    • Add an interactive UI option and start menu entry for set-labwc-keymap.
    • Fix several autologinchange issues (collapsing lines in greetd incorrectly, failing to remove effectively empty greetd configuration files, and using echo instead of printf).
    • Add lockfile-test.
    • Add /usr/libexec/helper-scripts/lockfile.sh.
    • Add random_alpha_numeric helper.
    • Use passwordless-root --qubes-rw in dev-root when necessary.
    • Use /etc-based sudo enablement in passwordless-root under Qubes by default and require --qubes-rw for the persistent-in-AppVM mechanism.
    • Move passwordless-root from usability-misc to helper-scripts.
    • Fix usage of start-stop-daemon in dist-virtual-keyboard.
    • Allow deleting configuration entries in config_builder.
    • Polish set-labwc-keymap argument parsing, write messages to stderr, and add --no-reload, --config, and end-of-options arguments.
    • set-labwc-keymap: use overwrite and show the contents of the created ~/.config/labwc/environment file.
    • dist-virtual-keyboard: port to start-stop-daemon.
    • Create set-labwc-keymap script.
    • Move dist-virtual-keyboard from usability-misc to helper-scripts.
    • Add env-sorted (env -0 | sort -z | tr '\0' '\n'). Thanks to Iguananaut. See https://stackoverflow.com/questions/60756020/print-environment-variables-sorted-by-name-including-variables-with-newlines
    • Only include the abstractions/tor AppArmor file if it exists.
    • Fix backing device detection for the live ISO root filesystem.
    • Add Wayland screen locker support to the lock-screen script.
    • origins-parser: fix cover status when /etc/dpkg/origins/kicksecure and /etc/dpkg/origins/whonix are no longer symlinks to /etc/dpkg/origins/default.
    • origins-parser: make initialization more robust.
    • Remove no longer required apt-get-update-plus. upgrade-nonroot now uses /usr/bin/apt-get --update full-upgrade instead.
    • Stop modifying .bashrc to keep behavior consistent with zsh.
    • dummy-dependency: use a single apt-get command to remove the original package and install the dummy package.
    • Avoid using shell=True.
    • get-backing-devices-for-mountpoint: improve parsing of /dev/dm* devices.
    • get-backing-devices-for-mountpoint: make symlink resolution more robust.
    • get-backing-devices-for-mountpoint: make parsing of loop devices more robust.
    • Fix live mode tests.
    • Allow overriding kernel_cmdline for test mode.
    • Remove tabs from scripts where not needed.
    • Exit with a non-zero status on error.
    • dummy-dependency: add --cache-only option.
    • dummy-dependency: implement actual package removal or purge.
    • Switch dummy-dependency from using Breaks/Replaces/Provides to using Conflicts/Provides.
    • Add str-replace-many.
    • Move dpkg-noninteractive from usability-misc to helper-scripts.
    • Prevent light_sleep from crashing scripts that use set -e.
    • Remove initramfs-tools-specific debug helper script.
    • Add memory-efficient sleep alternative light_sleep.
    • LXQt porting: add a configuration build utility, revise live mode detection for Trixie, and make package_installed_check.bsh callable as a script.
    • Move upgrade-nonroot from usability-misc to helper-scripts.
    • Move apt-get-reset from usability-misc to helper-scripts.
    • Move apt-get-noninteractive from usability-misc to helper-scripts.
    • Move apt-get-update-plus from usability-misc to helper-scripts.
    • Move security-misc/apt-get-update* to helper-scripts.
    • Add GATEWAY_IP6 variable.

  • icon-pack-dist:

    • Add a rounded version of the Kicksecure logo for the start button.

  • initializer-dist:

    • Remove invalid or broken sources list files during build.

  • kicksecure-base-files:

    • Tell the user how to leave a GRUB submenu.
    • Remove the network icon from the desktop.
    • Use lock-screen from helper-scripts for screen locking, add a lock screen background and remove the now redundant Waybar battery widget.
    • Move Waybar configuration for sysmaint sessions to *-base-files packages.
    • Add swaylock configuration for Kicksecure.
    • Disable the pcmanfm-qt thumbnailer and ensure pcmanfm-qt system-wide settings are honored in both user and sysmaint sessions.
    • Stop modifying .bashrc to keep behavior consistent with zsh.
    • Add /usr/share/kicksecure to XDG_CONFIG_DIRS, add a desktop background for Kicksecure LXQt, and add lxqt-panel and pcmanfm-qt configuration.
    • Bump the Kicksecure version.
    • Advertise a Kicksecure feature flag to enable sdwdate-gui communication.

  • kicksecure-meta-packages:

    • Install vm-config-dist everywhere also on host operating systems (ISO) for better support if run inside VMs.
    • Install usbguard by default.
    • Install nmap by default (includes nping, a TCP-based ping utility useful for debugging network issues). See Ping operation permitted? - Support - Whonix Forum
    • Install qubes-core-agent-dom0-updates by default in Kicksecure for Qubes.
    • Remove upower from Qubes machines.
    • Remove smart-notifier from Qubes machines.
    • Switch kicksecure-qubes-cli from firmware-nonfreedom to firmware-nonfreedom-network.
    • Install extrepo-offline-data by default.
    • Install firmware-nonfreedom by default on Qubes, useful for sys-net.
    • Add liblxqt-backlight-helper to dist-baremetal-gui-lxqt.
    • Add qubes-notification-agent to GUI Qubes systems.
    • Add kanshi to dist-nonqubes-gui-lxqt.
    • Do not install wvkbd in Qubes.
    • Add wvkbd virtual keyboard to dist-general-gui-lxqt.
    • Use the PCManFM-Qt Qubes file manager helper.
    • Install ram-wipe by default on Kicksecure bare metal.
    • Switch image viewer from lximage-qt to loupe.
    • Add wpasupplicant to Kicksecure on Qubes and bare metal.
    • Adjust dependencies for the security-misc split.
    • Merge qubes-whonix metapackages into the main metapackages.
    • Fix metapackage bugs.
    • Add usbguard-notifier to the dist-general-gui-all metapackage.
    • Add qubes-core-agent-network-manager to dist-qubes-cli. This package is required for NetVM; otherwise /usr/lib/qubes/network-manager-prepare-conf-dir is missing and the journal will show:

      NetworkManager.service: Unable to locate executable ‘/usr/lib/qubes/network-manager-prepare-conf-dir’: No such file or directory

    • Fix spacing and add Breaks/Replaces against Xfce metapackages.
    • Add missing firmware packages and a missing Flameshot dependency.
    • Avoid an either/or dependency bug and rework the dummy-dependency system.
    • Use Conflicts rather than Breaks to fix the Lintian warning:

      dummy-dependency-lxqt-policykit: breaks-without-version lxqt-policykit

    • Replace screengrab with flameshot.
    • Adjust for Qubes OS compatibility.
    • Do not install labwc on Qubes OS.
    • Fix some incorrect package dependencies.
    • Restructure metapackages.
    • Add a hard dependency on systemd-cryptsetup.
    • Adjust grub-live installation code for removal of initramfs-tools support.
    • Remove initramfs-tools support.
    • Switch the desktop to LXQt.
    • Add a dependency on USBGuard to enable security-misc’s USBGuard configuration.

  • legacy-dist:

    • Port to the new package-installed-check library.
    • Move sdwdate-gui configuration migration code to the sdwdate-gui postinst script.
    • Rewrite sdwdate-gui configuration gateway=sys-whonix to gateway="sys-whonix".
    • Remove /etc/dracut.conf.d/30-repart.conf during upgrades because it causes spurious errors on Trixie when run within Dracut on Trixie.
    • Remove xscreensaver during release upgrades to Trixie.
    • Replace lightdm (or the active display manager) with greetd on upgrade.
    • Release upgrade: Qubes R4.2 workaround: dummy-dependency qubes-core-agent-pcmanfm-qt.
    • Add a CLI deprecation popup message to the Debian maintainer postinst script.
    • Add CLI support.
    • Implement --force for release-upgrade.
    • Prohibit release upgrades by default on Qubes R4.2 and require Qubes R4.3.
    • Mark CLI as not yet deprecated where appropriate.
    • Document that Kicksecure 17 and Whonix 17 will remain supported until one month after Qubes R4.3 stable has been released. See decide availability of Kicksecure, and Whonix 18 (Debian trixie based) on Qubes R4.2 versus R4.3 · Issue #10219 · QubesOS/qubes-issues · GitHub
    • Rework the dummy-dependency metapackage system.
    • Fix checking whether the tor@default systemd unit is running only when a Qubes Template has been detected.
    • Add metapackage transition handling.
    • Show the deprecation popup also in Qubes.
    • Skip SSH confirmation if DEBIAN_FRONTEND=noninteractive.
    • Bump Kicksecure/Whonix major version number to 18.
    • Remove tb-default-browser during updates. (Merged into package open-link-confirmation.)
    • Allow release info origin and label changes during Bookworm → Trixie upgrades.
    • Add an SSH warning in release-upgrade due to new SSH client and server configuration files.
    • Disable a probably unnecessary repository change in release-upgrade.

  • libvirt-dist:

    • Disable clipboard sharing.
    • Add IPv6 support to the Whonix external network.
    • Change Xfce to LXQt where appropriate.

  • live-config-dist:

    • Double the length of most timeouts to accommodate slow installation target media.
    • Use standardized detection of kernel_cmdline.
    • Port to using set-system-keymap from helper-scripts.
    • Set keyboard layout for the greeter as well.
    • Enhance keyboard layout helper code to work with labwc and handle XKB variants and options.
    • Fix Calamares launch under Wayland.
    • Remove obsolete code from install-host.

  • lxqt-wayland-session:

    • Do not disable hardware cursors in virtual machines.
    • Enable merged configuration in labwc.
    • Enable dh_clean to clean up build artifacts.
    • Silence lxqt-river-init Lintian warning and fix the copyright file.
    • Update to lxqt-wayland-session 0.2.0 and apply Kicksecure-specific patches.
    • Initial commit of this package.

  • mediawiki-shell:

    • Refactor the code and improve correctness (thanks to Ben Grande).

  • msgcollector:

    • msgprogressbar: use a timeout.
    • /usr/libexec/msgcollector/msgprogressbar: handle the SIGINT signal.
    • Use light_sleep.
    • Set KillSignal=SIGKILL so stuck processes are forcefully terminated if needed.
    • /usr/libexec/msgcollector/msgprogressbar: fix terminating the parent program when the progress bar is closed.
    • Avoid an either/or dependency bug.
    • Switch to the LXQt notifier.
    • Replace a recurring 10 second sleep with light_sleep.
    • Remove Wayland-incompatible features from msgcollector.

  • open-link-confirmation:

    • Use standardized detection of kernel_cmdline.
    • Add tb-default-browser transitional package.
    • Fix XDG handling and remove now obsolete tb-default-browser.
    • Configure Firefox so it does not ask to be the default browser.
    • Add HTML and XML MIME types to x-www-browser and select torbrowser as the default browser on Whonix-Workstation.

  • privleap:

    • Add a check for insecure configuration file permissions.
    • Explicitly drop all supplementary groups.
    • Rework the leaprun signal handler to reduce the risk of terminate messages not being sent.
    • Remove sockets for disallowed users on configuration reload.
    • Avoid allowing anyone to run an action that has user or group restrictions for only nonexistent users or groups.
    • Make privleapd pick up changes to group ownership immediately and disconnect disallowed users who still manage to connect. Include minor test refactoring (inspired by ChatGPT Codex).
    • Harden umask as defense in depth against socket ownership vulnerabilities.
    • Fix an incorrect function call for normalizing a group ID.
    • Add username/UID to authorized/unauthorized messages in leaprun, and refactor tests to be easier to work with.
    • Fix leaprun documentation.
    • Make adjustments to pass black, mypy, pylint and regression tests under Trixie.

  • rads:

    • Increase RAM requirements for GUI and pause for five seconds after displaying a low RAM warning.
    • Remove an unnecessary dependency on systemd.
    • Adjust for Wayland.

  • ram-wipe:

    • Comment changes for the security-misc split.
    • Clarify lack of initramfs-tools support.
    • Remove sdmem and the second-stage kexec RAM wipe. Kernel memory zeroing with init_on_free=1 makes the second pass redundant. See RAM Wipe Development Notes (thanks to Kamil Aronowski <kamil.aronowski@3mdeb.com>).

  • repository-dist:

    • Use layouts in repository-dist-wizard rather than manual positioning to prevent UI issues and allow resizing.
    • Extend the signing key validity.
    • Stop unnecessarily using dh_python.
    • Check if /etc/apt/sources.list.d/derivative.list exists before deleting it to avoid repeated verbose deletion messages.
    • Switch to using deb822 sources.

  • sdwdate:

    • Trim about a quarter second off of sdwdate’s apparent startup time by notifying systemd of startup earlier.
    • Move sclockadj build into postinst and remove an obsolete adduser call.
    • Remove a down onion.debian.org time source:
      http://iebkxzjscv4jgaucepdbdf4b7bqmcwd5peulm5cbpoavlsnkfhda5gyd.onion (see archived link https://web.archive.org/web/20210430195930/https://onion.debian.org/).
    • Remove Mullvad time sources referenced here: Suggest Trustworthy Tor Hidden Services as Time Sources for sdwdate - #254 by Patrick - Development - Whonix Forum
    • Add a Startpage onion URL (thanks to Nurmagoz).
    • Collect all SecureDrop URLs in one place (thanks to Nurmagoz).
    • Fix Depends: util-linux-extra (provides hwclock).
    • Remove down or duplicated time sources.
    • Port to privleap and remove the dependency on sudo.
    • Harden the C code to make it more robust and secure.
    • Stop using dh_python to avoid replacing shebangs:
      dh_python3 was replacing shebangs in:
      • debian/sdwdate/usr/share/sdwdate/get-time-from-servers-test
      • debian/sdwdate/usr/share/sdwdate/onion-list-all
      • debian/sdwdate/usr/share/sdwdate/onion-tester
      • debian/sdwdate/usr/bin/url_to_unixtime
    • Add Mullvad search engine leta onion mirror (thanks to Nurmagoz).
    • Stop using the sleep binary; this is no longer necessary.

  • sdwdate-gui:

    • Tell systemd when sdwdate-gui-qubes@.service is initialized and running.
    • Send repeated Tor status messages if the server restarts.
    • Do not make the sdwdate-gui-qubes service fail if the sdwdate-gui-server VM is not running.
    • Prevent sdwdate-gui-qubes-proxy-helper from possibly delaying boot.
    • Fix menu flashing and CPU usage issues, and prevent massive notification floods when qrexec fails; harden code paths.
    • Move sdwdate-gui configuration migration code to the sdwdate-gui postinst.
    • Improve handling of invalid data (based on ChatGPT Codex suggestions).
    • Add better exception handling for configuration file parse failures and refactor the main loop in sdwdate_gui_client to satisfy pylint.
    • Add Depends: python3-pyinotify.
    • Fix icon change failures when a Whonix-Workstation is shut down and remove confusing information from a docstring.
    • Autodetect the server socket location rather than hardcoding it in sdwdate-gui-qubes-proxy-helper.
    • Remove no longer necessary dependencies on sudo.
    • Port sdwdate_gui_client.py to asyncio/pyinotify instead of Qt.
    • Rename sdwdate.Connect(Check) to sdwdate-gui.Connect(Check).
    • Change the sdwdate-gui tooltip to indicate that right-click opens the menu.
    • Avoid hanging with an error icon if Tor or sdwdate is not started when sdwdate-gui-client starts.
    • Make sdwdate-gui configuration parsing more robust, also parse /usr/local/etc/sdwdate-gui.d.
    • Enable Qubes-related services only on Qubes OS.
    • Disable left-click on the sdwdate-gui icon.
    • Add rm_conffile commands for migration to the new sdwdate-gui architecture.
    • Add more sdwdate-gui rewrite bug fixes.
    • Fix memory management issues in client and server.
    • Rewrite sdwdate-gui to use a client-server model.

  • security-misc:

    • Add a pkexec remembered-permissions fix for permission-hardener and fix some postinst bugs.
    • Remove obsolete migration code for permission-hardener and add initial state installation code.
    • Do not break passwordless sudo in unrestricted admin mode.
    • Port to package-installed-check.
    • Fix passwordless login for sensitive accounts and only deny passwordless privilege escalation.
    • Add kill-vboxdrmclient-on-shutdown.service.
    • Prevent non-sysmaint logins in sysmaint mode and unsafe passwordless logins in user mode.
    • Revert “Force immediate kernel panic on OOM”. See Consider enabling `panic_on_oom` · Issue #324 · Kicksecure/security-misc · GitHub
    • Suppress usbguard startup unless a USB controller is visible to lspci.
    • Move usbguard reject rules to the top.
    • Update README.md with information about Flatpak authentication hardening.
    • Remove Unicode characters where they were problematic.
    • Lock down Flatpak software management. Now requires sysmaint session if using user-sysmaint-split.
    • Use standardized detection of kernel_cmdline.
    • Do not start usbguard-notifier if /sys/bus/usb does not exist.
    • Fix USBGuard-notifier accept / reject buttons. See USBGuard - what should we allow or disallow by default? - #49 by Patrick
    • Set USBGuard to permit USB hubs and Qubes USB passthrough.
    • Allow listing USB devices via usbguard.
    • Separate ptrace() disabling into its own file.
    • [reverted] Force immediate kernel panic on OOM. This is intended to avoid security features such as the screen locker, kloak and emerg-shutdown being terminated when the system runs out of memory. See Screen Locker (In)Security - Can we disable these at least 4 backdoors? - #14 by arraybolt3 - Development - Whonix Forum and Consider enabling `panic_on_oom` · Issue #324 · Kicksecure/security-misc · GitHub (vm.panic_on_oom=2). [reverted] (Needs future work.)
    • Update documentation on slab_debug for future improvements.
    • Add documentation about risks associated with IPv6 Router Advertisements.
    • Fix emerg-shutdown gcc build.
    • Allow users in the qubes group to access USBGuard IPC.
    • Disable usage of ptrace() by all processes.
    • Add additional hardening to emerg-shutdown.
    • Add a notice on public releases in the README.
    • Update strings for the security-misc split.
    • security-misc → security-misc-shared package migration. See Split the `security-misc` into `security-misc-shared`, `security-misc-desktop` and `security-misc-server` · Issue #187 · Kicksecure/security-misc · GitHub
    • Add Replaces: security-misc
    • Add security-misc-server placeholder
    • Implement packaging split for security-misc
    • Add genmkfile debdistfile.
    • Split security-misc into security-misc-shared, security-misc-desktop and security-misc-server, rename files. See Split the `security-misc` into `security-misc-shared`, `security-misc-desktop` and `security-misc-server` · Issue #187 · Kicksecure/security-misc · GitHub
    • Enable vmscape=force.
    • Allow users in the sudo group to use usbguard-notifier.
    • Update SRSO documentation.
    • Allow USB devices that are already connected at USBGuard start time.
    • Enable USB video and audio devices, and reject USB RNDIS devices.
    • Disable RNDIS due to unfixable security issues.
    • Remove initramfs-tools support.
    • Disable memlockd service by default and fix its systemd path.
    • Disable emerg-shutdown and ensure-shutdown on Qubes OS.
    • Fix XDG handling, replace Xfce references with LXQt where appropriate, and make USBGuard configuration work correctly.
    • Update documentation on instant reboot on kernel panic.
    • Update documentation on the oops boot parameter.
    • Add a reference on conntrack helpers.
    • Enable ia32_emulation=0.
    • Temporarily revert IA32 documentation updates (earlier IA32 doc changes were later reverted).
    • Update the kernel panic service description.
    • Set sysctl kernel.panic=-1.
    • Clarify documentation on panics on oops and warnings (later reverted by IA32 doc revert).
    • Clarify documentation on disabling 32-bit x86 support (later reverted by IA32 doc revert).
    • Polish USBGuard configuration.
    • Remove obsolete Thunderbird configuration hardening.
    • Set hard and soft limits on core file size at the same time.
    • Move security-misc/apt-get-update* to helper-scripts.
    • Add SSH hardening configuration.
    • Update documentation on recovery restrictions.
    • Update various documents.
    • Upgrade sysctl settings and related documentation on kernel panics.
    • Enable cfi=kcfi.
    • Set soft limit for core dumps to 0 (thanks to nexus$).

  • setup-dist:

    • Adjust for new rads filenames.

  • setup-wizard-dist:

    • Port to package-installed-check.
    • Autostart setup-wizard-dist when /etc/systemcheck.d/autostart or /usr/local/etc/systemcheck.d/autostart exists (developer feature).
    • Skip the finish page inside Qubes.
    • Show which done file has been found in terminal output for easier debugging.
    • Fix keyboard layout change instructions for Whonix-Gateway.
    • Adjust keyboard layout change instructions for labwc.

  • swap-file-creator:

    • Allow running swap-file-creator inside Xen / Qubes when DO_PRE_CHECK=no is set.
    • Use a configuration file to allow users to disable the LUKS check and fix related issues.
    • Move to helper-scripts.
    • Speed up skipping behavior under Qubes.
    • Allow forcing creation of a swapfile on unencrypted systems, do not remove the swapfile if unnecessary, and adjust wording.
    • Stop creating encrypted swapfiles; only create swapfiles on LUKS volumes, delete swapfiles on shutdown, and improve do_stop reliability.
    • Remove initramfs-tools support.

  • sysmaint-panel:

    • Adjust to the new lock-screen script location.
    • Hide set system keymap and toggle on-screen keyboard buttons on Qubes OS.
    • Add a button for set-system-keymap.
    • Add a display configuration button.
    • Add on-screen keyboard and LXQt configuration buttons, and reformat code with black.
    • Remove dependency on usability-misc (required functionality moved to helper-scripts).
    • Move security-misc/apt-get-update* to helper-scripts.

  • systemcheck:

    • Detect the potential VirtualBox green turtle issue.
    • Check for self-detected stall on CPU.
    • Improve the system ready check.
    • Point out both failed and activating systemd units.
    • Tone down tirdad checks in Qubes when using --verbose.
    • Port to shell-based br_add (helper-scripts, strings.bsh) to fix:
      /usr/libexec/systemcheck/check_services.bsh: line 51: /usr/libexec/msgcollector/br_add: Argument list too long
    • Silence more journal warnings.
    • Prevent a silenced harmless labwc error message from causing systemcheck to fail.
    • Silence another journal warning.
    • Wait for both of these commands:
      • systemctl --wait is-system
      • systemctl --user --wait is-system
    • Fix AppArmor tests when using a non-English system locale.
    • Port to light_sleep.
    • Simplify the login security table now that the sysmaint account is no longer locked by default.
    • Improve the system ready check further.
    • Report if no systemd units failed in verbose mode.
    • Always check for failed systemd units, not only with --verbose.
    • Check if man is functional.
    • Remove undocumented --test-connect feature to simplify the code.
    • Polish control port and systemd status messages (thanks to assisted-by-ai bot).
    • Fix some mistakes in journal ignore lines and add more patterns.
    • Add new command line tool updatecheck and rename usr/libexec/systemcheck/updatecheck to usr/bin/updatecheck.
    • updatecheck: add leaprun system-ready-check.
    • updatecheck: improve error handling.
    • Remove an unnecessary dependency on systemd.
    • Fix broken pipe handling.
    • Disable lockfile due to bugs.
    • Wait for multi-user.target or sysmaint.target.
    • Prevent duplicate runs of systemcheck using a lockfile.
    • Use standardized detection of kernel_cmdline.
    • In ex_funct, fall back to the failed command’s exit code if EXIT_CODE is empty or 0.
    • Use curl --proxy-user for better stream isolation.
    • Suggest migrating from /etc/apt/sources.list/derivative.list to /etc/apt/sources.list/derivative.sources using the repository-dist utility.
    • Remove the user-sysmaint-split exception for Whonix-Gateway.
    • Isolate log checking code so less privileged users cannot leak journal and dmesg logs.
    • Only include the abstractions/tor AppArmor file if it exists.
    • Make disk encryption checks substantially more robust.
    • Silence more journal warnings.
    • Remove the virtualizer success check, because systemd-detect-virt exits non-zero on bare metal.
    • Document a USB module load order issue under VirtualBox and silence the corresponding warning.
    • Silence more bogus journal warnings.
    • Fix Qubes network settings checks inside Qubes sys-net.
    • Move the deprecation notice to legacy-dist.
    • Hide confusing output from:
      systemctl --global disable updatecheck.service
The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=, Also=, or Alias= settings in the [Install] section, and DefaultInstance= for template units). This means they are not meant to be enabled or disabled using systemctl. Possible reasons for having these kinds of units are:
* A unit may be statically enabled by being symlinked from another unit's .wants/, .requires/, or .upholds/ directory.
* A unit's purpose may be to act as a helper for some other unit which has a requirement dependency on it.
* A unit may be started when needed via activation (socket, path, timer, D-Bus, udev, scripted systemctl call, ...).
* In case of template units, the unit is meant to be enabled with some instance name specified.
    • Comment and dependency changes for the security-misc split.
    • Switch to using light_sleep in canary-daemon.
    • Switch to using deb822 sources.
    • Move security-misc/apt-get-update* to helper-scripts.

  • tb-starter:

    • Do not make Tor Browser the default image viewer.
    • Adjust for Wayland compatibility and remove the obsolete tb-default-browser dependency.

  • tb-updater:

    • Remove an unnecessary dependency on sudo.
    • Use curl --proxy-user for stream isolation.
    • Un-reverse chroot-pre and chroot-post.
    • Re-enable chroot handling and make it safer.
    • Adjust for LXQt/Wayland and remove obsolete dependency on tb-default-browser.
    • Fix default behavior in Qubes Templates: skip the network interface availability test by default, because Qubes Templates are non-networked by default. (Thanks to baxter.) See Tor browser downloader fails in whonix-workstation-17 template - Qubes-Whonix - Whonix Forum

  • tor-control-panel:

    • Fix the journal log viewer.
    • Avoid an either/or dependency bug.

  • usability-misc:

    • Skip set-grub-keymap in Qubes.
    • Silence spurious messages from Lintian.
    • Do not try to run set-grub-keymap in a chroot at all.
    • Do not update GRUB when building GRUB keyboard layouts if running in a chroot.
    • Fix GRUB keyboard options menu and generate GRUB keyboard layouts on upgrade or installation when possible.
    • Move the keyboard menu to the bottom of the boot menu.
    • Add a keyboard layout menu to GRUB.
    • Detect user-sysmaint-split.
    • dist-installer-cli: fix by running chmod o+r on created sources list files.
    • Remove a problematic tty check from 50_default_editor.sh.
    • Simplify code by merging /usr/libexec/default-editor/default_editor.sh into /etc/profile.d/50_default_editor.sh.
    • /usr/libexec/default-editor/default_editor.sh: set default editor to featherpad (part of the port to LXQt).
    • Polish additional dist-installer messaging grammar (thanks to assisted-by-ai bot).
    • Add tests for run_as_target_user.
    • Enable systemd-journald audit transport, required by apparmor-info and apparmor-watch. Run deb-systemd-helper enable systemd-journald-audit.socket. Debian no longer enables systemd-journald-audit.socket by default (see Debian bug #1038993).
    • Keep polkit-mate-authentication-agent-1 from launching when it is unnecessary.
    • Suppress startup of USBGuard-related units if no USB controller is found on the system.
    • Add a missing preinst script header.
    • dist-installer-cli (Trixie-based): install VirtualBox from the Oracle repository because VirtualBox is not yet in Debian fasttrack and Debian unstable is no longer compatible with Trixie.
    • Move passwordless-root from usability-misc to helper-scripts.
    • Move dist-virtual-keyboard from usability-misc to helper-scripts.
    • dist-virtual-keyboard: port to start-stop-daemon.
    • Add a wrapper script and desktop files for the virtual keyboard.
    • Switch default file manager to PCManFM-Qt.
    • dist-installer-cli: use a more minimal APT pinning configuration.
    • dist-installer-cli: adjust APT pinning to handle cases where sid is used instead of the generic unstable suite.
    • dist-installer-cli: implement --noupgrade development option to ignore pending upgrades.
    • dist-installer-cli: Fedora VirtualBox version bump.
    • dist-installer-cli: fix APT pinning to prefer stable (trixie at the time of writing) over unstable.
    • dist-installer-cli: fix so it does not enable the unstable repository as a fallback.
    • dist-installer-cli: support new key location /usr/share/keyrings/debian-archive-keyring.pgp.
    • dist-installer-cli: test whether the signed-by key exists.
    • dist-installer-cli: add Kali signed-by handling.
    • Move config-package-dev displace handling from desktop-config-dist to usability-misc.
    • Fix packaging: migrate zsh configuration files for config-package-dev.
    • Restore the Flameshot executable displace that was dropped by accident.
    • Add Breaks/Replaces against desktop-config-dist (<< 3:13.8-1).
    • Delete superfluous man pages.
    • Import zsh configuration from desktop-config-dist.
    • dist-installer-cli: string changes for security-misc split.
    • curl-download / scurl-download: port to wcurl.
    • Add Flameshot compatibility wrapper.
    • Fix VirtualBox with Linux 6.12 and higher.
    • Keep VirtualBox and KVM from conflicting.
    • Move dpkg-noninteractive from usability-misc to helper-scripts.
    • Adjust for Wayland/LXQt.
    • dist-installer-cli: add deb822 support, make variable handling safer, and rename some variables.
    • dist-installer-cli: reduce testing and unstable pin priority to avoid unintentionally upgrading a system to Testing or Sid.
    • Move upgrade-nonroot from usability-misc to helper-scripts.
    • Move apt-get-reset from usability-misc to helper-scripts.
    • Move apt-get-noninteractive from usability-misc to helper-scripts.
    • Move apt-get-update-plus from usability-misc to helper-scripts.
    • Remove apt-cacher-ng-prepare/undo; image builds now use approx instead.

  • user-sysmaint-split:

    • Remove qubes-whonix-sysinit.service.
    • Ensure sysmaint account password is unlocked upon creation since a PAM-based locking mechanism is used.
    • Add After=systemd-tmpfiles-setup.service to wait for systemd-tmpfiles-setup.service to create /run/qubes-rpc.
    • Add sysmaint-boot dependency on kill-vboxdrmclient-on-shutdown.service.
    • Stop locking the sysmaint account and remove xscreensaver code.
    • Improve exposure of informational and error messages in sysmaint-boot.service.
    • Hide the gsmartcontrol start menu entry because it is incompatible with user-sysmaint-split.
    • Restrict su-to-root (similar to sudo) so it is non-executable for non-root users, making failures clearer.
    • Clean up a previous sysmaint graphical session when starting a new one if needed.
    • Fix lxqt-powermanagement startup; it was starting too early.
    • Start lxqt-powermanagement in sysmaint sessions for sleep and screen locking.
    • Add more important systemd units to sysmaint-boot.target.
    • Start qubes-bind-dirs.service in sysmaint sessions.
    • Start qubes-updates-proxy.service in sysmaint sessions to fix template updates when Whonix-Gateway (sys-whonix) is booted in sysmaint mode.
    • Use standardized detection of kernel_cmdline.
    • Change default to sysmaint_session_wayland='yes'.
    • Enable backlight restore in sysmaint sessions.
    • Run wlr-resize-watcher in sysmaint sessions.
    • Enable passwordless root in Qubes unrestricted admin mode when the user password is locked.
    • Avoid crashing greetd when sysmaint autologin is disabled.
    • Stop logging into a full desktop session when sysmaint autologin is disabled.
    • Enable merged configuration in labwc.
    • Export LABWC_PID to allow easier compositor reconfiguration.
    • Set XDG_SESSION_TYPE correctly in sysmaint sessions.
    • Stop disabling UUIDs in grub.cfg.
    • Fix sysmaint Wayland session startup on physical hardware.
    • Adjust comments and dependencies for the security-misc split.
    • Signal to the system when the Wayland session has started.
    • Fix memory ballooning under Qubes OS.
    • Avoid spurious error messages if /etc/X11/default-display-manager does not exist.
    • Fix sysmaint session Qt theming.
    • Unmute audio in the sysmaint session since there is no easy way for users to unmute it otherwise.
    • Autostart LXQt notification service.
    • Switch back from lxqt-policykit to mate-polkit.
    • Remove initramfs-tools support.
    • Improve Wayland support.
    • Do not source Bash scripts from POSIX sh grub.d scripts.
    • Do not unset GRUB_DEVICE_UUID unless using initramfs-tools.

  • vm-config-dist:

    • Set labwc resolution to 1024x768 by default under Xen. This is to work arround various Qubes HVM upstream issues: Kicksecure for Qubes - HVM Issues
    • Port to package-installed-check.
    • Bring back vbox-guest-installer.
    • Delay suppress-power-management-in-vms.service until tmp.mount is finished.
    • Ensure vm-config-dist XDG_CONFIG_DIRS settings take precedence over desktop-config-dist.
    • Make vm-config-dist safe for installation on all platforms and remove unneeded code.
    • Disable wlr_resize_watcher on physical hardware, remove /mnt/shared bookmarks on platforms other than VirtualBox and KVM, and make postinst safe.
    • Use better settings for disabling LXQt power management.
    • Suppress VM power management under LXQt.
    • Switch from glxinfo to eglinfo in /etc/profile.d/20_software_rendering_in_vms.sh.
    • Simplify code by removing unmaintained KDE-related functionality.
    • Stop shipping config-package-dev displace for /etc/gdm3/daemon.conf.dist and undisplace for the same file, because gdm3 is no longer supported out of the box. Autologin in VMs is now handled by autologinchange.
    • wlr_resize_watcher: set all displays to 1920x1080 when dynamic resizing is not possible.
    • Do not start wlr-resize-watcher needlessly in Qubes.
    • Add Depends: python3-pyudev for wlr-resize-watcher.
    • Suppress unwanted PIDs being written to stdout in wlr-resize-watcher.
    • In wlr-resize-watcher, do not error out if an expected but nonessential component is missing.
    • Add hypervisor-specific graphics helper checks to wlr_resize_watcher.
    • Make wlr_resize_watcher.py valid as a standalone Python executable.
    • Clean up and reformat wlr_resize_watcher with black.
    • Fix wlr_resize_watcher mypy and pylint issues.
    • Add a tool for dynamic resolution resizing on wlroots-based compositors.
    • Fix spice-vdagent wrapper.
    • Fix AC97 audio speed.
    • Make spice-vdagent able to launch under Wayland via Xwayland.
    • Switch from p7zip-full to 7zip.
    • Fix XDG handling.

  • qubes-template-kicksecure:

    • Fix failure to install firmware-nonfreedom during template build.
    • Fix metapackage name and point to the trixie-developers repository.
    • Use pcmanfm-qt instead of Thunar.
    • Remove apt-key call, which no longer exists in Debian 13.
    • Switch to LXQt.
    • Switch to using deb822 sources.

  • derivative-maker:

    • Fix theming for the ISO keyboard layout menu.
    • Avoid shredding the hostname when the build host’s hostname matches.
    • Port to package-installed-check.
    • Generate GRUB keyboard layout files during image builds.
    • Fix more reliable chmod +r for debian.sources.
    • Make grml-debootstrap able to set locale to en_US.UTF-8 during image builds.
    • Do not yet install VirtualBox by default inside the cowbuilder chroot. Enable after running build-steps.d/*_create-vbox-vm inside the chroot. (Needs further work.)
    • Enable passwordless sudo for the current user ($USER) after the build process starts to avoid sudo: a password is required errors.
    • For ISO builds, ensure /etc/apt/sources.list.d/debian.sources is readable by “others”.
    • Update VirtualBox download links for the Whonix Windows Installer.
    • Stop downloading VirtualBox from Debian unstable / sid because it is no longer compatible with trixie.
    • Install user-sysmaint-split by default also on Whonix-Gateway VMs.
    • Clear repository metadata from approx’s cache before a build.
    • Add VirtualBox guest additions from Debian unstable to the ISO.
    • Use consistent options for dist-installer-cli (VirtualBox installer by Kicksecure developers) on the build host and inside pbuilder-chroot-script-virtualbox.
    • Simplify code.
    • Isolate the APT state directory when using temporary APT repositories.
    • Fix stray mount device tests when using --target root.
    • VirtualBox version bump.
    • Run virtualbox-installer with --noupdate because the system has already been updated; this avoids race conditions when new updates appear during the build.
    • Disable VBox clipboard sharing and drag and drop.
    • Fix tirdad package cleanup and switch back to AC97 audio for VirtualBox.
    • Add lxqt-wayland-session.
    • Bump RAM for CLI VMs to 768M to prevent freezing.
    • Fix Kicksecure CLI VM builds (now referred to as server).
    • Code cleanup: Remove no longer Ubuntu sources which were no longer used for many years.
    • Fix origin and label for Trixie.
    • Revert incorrect bullseye / bookworm labels.
    • Add temporary workarounds for the port to Trixie.
    • check-operating-system-version: allow Bookworm to build Trixie based images.
    • Remove support for initramfs-tools.
    • Port to Debian Trixie.

Full difference of all changes

https://github.com/Kicksecure/derivative-maker/compare/17.4.4.6-developers-only…18.0.8.7-developers-only

(This forum post was previously a call for testers. No release critical bugs where found during the testing period. This forum post was therefore transformed into a stable release announcement. See edit history.)

3 Likes
2

Fantastic work!

1 Like
3

Hi, I already am running kicksecure 17 on a macbook 11,3 and it works fine. I downloaded the testing iso, burnt to usb, held down option and selected the usb. I tried every grub entry option and after I select it, it runs a line or 2 (something about dracut) and then the laptop just turns off.

I tried to edit the grub entries to add nomodeset but that also had the same result. I re-downloaded the iso, tried a different usb and get the same result.

As a test I downloaded the xfce kicksecure, did exactly the same method of writing it to the same USB etc.. and it booted into the usb livemode with no errors. So it is surely something with this 18.0.7.5 iso.

I just noticed there is a 18.0.7.6 in the op, I will try that now.

Wonderful! It works a dream! ( whatever you changed from .5 to .6 worked.)
Thanks to all, it looks great.

1 Like
4

(This forum post was previously a call for testers. No release critical bugs where found during the testing period. This forum post was therefore transformed into a stable release announcement. See edit history.)

2 Likes
5

Hello all - I am new here and have been testing the 18.0.8.7 LXQt iso on bare-metal machines - one with a WiFi only connection and the other with ethernet - played around after install and all looks very good. I am very interested in further testing and am currently taking a good look at all the documentation related to same.

Am available to test on regular basis and would appreciate any pointers as to priorities.

3 Likes
6

The most important is probably installing, booting, boot modes, persistence, upgrading, systemcheck. If any of that is broken (except systemcheck), that would be pretty bad. For example, if upgrading was broken, then smaller bugs could not be fixed through upgrades.

Try your personal use cases. If you that that, then that’s already super helpful and a lot.

Here’s our official plan for now:

2 Likes
7

Tks - will check this out.

2 Likes