Release ghaf-26.02.1

This is monthly Ghaf release which has been fully tested on Nvidia Orin NX, Nvidia Orin AGX, Lenovo X1 Carbon Gen11 and System76 Darter Pro platforms

Release Tag

https://github.com/tiiuae/ghaf/releases/tag/ghaf-26.02.1

Supported Hardware

The following target hardware is supported by this release:

NVIDIA Jetson Orin AGX
NVIDIA Jetson Orin NX
Lenovo ThinkPad X1 Carbon Gen 10/11/12/13, Gen9 2-in-1
Lenovo T14 AMD
Dell Latitude 7230, 7330
Alienware M18
System76 Darter Pro
NXP i.MX 8M Plus

What’s Changed

build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.3.0 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1737
build(deps): bump github/codeql-action from 4.31.11 to 4.32.2 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1736
build(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1735
Refactor bit by bit by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1729
Fix intel-laptop target by @nesteroff in https://github.com/tiiuae/ghaf/pull/1728
firewall: add IP blacklisting for ping flood attacks by @enesoztrk in https://github.com/tiiuae/ghaf/pull/1731
nvidia-jetpack: move pre-flash commands into writeShellApplication by @vunnyso in https://github.com/tiiuae/ghaf/pull/1740
Refine deferred disk encryption and passphrase handling by @vunnyso in https://github.com/tiiuae/ghaf/pull/1726
docs: bump the docs by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1743
version bump by @clayhill66 in https://github.com/tiiuae/ghaf/pull/1745
suspend: switch from deep -> s2idle for darp11 by @kajusnau in https://github.com/tiiuae/ghaf/pull/1715
Post refactor fixup by @kajusnau in https://github.com/tiiuae/ghaf/pull/1747
docs: add 26.01.1 release note by @clayhill66 in https://github.com/tiiuae/ghaf/pull/1746
Fixup broken refactor by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1748
refactor: embrace the features! by @kajusnau in https://github.com/tiiuae/ghaf/pull/1749
cleanup: basic formatting changes by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1750
fix: nixos-generators deprecated by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1751
Fix interfaces vm by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1754
Fix/encryption verity decoupling by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1755
Decouple encryption from debug profile by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1756
vtpm: auto assign the baseport to avoid issues by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1757
build(deps): bump cachix/install-nix-action from 31.9.0 to 31.9.1 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1759
build(deps): bump tj-actions/changed-files from 47.0.1 to 47.0.2 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1760
build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1761
desktop: refactor launchers, fix app icons in dock, alt-tab by @kajusnau in https://github.com/tiiuae/ghaf/pull/1732
net-vm: add net-vm features module by @kajusnau in https://github.com/tiiuae/ghaf/pull/1763
Create sysvm attrset by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1766
partitioning: avoid blocking initrd TTY during TPM2 unlock handoff by @vunnyso in https://github.com/tiiuae/ghaf/pull/1764
fix(laptop): increase net-vm memory for darp11 storeDisk configs by @vunnyso in https://github.com/tiiuae/ghaf/pull/1769
zram: enable zram swap for the vms to reduce pressure by @brianmcgillion in https://github.com/tiiuae/ghaf/pull/1770
build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1778
build(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1777
build(deps): bump tj-actions/changed-files from 47.0.2 to 47.0.4 by @dependabot[bot] in https://github.com/tiiuae/ghaf/pull/1776
Update smoke test by @leivos-unikie in https://github.com/tiiuae/ghaf/pull/1783
qemu: fix patch to properly handle lid events by @kajusnau in https://github.com/tiiuae/ghaf/pull/1785
secureboot: rotate bundled enrollment keys from ghaf-infra-pki by @vadika in https://github.com/tiiuae/ghaf/pull/1781
audit: adjust OSPP file activity rules for session users by @everton-dematos in https://github.com/tiiuae/ghaf/pull/1782
Docs: fix broken source url in glossary referencing the Ghaf tree by @mnaamani in https://github.com/tiiuae/ghaf/pull/1773

New Contributors

@mnaamani made their first contribution in https://github.com/tiiuae/ghaf/pull/1773

Full Changelog: https://github.com/tiiuae/ghaf/compare/ghaf-26.01.1...ghaf-26.02.1

Bug fixes

Fixed bugs that were present in the previous release

(System76) Suspension has been disabled - s2idle suspension is now supported
Ping flooding doesn’t trigger blacklisting
Laptop is not locked or suspended when the lid is closed
(X1) Downloading large file (~10GB) crashes the browser
Cosmic settings timezone change does not work

Known Issues and Limitations

Issue	Status	Comments
x86
(X1) Unlock with fingerprint doesn’t work	In Progress	Issue is under investigation
Screenshot is not saved to Pictures	In Progress	Workaround: Creating Pictures folder manually and saving then
WireGuard option missing from chrome-vm and business-vm	In Progress	Will be fixed in next release
NVIDIA Jetson AGX Orin / Orin NX
GUI login does not work	In Progress	Issue is under investigation
Device boots to black screen with only cursor blinking	In Progress	Workaround: Boot with display connected or launch login screen manually by ctrl+C
If suspended, device doesn’t wake-up	In Progress	Issue is under investigation
Locking the device from power menu doesn’t work	On Hold
Unlocking from lock screen does not work	On Hold

Installation Instructions

Released images are available at https://archive.vedenemo.dev/

Download the required image and use the following instructions: Build and Run.