Skip to content
Ghaf Framework

Release ghaf-26.08.1

This Ghaf release is for x86 platforms, it has been fully tested with the reference HW platforms

Release Tag

Section titled “Release Tag”

https://github.com/tiiuae/ghaf/releases/tag/ghaf-26.08.1

Supported Hardware

Section titled “Supported Hardware”

Reference HW platforms:

  • Lenovo ThinkPad X1 Carbon Gen 11
  • System76 Darter Pro

Generic HW support:

  • Generic x86_64 systems supporting UEFI boot and hardware virtualization
  • Hardware compatibility may vary depending on graphics, networking, audio, and peripheral devices

What’s Changed

Section titled “What’s Changed”

🚀 Features

Section titled “🚀 Features”
  • access-control: Enable acl if TLS is enabled - (b432ee8)
  • acl: ACL implementation - (3dcd45b)
  • acl: Acl rules for VMs - (a9eb506)
  • builders: Export pre-bound builders and add extraInputs - (2243f85)
  • cosmic: Add panels option - (d4c05da)
  • cosmic: Make shortcuts configurable - (04e36a6)
  • firewall: Apply uplink-dependent rules at runtime - (7ba0849)
  • flatpak: Add remotes and store options - (e88d3ab)
  • givc: Expose app-vm services option - (3ae09f1)
  • gpu-vm: Plumb the physical display to gpu-vm on Orin AGX - (71d350f)
  • gpuvm: Integrate CDI and managed GPU partitions - (b01c483)
  • jetson: Add support for UKI image generation - (ac00d03)
  • keys: Add debug developer key for Eyad - (dadfaff)
  • logging: Logging can be enabled without forwarding - (cf4a07e)
  • matrix: Fix the build matrix - (5349fd0)
  • netboot: Abstract out common installer - (f73b21f)
  • netboot: Add netboot installer - (e6003fb)
  • netboot: Add netboot server to devshell - (338d6d4)
  • netboot: Add tests - (bfef8a9)
  • netboot: Unattended install and docs - (77b52be)
  • netboot: Tune to run against Dell devices - (2b01173)
  • netvm: Resolve the LAN-facing interface at runtime (observe only) - (2e1f013)
  • netvm: Drive smcroute and nw-packet-forwarder from the resolved uplink - (335da09)
  • orin: Two-VM host1x ownership split (GPU compute + software display) - (0727322)
  • orin: Accelerated single-gui-vm with GPU/display passthrough - (f14cec2)
  • orin: App VM support on the accelerated profile - (4e16e10)
  • orin: Secure boot support for UKI - (69b64b3)
  • orin: Add UKI targets for orin - (49c52bf)
  • orin/guivm: COSMIC desktop bring-up on Tegra - (b4dceea)
  • orin/nx: Three-vm split and accelerated gui-vm topologies - (2ef9688)
  • partitioning: Make disko volume sizes configurable - (c7f7874)
  • passthrough: Integrate the Crosvm device lifecycle - (164bf14)
  • profiles: Wire the system VMs in laptop-x86, as orin already does - (eb83dfd)
  • spire: Support named agent instances - (32f814f)
  • spire: Support upstream agent integration - (e682753)
  • ssh: Add ssh release configuration - (686ad97)
  • targets: Reduce the number of actual targets - (8557657)
  • targets: Enable Crosvm for generic Intel laptops - (425f2f6)
  • yubikey-ssh: Add yubikey ssh script - (7c7d6a3)

🐛 Bug Fixes

Section titled “🐛 Bug Fixes”
  • adminvm: Consume spplyVmConfig when it is set - (5e609c0)
  • appvm: Type-check the applications passed to mkAppVm - (f02ed1e)
  • audiovm: Restore Bluetooth after device reattach - (473a3f6)
  • backlight: Host backlight control gating - (b47f8c7)
  • backlight: Bring the panel up usable when there is nothing to restore - (db72e95)
  • bluetooth: BLE mouse doesn’t work - (1840cb0)
  • bot: Mad skills - (44a5f4f)
  • builders: Call getConfig with a VM entry, not an attrset - (74a386c)
  • camera: Fix internal camera routing dell - (d0622db)
  • chrome-extension: Support user-data-dir needed - (be2c453)
  • chromecast: Bound the externalNic wait so a wrong NIC fails visibly - (6244358)
  • ci: Reduce build eval worker pressure - (3aee63a)
  • ci: Remove the accelerated gui cross from build matrix - (b20cd9f)
  • ci: Pin nix-eval-jobs to 2.34.3 for the eval workflow REVERT - (594b6e0)
  • cosmic: Make panel applets respond to touch - (1f0d6f7)
  • cosmic: Fix our patches to epoch-1.5 - (442eb0d)
  • cosmic: And unhide_delay to autohide - (5235422)
  • cosmic: Recover applets after suspend - (b867001)
  • cosmic-greeter: Fix focus on unlock input - (b65ed92)
  • cosmic-greeter-daemon: Authentication errors - (3256d40)
  • cosmic-panel: Autohide - (3ddc569)
  • cosmic-settings-daemon: Restart cosmic-settings after resume - (f1924f0)
  • crosvm: Support Intel laptop device passthrough - (09882ea)
  • crosvm: Close review and lifecycle regressions - (b6af0c8)
  • crosvm: Update device manager and kernel boot target - (f824dd6)
  • element: Update for the latest - (98f99c7)
  • errors: Caught during ci-test-automation run - (4a4975b)
  • errors: Using incorrect waits during boot - (9c18291)
  • event-proxy: Access control rule based on event source - (8c38c85)
  • firewall: Relax flood limits and bound ban time on debug images - (6286094)
  • flake: Avoid eager verity target evaluation - (0d994d9)
  • flake: Incorrect pin used for crosvm - (59ff1fb)
  • flash: Pass image to bmaptool in prebuilt-bmap path - (5ae5ffc)
  • fss: Make sealed logging recovery evidence-backed - (b04a140)
  • fss: Use Wants instead of Requires for the clock-readiness barrier - (3fba42d)
  • fss: Cap receipt-excused archived FAIL at warning, never a silent pass - (dda483d)
  • fss: The sealing and verification key diverge - (acf7e24)
  • fss-triage: Stop interpolating root-controlled values into bash -lc - (d8bb4dd)
  • givc: Use time and locale from givc - (6617c63)
  • givc-cli: Route stop service commands through CLI - (8be939a)
  • gpuvm: Cover partitioning in NX debug build - (c6fe0c7)
  • graphana: Version bump changed overlay target - (962aa77)
  • greetd: Fix the pam handling of the login auth - (31fdabe)
  • guivm: Gate the flatpak profile entry on the share, not the VM - (257c6e7)
  • installer: Include the dependencies - (9a37dc8)
  • intel-laptop: Blacklist WWAN modules to stop a shutdown hang - (43d5d79)
  • lib: Stop vmConfig dropping mem when vcpu is also set - (9f03db4)
  • logging: Too verbose and spire too eager - (deb1e64)
  • logging: Take the clock-readiness barrier off the VM boot path - (8569821)
  • logging: Take the clock-readiness barrier off the VM boot path - (40a0d7e)
  • logging: Recover FSS sealing from clock jumps instead of failing forever - (8eae1c9)
  • logging: Harden the clock-jump recovery paths - (261b9ef)
  • logging: Re-verify before believing a live-journal counter mismatch - (d9328b9)
  • mgbe0: Upstream patch merged - drop ours - (766eaf0)
  • microvm: Wait for a stopping guest instead of killing it immediately - (dcbb176)
  • microvm: Disable systemd service watchdogs in guests - (abd3f8b)
  • microvm: Make Crosvm StoreDisk boot reliably - (34ecbf7)
  • microvm: Make Crosvm TPM storage reboot-safe - (0f9eb69)
  • microvm: Stabilize USB-backed first boot - (454c995)
  • microvm: Speed up Crosvm guest shutdown - (724dbb6)
  • netvm: Support USB CDC NCM adapters - (d7001ac)
  • netvm: Debounce uplink-dependent restarts - (2fbc465)
  • nix-eval-jobs: The update has been merged - (64e1ab0)
  • nix-fast-build: Seems the underlying nix 2.35 has changed - (8b8d72b)
  • oot: Nvidia-oot broken against 6.12.103 - (885d666)
  • oot-kernel: Patch the oot-kernel for jetpack - (ca2fd8a)
  • orin: Stabilize BPMP proxy wire ABI - (19d5522)
  • orin: Harden BPMP proxy against malformed guest requests - (3715839)
  • orin: Fix multiple python build issues - (3e06184)
  • orin: Stop resize-partitions burning 30 s in initrd on every boot - (8f90bfa)
  • orin: Stop resize-partitions burning 30 s in initrd on every boot - (f4ac0de)
  • orin: Let -s consume the sdImage output directory directly - (9506b3d)
  • orin: Select the Secure Boot QSPI variant explicitly, not via -s - (e09c183)
  • orin: Release unused GPU VRAM carveout - (a1b7587)
  • orin: Reserve display RAM only for split topology - (d9254dd)
  • orin: Build pre-flash helper for host - (5b3978b)
  • orin: Hash the LUKS device-unique key context - (de1fea9)
  • orin/dce: Page-align the DCE reverse-event payload window - (1727243)
  • orin/flash: Cap the debug erase fallback to a 32MiB head wipe - (262f129)
  • orin/guivm: DCE display event delivery path - (5512205)
  • orin/guivm: Complete display synchronization and cursor path - (e9b0520)
  • orin/guivm: Keep eglut event dispatch nonblocking - (3779c84)
  • orin/guivm: Keep the R5 flip-completion binding across modesets - (7eb6231)
  • orin/netvm: Allow the MGBE0 clock ancestors in the BPMP allow-list - (dc0240b)
  • overlays: Cross-compile waypipe and osquery (aarch64-from-x86_64) - (b162710)
  • overlays: Cross-compile chromium (aarch64-from-x86_64) - (1cbab47)
  • overlays: Fix the scope of the cross compilation - (3189f56)
  • overlays: Remove packages merged upstream - (9dfc9ef)
  • pandas: Carry upstream patch - (3755149)
  • pci-binder: Detect passthrough devices when no ids are configured - (1cb5e3d)
  • power: Gracefully stop guests during host shutdown - (a1a3c68)
  • power: Detect switch activation by process, not one hardcoded unit - (d03214e)
  • power: Do not let an empty PCI id list disable guest fake-suspend - (3087322)
  • power: Harden Bluetooth recovery after resume - (cc4d9b0)
  • power-perf: Power should be inheratable - (94fd85c)
  • python: Jetpack-nixos needs older setuptools - (4cb9d5f)
  • qemu: Root of the build has changed in nixpkgs - (77dbc3c)
  • qemu-bpmp: Make MGBE0 vfio-platform passthrough reach line rate on gicv3 - (df16ce2)
  • qemu-bpmp: Disable additional tests that do not apply - (559816b)
  • reference: Gate developer SSH keys on the debug profile - (ad10593)
  • rtc: Improve the seeding anchor logic - (6c3c172)
  • ruff: New ruff settings are more strict - (40fe8c2)
  • serial: Include serial in the installer - (f453573)
  • serial-skills: Improve the skills for serial - (e9ee79c)
  • skills: Fix the logging diff matching - (a024692)
  • skills: Prefer boot to switch to be sure - (f5fd8eb)
  • spectrum: Broken revCount - (0675189)
  • spire: Support offline attestation and post-sync renewal - (84172d1)
  • spire: Handle backward clock jumps and surface post-sync failures - (551bf06)
  • spire: Include agent services - (f604ed0)
  • ssh: Remove dead waypipe-ssh - (0636936)
  • sssd: Use the pam login not greetd - (86c1ebf)
  • startup: Reduce Intel laptop boot latency - (fadffb1)
  • svid: Try and address the time sync issue - (61c1d8c)
  • swtpm: Add build-platform openssl for cross-compilation - (00a705c)
  • systemd: Carry NixOS PR #553061 until it reaches our nixpkgs - (98609b2)
  • templates: These are just plain wrong, delete - (aae54ba)
  • time: Stop waiting for convergence - (efd075a)
  • time: Avoid RTC contention with Chrony - (3e83178)
  • tpm2-pytss: Drop obsolete cross patch - (0874068)
  • usb: Suppress repeated device notifications - (5f18cfd)
  • usb: Suppress settings inventory log spam - (40aad26)
  • user-provision: Prompt for Wi-Fi password interactively - (3846677)
  • wait-for-unit: Report the observed state on timeout, on stderr - (85d151b)
  • waypipe: Pin to ffmpeg_8 until fixed upstream - (01eeb05)
  • waypipe: Drop the ffmpeg_8 pin, merged upstream - (524b179)

🚜 Refactor

Section titled “🚜 Refactor”
  • fss: Source the verify classifier from /etc instead of inlining it - (2ced642)
  • fss: Hoist remaining duplicated helpers into the shared classifier - (7a7c0c2)
  • gpu-vm: Split guest DTS into component dtsi files - (3422736)
  • gpu-vm: Make DCB gate mandatory + single-pass hex decode - (1cd5e71)
  • netvm: Stop deriving the uplink from the hardware definition - (cbb695b)
  • orin: Select the display DCB payload per board - (3b89c28)
  • reference: Put mvp-user-trial on the downstream path - (2ae967a)
  • spire: Remove join token attestation - (5d553e7)

📚 Documentation

Section titled “📚 Documentation”
  • acl: Documentation - (6239bd3)
  • fss: Document local-root receipt-forgery and pre-activation caveats - (371957f)
  • fss: Clarify clock-ready barrier deps and recovery receipt cap - (05fd79b)
  • orin: Document passthrough memory footprint - (dc424c9)
  • ssh: Add/update ssh documentation - (d307fe1)
  • Add 26.07.1 release note - (432891c)

🎨 Styling

Section titled “🎨 Styling”
  • ghaf-logs: Revert unintended reindentation of collect-logs.sh - (62c1429)

⏩ Dependency Updates

Section titled “⏩ Dependency Updates”
  • all: Get the latest - (ec16f21)
  • august: Bump all 8.8.2026 - (355260c)
  • docs: Update the doc dependencies - (2ed510f)
  • docs: Update dependencies - (bd249ce)
  • docs: Latest and greatest - (b4469c3)
  • fixes: Ghafpkgs and ci-test-automation - (338fb00)
  • ghaf-givc: Integrates fix for event proxy ACL - (a971a30)
  • ghaf-givc: Implements stop service cli - (2e4df17)
  • givc: Pin to appvm services PR - (608f108)
  • givc: Realign and not carry the pin - (dbfd8de)
  • givc: Pin givc until commit merges - (07cc4c8)
  • inputs: 28th july bumping inputs - (e538c45)
  • jetpack-nixos: Rebase on upstream - (184dbec)
  • july: Bump 20th july - (a1fd998)
  • nixpkgs: 9.8.2026 - (cefe50e)
  • pkgs: Get the latest - (aecfdf3)
  • pkgs-by-name-for-flake-parts: Unpin and track main - (ea2eeba)
  • vhotplug: Pick up the VM socket readiness race fix - (9b4f4f9)
  • Version number - (04abb7d)
  • Bump all inputs 2026-07-14 - (5e3158a)

🧪 Testing

Section titled “🧪 Testing”
  • acl: Access control checks - (e3e266c)
  • fss: Harden receipt diagnostics - (08fd1cf)
  • fss: Exercise ghaf-clock-ready at production defaults - (d851f93)
  • user-provision: Enable recovery key in automated user provisioning - (67eaee7)

⚙️ Miscellaneous Tasks

Section titled “⚙️ Miscellaneous Tasks”
  • cosmic: Remove cosmic-player overlay, remove cosmic-monitor - (068aed8)
  • flake: Follow ghaf-device-manager mainline - (ac44085)
  • flake: Follow ghaf-crosvm mainline - (77f74cc)
  • orin: Build the accelerated gui-vm target - (c5af7fc)
  • Ignore local workspace state - (98bb644)

New Contributors

Section titled “New Contributors”
  • @eyad-tii made their first contribution in #2127
  • @tkaratapanis made their first contribution

Bug fixes

Section titled “Bug fixes”

Fixed bugs that were present in the previous release

  • Layout can be selected only once and not changed afterwards
  • Audio taskbar doesn’t work after suspension

Known Issues and Limitations

Section titled “Known Issues and Limitations”
Issue Status Comments
x86
Reboot and shutdown takes long time In Progress Issue is under investigation
(System76) Laptop suspended again after opening the lid In Progress Seen rarely, issue is under monitoring
Redirecting to browser does not work in flatpak-vm, cannot sign in to Zoom, Spotify etc In Progress
External USB camera stream has poor quality and camera may stop working In Progress
USB storage device mounting in app-vm’s doesn’t work In Progress Fix is under verification

Installation Instructions

Section titled “Installation Instructions”

Released images are available at https://archive.vedenemo.dev/

Download the required image and use the following instructions: Build and Run