Skip to content
Ghaf Framework

Release ghaf-26.09.1

This is monthly Ghaf release which has been fully tested on Nvidia Orin NX, Nvidia Orin AGX, Lenovo X1 Carbon Gen11 and System76 Darter Pro platforms

Release Tag

Section titled “Release Tag”

https://github.com/tiiuae/ghaf/releases/tag/ghaf-26.09.1

Supported Hardware

Section titled “Supported Hardware”

Reference HW platforms:

  • Lenovo ThinkPad X1 Carbon Gen 11
  • System76 Darter Pro
  • Nvidia Jetson Orin NX & AGX

Generic HW support:

  • Generic x86_64 systems supporting UEFI boot and hardware virtualization
  • Hardware compatibility may vary depending on graphics, networking, audio, and peripheral devices

What’s New

Section titled “What’s New”

🚀 Features

Section titled “🚀 Features”
  • crosvm: Enable DAX read-only nix store share - (6c12bbe)
  • debug: Add lswt to gui debug tools - (04ca18a)
  • desktop: Switch default calculator to cosmic-ext-calculator - (662b38c)
  • image: Create LUKS2 and LVM storage in a build VM - (fbf40de)
  • installer: Point the firmware at the disk after an install - (561a977)
  • installer: Share the boot-entry and queue code with the TUI - (19c25d4)
  • keys: Allow downstream to use debug keys - (dafd101)
  • kill-switch: Switch to using rust kill-switch CLI - (4b8ed57)
  • logging: Disable FSS through global policy - (6a14daa)
  • logging: Add clock-independent log sealing - (c7487ee)
  • microvm/crosvm: Enable hugepages for guest RAM - (a5e7196)
  • netboot: Serve a fleet, in two tiers - (37fd59f)
  • nix: Drop nixpkgs and nix from release - (2c22309)
  • nw-packet-forwarder,smcroute,firewall: Act on every resolved uplink - (69dea2e)
  • org: Add an organization config mechanism - (8cb0ce3)
  • org: Move logging config to org - (fc3a5a1)
  • org: Move bug-report config to org - (472704e)
  • org: Move Fleet configuration to org - (1eb36ef)
  • org: Move ssh key definition to org - (f9da278)
  • org: Move Active Directory to org config - (1353089)
  • org: Move firewall updater URL - (d04d73d)
  • org: Move ntp server config - (a142dae)
  • org: Move Secure Boot keys to org config - (0589cab)
  • org: Move time and locale - (47637e2)
  • org: Add admin user account - (6c90cc8)
  • org: Add documentation - (8d25d9f)
  • orin: Add signed A/B images and firmware boot policy - (a712de9)
  • performance: Drop dead tuned settings, add audio profiles - (95db101)
  • theming: Add shared stylix-based theming module - (343c4ab)
  • theming: Propagate theming and boot settings to host and VM modules - (c2b676f)
  • theming: Drive plymouth boot theme from ghaf.theming - (a8729fe)
  • theming: Decouple stylix, disable it and gtk/qt theming on host - (5a21e1b)
  • udiskie: Use a dedicated tray icon - (17f8676)
  • update: Define signed update artifact tooling - (e522ddc)
  • update: Gate A/B acceptance on boot health - (dc65dca)
  • update: Bind secure targets to external public trust - (cba8f5b)
  • update: Add bounded downloads to debug net-vm - (2156e30)
  • uplink-resolver: Resolve every interface holding a default route - (be96225)
  • usb: Allow connecting usb storage to chromevm - (24522f4)
  • usb-applet: Use new cosmic version of usb applet - (793f536)
  • x86: Build and sign fixed-capacity A/B disk images - (4ff721f)
  • x86: Add secure A/B boot and resumable disk encryption - (341a8cc)

🐛 Bug Fixes

Section titled “🐛 Bug Fixes”
  • agent: Update flash command and prompt - (9e6c10b)
  • audit: Enable auditing independently of FSS - (c545a55)
  • boot: Some timing and logging fixes - (1c9de88)
  • carries: Removed carried workaround systemd, microvm - (7449b7c)
  • chromecast,dendrite-pinecone: Join mDNS group, fix duplicate mroute - (10226bc)
  • ci: Increase the memory for eval - (8265d64)
  • ci: Recognize private organization memberships - (a54aa64)
  • common: Correct user, provisioning and vm plumbing bugs - (15d1b5b)
  • crosvm: Pin UAS Stop Endpoint fix - (e5e8b62)
  • crosvm: Deliver pending xHCI interrupts - (8e3b734)
  • dbus-python: Missing dependency - (94909a3)
  • element: Fix the overlay to match upstream - (b219637)
  • eval: Reduce eval size and increase worker size - (4fa26fb)
  • eval: Fix the eval size for the runners - (bec3b00)
  • flake: Dedup follows - (5bc4c60)
  • flatpak: Fix URL XDG handler notification not showing - (69c5e6d)
  • givc-policy: Make the log messages more explicit - (c6a22b3)
  • greeter: Cancel session on failed password authentication - (1ae5d1c)
  • guidelines: Enforce clean guidelines and comments - (e5145e7)
  • guivm: Run user-login wait as a simple service - (1233693)
  • hardware: Read hostPlatform via config.nixpkgs to avoid infinite recursion - (cbb513e)
  • hardware: Jetson, partitioning and laptop definition fixes - (19bbcb6)
  • installer: Review findings on the install path - (0862a0b)
  • installer: Correct when stale boot entries arise - (fd11036)
  • installer: Intermittent issues occuring - (d889933)
  • intel-laptop: Make the VMM selection overridable downstream - (8ec8fd5)
  • logging: Support both journald option formats - (bc2a564)
  • logging: Stop guessing FSS journal storage - (6af550e)
  • logging: Retry sealing confirmation after journald restart - (52e575d)
  • logseald: Reset sealing state when credentials change - (1cad555)
  • microvm-cli: Remove the unused cli package - (d1943b5)
  • netboot: Missing packages when not run from the devshell - (e5311db)
  • nixpkgs: Stop shipping source in release images - (20769a3)
  • orin: Shutdown is now actually sent to the vms - (2133cd5)
  • orin: Cross compile cosmic reader error fix - (8d16b42)
  • orin: Cosmic comp - smitay dmabuf fence patch update - (e9355d9)
  • orin: Grow encrypted storage and preserve persistent data - (17fd65a)
  • orin-targets: Do not create so many duplicate flashers - (4de9bdb)
  • overlays: Remove the redundant overlay for ghafpkgs - (ea83997)
  • performance: Order ppd profile units after tuned - (0a3ddb3)
  • profiles: Harden the debug/release boundary - (446b439)
  • release: Propogate the release enable - (64a2318)
  • review: Correct fail-open paths and a broken eval in the p0 series - (08293a8)
  • secureboot: Verify installed boot files and enrollment keys - (6164769)
  • secureboot: Accept signed UKIs referenced by boot entries - (c9f8153)
  • security: Keep dev secrets out of release images, the journal and the store - (c063ba3)
  • services: Givc socket lists, github token handling - (2461e42)
  • smcroute,nw-packet-forwarder: Drop the start rate limit on uplink-driven units - (b938eb6)
  • spire: Recover invalid identities after clock changes - (ec7d406)
  • stdenv: Fix the namespace to include hostPlatform - (37b5aa1)
  • time: Bound the clock barrier on RTC-backed x86 boards - (94a25e3)
  • usb-device-manager: PR 9 is needed to fix passthrough - (759cd4a)
  • usb-passthrough: Disconnects and reconnects get lost - (42e57af)
  • waypipe/appvm: Start graphical-session.target once waypipe is reachable - (b33c0db)
  • windows-launcher: Declare ISO_FILE only on x86_64 - (92728e0)
  • xHCI: Fix the usb pass through - (eecfaf5)
  • yad: Drop the optional backends 15.0 turned on - (afd2b32)
  • yad: Support renamed sourceview argument - (bd12982)
  • yad: Dependency gtksourceview renamed - (5214507)
  • Pre-select defaultLocale in initial-setup language page - (f9dcb76)

🚜 Refactor

Section titled “🚜 Refactor”
  • cosmic: Drop hardcoded icon and font theming in favor of stylix - (8669065)
  • debug: Use with pkgs in debug tools lists - (223ae14)
  • disko: Make comp level configurable, couple erofs to it - (bf381af)
  • fingwit: Build xapp with app-lib-only - (10c278d)
  • givc: Centralize GUI VM D-Bus proxy services - (67c0a5a)
  • logging: Remove legacy FSS implementation - (96f3ecb)
  • microvm: Tune compression, dedupe storeOnDisk config - (c6c8635)
  • org: Stylistic changes - (b340fde)
  • orin: Use lib.getExe for the flash script output name - (c996e74)
  • orin: Consume virtualization patches from jetpack-nixos - (0c2ea63)
  • orin: Remove unused flash disk overrides - (908c465)
  • papirus-icon-theme: Drop breeze-icons fallback - (206547e)
  • performance: Derive tuned profile sets from one table - (e2ad016)
  • qemu: Consume Ghaf variants from ghafpkgs - (c9a52eb)
  • tuned: Drop unused tuna and pyperf dependencies - (bfd69cb)
  • Allow webcams in multiple VMs - (2773ad7)
  • Gate the full glibc locale archive behind ghaf.locales.enable - (1ad003c)

📚 Documentation

Section titled “📚 Documentation”
  • agents: Introduce explicit commit and comment guidelines for agents - (076414f)
  • intro: Fix camera isolation section to reflect new behavior - (45c50e4)
  • orin: Document secure A/B flashing and rollback tests - (edd7d54)
  • update: Describe the shared secure A/B workflow - (a46cceb)
  • x86: Document secure A/B installation and rollback tests - (94e5e1c)
  • Add 26.08.1 release note - (3d95255)
  • Promote flakevuln - (68f4d92)
  • Add more explicit commit guidelines - (d190a58)

⏩ Dependency Updates

Section titled “⏩ Dependency Updates”

⚙️ Miscellaneous Tasks

Section titled “⚙️ Miscellaneous Tasks”
  • build/docs: Remove references to generic-x86 target - (a8e6ec3)
  • crosvm: Follow merged UAS fix - (2349b1d)
  • eval: Supply public trust for secure A/B targets - (66a9744)
  • flake: Add stylix input - (251dcb4)
  • flakevuln: Add workflow - (a77b12b)
  • flakevuln: Add vulnerability whitelist - (1bf5323)
  • flakevuln: Triage vulnerability findings - (918eace)
  • flakevuln: Triage vulnerability findings - (a0069a9)
  • flakevuln: Update action revision - (19fc823)
  • graphics: Drop a deprecated call and an empty autostart unit - (6b701c0)
  • overlays: Clean up and drop changes carried upstream - (a1ccb60)
  • slsa: Start generating SLSA source VSA for commits on main - (4b5ebaf)
  • Remove generic-x86 target config - (f27b69b)
  • Auto-assign pull requests to their author - (ee42cd1)

Bug fixes

Section titled “Bug fixes”

Fixed bugs that were present in the previous release

  • Redirecting to browser does not work in flatpak-vm, cannot sign in to Zoom, Spotify etc
  • USB storage device mounting in app-vm’s doesn’t work
  • Reboot and shutdown takes long time

Known Issues and Limitations

Section titled “Known Issues and Limitations”
Issue Status Comments
x86
(System76) Laptop suspended again after opening the lid In Progress Seen rarely, issue is under monitoring
(X1) External USB camera stream has poor quality and camera may stop working In Progress
NVIDIA Jetson AGX Orin / Orin NX
Display doesn’t work In Progress
Note: NVIDIA Docker is no longer supported on the host when GPU passthrough is enabled. GPU workloads should run inside the GPU VM instead

Installation Instructions

Section titled “Installation Instructions”

Released images are available at https://archive.vedenemo.dev/

Download the required image and use the following instructions: Build and Run