secureblue

California recently passed, and Colorado and NY recently introduced, age verification legislation targeting OS providers that is so imprecisely written that it's unclear how to comply. If you live in one of those states, contact your state senator and rep asking them to oppose this legislation.

Release 145.0.7632.159-443143 · secureblue/Trivalent What's Changed chore(deps): bump github/codeql-action from 4.31.10 to 4.32.4 by @dependabot[bot] in #632 chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in #635...

Trivalent 145.0.7632.159-443143 released:

github.com/secureblue/T...

Release 145.0.7632.116-442971 · secureblue/Trivalent Upstream Changes https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_23.html Full Changelog: 145.0.7632.75-442755...145.0.7632.116-442971

Trivalent 145.0.7632.116 released:

github.com/secureblue/T...

Build architecture | secureblue Build architecture for secureblue

Check out the new article on secureblue.dev covering secureblue's build architecture, especially supply chain security mechanisms:

secureblue.dev/articles/bui...

Trivalent 145.0.7632.109-442868 released:

github.com/secureblue/T...

Release 145.0.7632.75-442755 · secureblue/Trivalent What's Changed feat: use source cache versioning by @RKNF404 in #624 Full Changelog: 145.0.7632.67-442735...145.0.7632.75-442755

Trivalent 145.0.7632.75-442755 released:

github.com/secureblue/T...

Google is aware that an exploit for CVE-2026-2441 exists in the wild.

Release 145.0.7632.67-442736 · secureblue/Trivalent What's Changed fix(aarch64): pull Chromium patch to assume nightly rustc by @RoyalOughtness in #615 Upstream Changes https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-deskto...

Trivalent 145.0.7632.67-442736 released:

github.com/secureblue/T...

This release includes upstream security fixes for 11 CVEs. It also features a new quick action toolbar button for our dark mode toggle. You can add it to your toolbar via Settings > Appearance > Customize your toolbar.

Release v4.8.1 - Switch to Bazaar App Store · secureblue/secureblue v4.8.1 - Switch to Bazaar App Store All app stores (Gnome Software, Discover, Cosmic Stores) have been removed and replaced with Bazaar. Corresponding firmware update notifications provided by thos...

Release v4.8.1 is out, now with the Bazaar App Store. See the release notes for details: github.com/secureblue/s...

Release 144.0.7559.132-442539 · secureblue/Trivalent What's Changed fix: secureblue faq url by @RoyalOughtness in #595 feat: disable user feedback prompts by @RoyalOughtness in #596 chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1...

Trivalent 144.0.7559.132-442539 released:

github.com/secureblue/T...

HTTP 404 for repo keyring when updating · Issue #1416 · freedomofpress/dangerzone What happened? I got the following error when doing a system update: error: Updating rpm-md repo 'dangerzone': Failed to download gpg key for repo 'dangerzone': Status code: 404 for https://package...

Additional information for the previous post: github.com/freedomofpre...

If you've installed dangerzone, you're likely having upgrade issues. Dangerzone abruptly moved their repo GPG key, which they will fix shortly. To unblock, you can simply ⁨run0edit /etc/yum.repos.d/dangerzone.repo⁩ and replace ⁨gpgkey⁩ with their new ⁨url: packages.freedom.press/yum-tools-pr...

Release 144.0.7559.109-442393 · secureblue/Trivalent What's Changed chore: update copyright statement by @RoyalOughtness in #585 chore(vanadium): update patches by @RKNF404 in #586 chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabo...

Trivalent 144.0.7559.109-442393 released:

github.com/secureblue/T...

And yes, daily updates are pulled automatically and applied on reboot.

Updates have nothing to do with releases. Releases are symbolic. Builds are created and published daily.

Release v4.8 - Provenance, egress blocking, virtualization, and rechunking · secureblue/secureblue v4.8 - Provenance, egress blocking, virtualization, and rechunking Provenance Image upgrades now include automatic SLSA provenance verification. Provenance verification can also be done when manual...

Release v4.8 is out, containing a number of major improvements. See the release notes for details: github.com/secureblue/s...

Release 144.0.7559.96-442238 · secureblue/Trivalent What's Changed fix: remove quotes from generic name and comment in trivalent.desktop by @tpaau in #578 chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10 by @dependabot[bot] in #582 Up...

Trivalent 144.0.7559.96-442238 released:

github.com/secureblue/T...

Release 144.0.7559.59-442111 · secureblue/Trivalent What's Changed feat: add comment and generic name for the desktop entry by @tpaau in #561 chore(port): update patches to 144 by @RKNF404 in #557 feat(gpusandbox): improve seccomp filter for GPU pr...

Trivalent 144.0.7559.59-442111 released:

github.com/secureblue/T...

Release 143.0.7499.192-441933 · secureblue/Trivalent What's Changed chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #548 chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #549...

Trivalent 143.0.7499.192-441933 released:

github.com/secureblue/T...

Release 143.0.7499.169-441525 · secureblue/Trivalent What's Changed feat(ui): Translation support by @RKNF404 in #544 Upstream Changes https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_18.html Full Changelog: 143.0.749...

Trivalent 143.0.7499.169-441525 released:

github.com/secureblue/T...

Release 143.0.7499.146-441480 · secureblue/Trivalent What's Changed chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #535 feat: exit immediately if run as root by @RoyalOughtness in #536 fix: avoid bwrap errors with ldpr...

Trivalent 143.0.7499.146-441480 released:

github.com/secureblue/T...

Trivalent 143.0.7499.109-441349 released:

github.com/secureblue/T...

Google is aware that an exploit for Bug 466192044 (no CVE issued yet) exists in the wild.

Release 143.0.7499.40-441176 · secureblue/Trivalent What's Changed feat(theming): Classic theme by default by @RKNF404 in #519 fix(spec): properly check off version tag by @RKNF404 in #520 fix(conf): make ENABLE_VULKAN not persistent in the system ...

Trivalent 143.0.7499.40-441176 released:

github.com/secureblue/T...

feat: support rechunking with build-chunked-oci by HastD · Pull Request #610 · blue-build/cli Add support for rechunking images with rpm-ostree compose build-chunked-oci. This is available in the CLI with the --build-chunked-oci option, with an optional --max-layers argument to specify the ...

Our images are now rechunked using build-chunked-oci, reducing daily update sizes by ~40%. We expect this reduction to grow as we make further optimizations. The initial update to a rechunked image will be substantially larger, but this is a one-time event.

For more info: github.com/blue-build/c...

Install | secureblue Steps to install secureblue

This week we shipped ARM64 images for Beta testing. Please report any issues you encounter.

For installation instructions, consult secureblue.dev/install#arm64

Release 142.0.7444.175-440855 · secureblue/Trivalent What's Changed chore: remove unnecessary patch by @RoyalOughtness in #511 fix(wrapper): flags variable handling by @RKNF404 in #515 Full Changelog: 142.0.7444.162-440723...142.0.7444.175-440855

Trivalent 142.0.7444.175-440855 released:

github.com/secureblue/T...
chromereleases.googleblog.com/2025/11/stab...

This release includes upstream security fixes for multiple CVEs, including CVE-2025-13223. Google is aware of an exploit for CVE-2025-13223 that exists in the wild.

Release 142.0.7444.162-440723 · secureblue/Trivalent What's Changed docs: Update the readme to reflect the new state of the NSS by @Collision4468 in #504 feat(ui): Move search suggestion by @RKNF404 in #510 feat(conf): Extra conf files support by @R...

Trivalent 142.0.7444.162-440723 released:

github.com/secureblue/T...
chromereleases.googleblog.com/2025/11/stab...

Install | secureblue Steps to install secureblue

ISOs and Torrents for the F43-based secureblue images are now available! Please seed if you can:

secureblue.dev/install#iso
fosstorrents.com/distribution...

Many thanks to @fosstorrents.bsky.social for providing torrent hosting!

Yes, it was fixed in this release bodhi.fedoraproject.org/updates/FEDO...

Release 142.0.7444.134-440598 · secureblue/Trivalent What's Changed fix: disable ai mode omnibox entrypoint by @RoyalOughtness in #505 Full Changelog: 142.0.7444.134-440595...142.0.7444.134-440598

Trivalent 142.0.7444.134-440598 released:

github.com/secureblue/T...
chromereleases.googleblog.com/2025/11/stab...

Release v4.7 - Fedora 43 · secureblue/secureblue What's Changed chore(po): update PO files to reflect changes to audit script by @HastD in #1320 chore(audit): add Bazaar to "expected arbitrary permissions" list by @HastD in #1290 feat: don't ins...

Release v4.7 is out, based on Fedora 43. Thanks to everyone who helped test and fix issues. No action is needed to upgrade, you will get the new image automatically. github.com/secureblue/s...