v3.1.0
Upgrade issues
Be advised that there is currently an issue when upgrading from 3.0.x to 3.1.x in which the user ids will change. This will result in any files owned by the user under its /home directory to lose permissions which can lead to not being able to ssh (ssh keys will have a different user id)
We are currently working on a workaround, so you are advised to not upgrade until 3.1.2 is released with a fix for this.
Potential Breaking Changes
By default, Uki artifacts (identified by the -uki suffix) no longer include Linux modules and firmware in the image. Real-world testing has shown that many EFI firmwares are very particular about the size of the EFI image, often refusing to boot if the file exceeds 300-400MB. Given the wide variety of EFI firmware implementations, predicting whether a UKI EFI file will boot on different hardware is challenging.
To enhance compatibility, we decided to slim down the UKI files by removing the largest components: the Linux modules and firmware packages. This results in EFI files around 200-300MB, which are much more likely to boot correctly across various EFI implementations.
However, this change comes with a trade-off. Smaller images, while being more compatible with a wide range of EFI firmwares, may lack comprehensive hardware support because they do not include all the Linux modules and firmware packages. This means that certain hardware components may not function correctly or optimally when using these slimmer UKI images.
On the other hand, larger UKI images, which include all necessary modules and firmware for extensive hardware support, provide better functionality and compatibility with a broad range of hardware. However, these larger images are more likely to encounter boot issues due to EFI firmware limitations, as many EFI implementations refuse to boot files larger than 300-400MB.
We publish -uki artifacts ourselves, which are the slimmed versions, as examples of how to build a slimmer UKI artifact. While these serve as a reference, we recommend always building your own custom images to tailor them to your specific hardware needs. If you need to include those packages for full hardware support, you can create a custom artifact to add them back, as detailed in the Kairos docs.
We recommend keeping your UKI EFI files as small as possible to maximize boot success across different EFI firmware implementations. While smaller images offer better compatibility, they may lack full hardware support. Conversely, larger images, which include all necessary modules and firmware, provide comprehensive hardware support but may fail to boot due to EFI firmware constraints.
Check out how to build your own base images with the Kairos Factory
What's Changed
💿 UKI
- UKI: measured systemd-sysext by @Itxaka #2117
- UKI: Verify images signature before upgrade by @Itxaka #2200
- UKI: Enroll keys during setup #2048
- Install limited amount of modules for UKI Ubuntu by @mauromorales in #2566
🐧
- Support for Ubuntu 24.04 LTS by @mauromorales #2138 and deprecation of 23.10
- Support for Fedora 40 by @Itxaka in #2502 and deprecation of previous versions
- refactor debian dockerfile to build arm by @mauromorales in #2542
- Bump opensuse Leap to 15.6 by @mauromorales in #2623
🐛
- fix(nvidia): do not ship nohang in nvidia-arm builds by @mudler in #2433
- Allow https protocol in ipxe by @jimmykarily in #2468
- fix(orin): disable ISCSI in the initramfs generation by @mudler in #2474
- 🐛 Move nfs-utils to common build target in opensuse flavor by @kaiehrhardt in #2495
- 🐛 Install cryptsetup for all arches in opensuse by @Itxaka in #2691
📖
- 📖 chore: fix typos by @xiaoxianBoy in #2441
- readme: add links to project governance by @mudler in #2498
- Update LICENSE by @mudler in #2503
- Add OpenSSF best practices badge by @mauromorales in #2639
- Add clomonitor badge by @mauromorales in #2640
- Link to GH Security Draft Advisory form by @mauromorales in #2650
🔧
New Contributors
- @xiaoxianBoy made their first contribution in #2441
Full Changelog: v3.0.14...v3.1.0
