Skip to main content

Release history for the OS Distribution Mirror Gateway and osdl operator tooling

Changelog

PUBLIC RELEASE RECORD

All notable public changes are recorded here. Format follows a Keep a Changelog spirit. Dates are UTC. This log deliberately omits private infrastructure, hostnames, credentials, and operator-internal paths.

Tooling train
v1.3.4
API schema
api 1.1.0
Releases
8
Dates
UTC
v1.3.4 Latest

Mirror metadata refresh

  • catalog
  • mirrors
  • ops

Official checksums and release pointers revalidated against upstream. Fourteen channels moved forward. Six channels were unchanged.

Changed

Distribution metadata
  • Arch Linux → 2026.10.01 (sha256sums.txt)
  • Debian → 13.7.0 Trixie netinst (SHA256SUMS + SHA512SUMS)
  • Ubuntu → 26.04.1 desktop and live server (SHA256SUMS)
  • Alpine Linux → 3.24.2 standard
  • NixOS → 26.05 minimal (current stable channel; 26.11 is not published)
  • Manjaro KDE → 26.1.0
  • openSUSE Tumbleweed → Snapshot20261007 (Current.iso pointer)
  • Parrot Security → 7.4 (security and home editions)
  • Qubes OS → 4.3.2
  • Tails → 7.14 (ISO and IMG from official latest.json)
  • Fedora CoreOS → 44.20260913.3.2 stable stream
  • Flatcar Container Linux → 4757.2.1 (stable DIGESTS SHA512)
  • Kairos → 4.3.0 (standard amd64 K3s image and core image)
  • Talos Linux → 1.14.2 (metal-amd64.iso + sha256sum.txt)
  • Revalidated unchanged: AlmaLinux 10.2, Rocky Linux 10.2, Fedora Workstation 44, Linux Mint 22.3, openSUSE Leap 16.0, Kali Linux 2026.2
v1.3.3

Mirror metadata refresh

  • catalog
  • mirrors
  • ops

Official checksums and release pointers revalidated against upstream. Updated Tails 7.11, Talos Linux 1.13.9, Kairos 4.2.0, Flatcar 4593.2.5, and openSUSE Tumbleweed Snapshot20260818.

Changed

Distribution metadata
  • Tails → 7.11 (new ISO + SHA256 from official latest.json)
  • Talos Linux → 1.13.9 (metal-amd64.iso + sha256sum.txt)
  • Kairos → 4.2.0 (standard amd64 + K3s image)
  • Flatcar Container Linux → 4593.2.5 (stable DIGESTS SHA512)
  • openSUSE Tumbleweed → Snapshot20260818 (Current.iso pointer)
  • Revalidated unchanged: Ubuntu, Debian, Arch, Fedora, AlmaLinux, Rocky, Mint, Kali, Alpine, Parrot, Manjaro, Leap, NixOS, Qubes, Fedora CoreOS
v1.3.2

Animated cybernodes console previews

  • ui
  • media

Distro console SVGs redesigned as animated terminal sessions: OS icon in the window chrome, prompt user@cybernodes.de, and SMIL-typed distro-specific commands (apt/dnf/pacman/talosctl/osdl).

Added

  • Generator scripts/generate-cli-svg.php rebuilds all distro cli.svg previews
  • Title-bar embeds each project icon next to traffic lights
  • Looping SMIL animations: sequential command reveal, typing clip, blinking cursor

Changed

  • Console host prompt is {distro}@cybernodes.de (replaces @gateway)
  • Sessions include OS-family package tooling and osdl verify/get examples
v1.3.1

Sticky header polish & admin stealth

  • ui
  • security
  • ops

Scroll morph for the site header fully collapses the status strip into a compact Status pill (no residual empty banner). Admin console is VPN-only and stealth-hidden from the public internet.

Fixed

Sticky header / status strip
  • When scrolling, the full status-banner area now collapses completely (min-height/height/padding zeroed) instead of leaving an empty reserved band
  • Status details remain available via the compact frosted Status pill + popover in the sticky nav bar

Changed

  • Public CLI copy no longer references internal admin/re-enable instructions for blended-out Windows tooling
  • Structured changelog page tooling train bumped to v1.3.1

Security

  • Admin console reachable only from Sentinel Core VPN (10.1.0.0/24) and Infrastructure (10.0.0.0/24); public requests receive a generic 404
  • Dual enforcement: nginx edge allow/deny + PHP AdminAccess CIDR gate
  • Admin path not advertised in robots.txt or public site copy
v1.3.0

Operator UX, media vault & presentation layer

  • ui
  • media
  • security
  • ops

Professional hub presentation: day/night themes, responsive navigation, distribution media galleries with secure vault delivery, FAQ discovery, and operational blend-out controls for unfinished Windows tooling.

Added

Presentation & navigation
  • Day / Night theme switcher with persistent preference and early paint bootstrap
  • Responsive navigation panel: desktop header controls, mobile hamburger with theme below links
  • Distribution project icons and official screenshot carousels on hub cards
  • Thumbnail-first media with full-size lightbox and optional social / video references
  • Sticky header morph: full status strip at top; compact Status pill when scrolled
Media vault
  • Authenticated superadmin Media Vault for controlled asset ingest
  • Server-side thumbnail generation (GD / Imagick) and gated file delivery via /media/v1/
  • Catalog-driven gallery references without exposing raw vault paths
Discovery
  • FAQ overview with category chips, free-text search, and filtered empty states
  • Lane-aware filter chips (IT-Security, Kubernetes, Immutable) matched on operational lane, not marketing tags

Changed

  • Status banner layout hardened for multi-segment alignment across breakpoints
  • Windows PowerShell installer and client scripts blended out of public endpoints until CLM-safe delivery is complete (Linux CLI remains primary)
  • Public changelog delivered as a structured HTML page at /changelog/ (no raw markdown download)

Security

  • Vault originals are not web-static; delivery goes through PHP with path hardening
  • CSP extended only for first-party assets and optional youtube-nocookie lightbox embeds
  • Site settings gate unfinished public script surfaces without removing admin-side visibility
v1.2.0

Air-gap corridor & Windows CLI train

  • cli
  • air-gap
  • windows

Air-gap corridor tooling and a first-class Windows PowerShell client. Operators on a connected jumphost can stage verified ISO media—including checksums and optional signing material—onto isolated hosts over SCP, with parity between Linux and Windows control planes.

Added

Air-gap transfer (osdl push / osdl-push)
  • osdl-push (bash): production-oriented SCP transfer of ISO/disk image, checksum listing or generated digest, optional detached GPG signature, optional public keys, and operator MANIFEST.txt with remote verify steps
  • osdl-push.ps1 (PowerShell): Windows-equivalent push workflow using OpenSSH ssh/scp
  • Bastion / ProxyJump support (--jump / -Jump) for classic jump-host → air-gap segment paths
  • --distro <id> enrichment: when online, attach official checksum material from live gateway metadata
  • --print rehearsal mode: emit the exact transfer plan without moving bytes
  • Integrated as osdl push … on both bash and PowerShell clients
Windows CLI (osdl.ps1)
  • Full PowerShell operator contract: list · info · get · verify · status · push · version · help
  • Local metadata cache under %LOCALAPPDATA%\osdl with TTL and --refresh / -Refresh
  • SHA256 / SHA512 verification via Get-FileHash (no third-party modules)
  • install.ps1 one-liner installer with optional user PATH registration
Documentation & UX
  • Hub CLI section documents Linux and Windows install paths
  • FAQ entries for air-gap push, Windows install, and verification responsibility
  • Glossary terms: Air-gap, Jumphost / Bastion, ProxyJump, Bundle

Changed

  • osdl (bash) bumped to 1.2.0; push delegates to colocated osdl-push
  • Linux installer deploys both osdl and osdl-push into the install directory
  • Public API catalog api_version remains 1.1.0 (metadata schema unchanged); tooling version is independent

Security

  • Push path never invents upstream trust: it only ships files the operator already holds (plus optional metadata-derived official checksum listings when online)
  • Installers perform lightweight identity checks before writing binaries/scripts
  • Digest match ≠ GPG authenticity — operators must still validate signed upstream checksum files when the threat model requires it
  • No analytics, no third-party runtimes, no binary hosting on the gateway

Operator notes 

# Linux jumphost
osdl get rocky --verify -o /var/tmp/rocky.iso
osdl push --host ops@10.10.50.20 --iso /var/tmp/rocky.iso --distro rocky

# Via bastion
osdl push --host airgap@192.168.99.10 --jump bastion@edge \
  --iso ./image.iso --checksum ./SHA256SUMS --sig ./SHA256SUMS.gpg

# Windows (PowerShell + OpenSSH Client)
osdl get debian -Verify -Output $env:TEMP\debian.iso
osdl push -Iso $env:TEMP\debian.iso -TargetHost ops@10.10.50.20 -Distro debian
v1.1.0

Operational lanes & catalog depth

  • catalog
  • lanes
  • filter

Hub information architecture split into operational lanes, expanded distribution coverage, and professional multi-token filtering with base-family and mission synonyms.

Added

Hub lanes
  • General Purpose — desktop/server/enterprise baselines
  • IT-Security & Privacy — pentest, forensics, privacy, hardened workstation media
  • Kubernetes & Immutable Node OS — container-optimized / K8s-first systems
  • Lane jump links, lane badges, and filter chips for IT-Security, Kubernetes, and Immutable
Kubernetes / immutable channels
ID Project Role
talos Talos Linux K8s-only OS; day-2 via talosctl
flatcar Flatcar Container Linux CoreOS successor; container host
fedora-coreos Fedora CoreOS Auto-updating atomic host
kairos Kairos Immutable cloud-native OS (+ K3s images)
Catalog model
  • lane field (general | security | kubernetes) on each distribution
  • Richer base / search_terms for family-aware discovery
  • Search excludes free-text marketing descriptions to reduce false positives
Filter engine
  • Multi-token AND queries with synonym expansion
  • Word-boundary matching (no false substring hits)
  • Result counters, clear control, empty-state guidance, ?q= deep links
  • Empty lanes hide while a filter is active

Coverage retained

Security / privacy channels
  • Kali Linux, Parrot Security, Tails, Qubes OS (with official digests)
General catalog
  • Ubuntu LTS, Debian stable, Fedora, Arch, openSUSE Leap/Tumbleweed, Linux Mint, Rocky Linux, AlmaLinux, Alpine, NixOS, Manjaro
v1.0.0

Initial production gateway

  • foundation
  • api
  • cli

Initial production gateway: configuration-driven metadata hub, public JSON API, tactical UI, and pure-shell Linux CLI.

Added

  • Distribution Mirror Hub — cards with official URLs, digests, verify commands, secure download actions
  • Operational status banner — UTC metadata sync timestamp, OPERATIONAL / DEGRADED / MAINTENANCE, channel id
  • Public API: GET /api/v1/latest.json, /api/v1/distros.json, /api/v1/status.json
  • CLI (osdl) — bash client: list, info, get, verify, status
  • One-liner installer — curl -fsSL https://os.webservice.digital/cli/ | bash
  • Single source of truth — data/catalog.json + scripts/export-api.php
  • Security baseline — strict CSP, HSTS, frame denial, no third-party scripts/trackers
  • FAQ + codeword glossary
  • Explicit disclaimers: independent gateway; no ISO hosting; not an official mirror of any distribution

Design constraints honored

  • Static-first / CloudPanel-friendly PHP rendering
  • Operator-updatable metadata without application rewrites
  • CLI fetches live metadata only; downloads use official project URLs

Versioning policy

COMPONENT SCHEME
Component Scheme Notes
Gateway UI / catalog tooling SemVer-ish (MAJOR.MINOR.PATCH) Documented in this changelog
Public JSON api_version Independent Bumped only on breaking API field changes
osdl CLI Tooling train (e.g. 1.2.0) Reported by osdl version
OPERATOR QUICK REF