173 lines
7.3 KiB
Markdown
173 lines
7.3 KiB
Markdown
# Roadmap
|
|
|
|
Versioned roadmap for veilor-os. Targets are intentionally short and
|
|
testable. No fluff. Items in earlier versions are blockers for later
|
|
ones unless explicitly noted.
|
|
|
|
For the historical record of what landed in each release, see
|
|
[`../CHANGELOG.md`](../CHANGELOG.md).
|
|
|
|
---
|
|
|
|
## v0.2 — green ISO + base hardening (DONE)
|
|
|
|
Reproducible CI build pipeline. UEFI+BIOS bootable live ISO from a single
|
|
kickstart. Single-prompt LUKS install. First-boot admin password flow.
|
|
Full overlay applied (sysctl, sshd, sudoers, tuned profiles, KDE black
|
|
theme, Fira Code, branded `/etc/os-release`). SELinux enforcing.
|
|
firewalld drop zone. fail2ban + auditd + USBGuard active. The build
|
|
chased five real bugs (DEST hardcoded, `set -eu` killing `cp`,
|
|
os-release symlink, missing admin user, `LABEL=` vs `CDLABEL=` in
|
|
livecd-tools) before greening.
|
|
|
|
Released `v0.2.5` on 2026-05-01. CI on every push to `main`.
|
|
|
|
---
|
|
|
|
## v0.3 — UX polish (in progress)
|
|
|
|
The visible polish layer that v0.2 deferred for build velocity.
|
|
|
|
- **Plymouth black theme** — boot splash matching the desktop. No Fedora
|
|
drum, no white flash. `assets/plymouth/veilor/`.
|
|
- **SDDM theme** — black login background, single-user prompt with
|
|
`admin` pre-filled, no userlist.
|
|
- **Konsole profile** — black background, Fira Code, transparent panel
|
|
off (no compositor cost on resume).
|
|
- **Wallpaper SVG** — flat black with subtle veilor wordmark, 1080p +
|
|
4K + ultrawide variants.
|
|
- **Re-enable memory hygiene on installed system.** v0.2.5 stripped
|
|
`init_on_alloc=1 init_on_free=1` from the *live* cmdline because they
|
|
5x'd KVM boot time. Re-add post-install via `veilor-firstboot` so the
|
|
installed system gets the protection without the ISO penalty.
|
|
- **USBGuard auto-snapshot on first boot.** Currently the operator
|
|
runs `usbguard generate-policy` manually. v0.3 wires this into
|
|
`veilor-firstboot` after the password step (with a clear
|
|
"plug in trusted devices first" prompt).
|
|
|
|
Target: this month. None of it is a kickstart change — pure overlay
|
|
work.
|
|
|
|
---
|
|
|
|
## v0.4 — distribution + signing
|
|
|
|
Get veilor-os to a state where the ISO is downloadable, verifiable, and
|
|
trusted by Secure Boot without user shenanigans.
|
|
|
|
- **GPG-signed releases.** Tag → CI builds → CI signs ISO + sha256 with
|
|
veilor.org release key → GitHub Release artifact carries `.iso.asc`.
|
|
- **Reproducible builds.** Pin Fedora compose ID, lock package versions
|
|
via `dnf snapshot` or equivalent, document how to verify two builds
|
|
match.
|
|
- **Own MOK (Machine Owner Key) + sbsign for Secure Boot.** Currently
|
|
veilor-os relies on Fedora's signed shim chain. v0.4 ships our own
|
|
MOK, signs the kernel + initramfs at build time, optionally enrols
|
|
the MOK on first boot for users who want a cleaner trust path.
|
|
- **ISO download mirror** — static download page on veilor.org with
|
|
current + previous release, sha256, gpg signature. **Not** an RPM
|
|
mirror — veilor-os does not ship its own packages, only the spin
|
|
configuration.
|
|
- **Release process documented** — tagging, CI, signing, mirror sync
|
|
in `docs/RELEASE.md`.
|
|
|
|
---
|
|
|
|
## v0.5 — hardening tier 2
|
|
|
|
Hardening that builds on v0.2's foundation. Each item is opt-in unless
|
|
specified — defaults stay sane for a daily driver.
|
|
|
|
- **AppArmor profiles in addition to SELinux.** Stack-not-replace.
|
|
Targeted at the browser, the mail client, and anything that touches
|
|
attacker-controlled data. SELinux remains the primary MAC.
|
|
- **systemd-homed** — encrypted-per-user `~`, suspend-aware, key
|
|
unlocked at PAM login. Optional, opt-in via post-install helper.
|
|
- **nftables ruleset** alongside firewalld defaults. Default firewalld
|
|
policy stays drop; nftables provides advanced filtering for users
|
|
who want it.
|
|
- **Audit log shipping** — opt-in `auditd` -> remote syslog over TLS,
|
|
for users running a central log aggregator.
|
|
- **Installer kickstart split** — separate `veilor-os-install.ks` for
|
|
installer ISO (real LUKS partitioning, not the live-rootfs
|
|
simplification used in v0.2). Lets users install veilor-os as the
|
|
primary OS without going through the live boot first.
|
|
- **Audit baseline** — re-run the security audit (template in
|
|
`security/audit-template.md`) and target a lower risk score than v0.2.
|
|
|
|
---
|
|
|
|
## v0.6 — ergonomics
|
|
|
|
Smooth the operator experience so day-to-day work doesn't fight the
|
|
hardening.
|
|
|
|
- **`veilor-update`** — wraps `dnf upgrade` with a pre-check (snapshot
|
|
available?), an auditd pause, and post-update sysctl/SELinux
|
|
validation. One command, no surprises.
|
|
- **`veilor-doctor`** — diagnostic helper. Walks the audit checklist
|
|
(`getenforce`, `mokutil --sb-state`, `firewall-cmd --get-default-zone`,
|
|
fail2ban status, USBGuard policy, sysctl drift) and reports what's
|
|
drifted from baseline.
|
|
- **Opt-in installer ISO** — flip from live-only to live + installer,
|
|
user picks at boot menu. Installer uses the v0.5 kickstart with full
|
|
LUKS + btrfs subvols + zram.
|
|
- **First-boot UX** — replace TTY password prompt with a small
|
|
Plymouth-rendered dialog. Less raw.
|
|
- **Bluetooth opt-in helper** — single command to enable + bring up
|
|
the daemon + add the user to the right group. Currently three
|
|
commands.
|
|
|
|
---
|
|
|
|
## v0.7 — public flex
|
|
|
|
Take veilor-os out of "private repo, contained audience" mode.
|
|
|
|
- **Public docs site** — Hugo or mdBook on `veilor.org`, generated from
|
|
`docs/`. Single source of truth for INSTALL, HARDENING, BUILD,
|
|
ROADMAP, RELEASE, CONTRIBUTING.
|
|
- **Repo public** — flip GitHub visibility, announce.
|
|
- **Comparison + benchmarks** — published numbers vs stock Fedora KDE
|
|
on cold boot, idle RAM, idle network egress, suspend/resume time.
|
|
- **Threat model published** — what veilor-os defends against, what it
|
|
does not. Honest scope.
|
|
- **Press kit** — wallpapers, logo, screenshots, feature one-liner.
|
|
|
|
---
|
|
|
|
## v1.0 — production
|
|
|
|
The line where veilor-os is recommended for a non-author user as a
|
|
daily driver.
|
|
|
|
- **Multi-arch.** x86_64 today; v1.0 ships aarch64 ISO too (laptops
|
|
on ARM are real now). Build matrix in CI.
|
|
- **LTS commitment** — major versions tied to Fedora's release cadence,
|
|
patch releases for security only, documented EOL per major.
|
|
- **Recovery ISO** — minimal rescue image with veilor tools (LUKS
|
|
unlock, btrfs scrub, sysctl reset, fail2ban unban) for "I cannot log
|
|
in to my system" days.
|
|
- **TPM2 integration** — sealed LUKS unlock against TPM2 PCRs (opt-in,
|
|
default stays password). Ships as helper script, not silent default.
|
|
- **Signed update channel** — beyond GPG-signed ISOs, a signed metadata
|
|
repo so `veilor-doctor` can detect available updates without trusting
|
|
Fedora's mirrorlists alone.
|
|
|
|
---
|
|
|
|
## Stretch goals — not on the v0.x → v1.0 critical path
|
|
|
|
These are spin variants that share veilor-os DNA but need their own
|
|
kickstart or build tool. They live on a separate track and do not
|
|
block v1.0.
|
|
|
|
- **`veilor-server`** — no KDE, no GUI, hardened headless Fedora for
|
|
homelab / VPS. Same overlay, different package set.
|
|
- **`veilor-kiosk`** — single-app Plasma session, locked-down user,
|
|
read-only root. For dedicated-purpose machines.
|
|
- **`veilor-atomic`** — rpm-ostree / bootc-image-builder rebase.
|
|
Immutable root, transactional updates, atomic rollback. Different
|
|
build tool entirely (likely `bootc-image-builder`); all veilor
|
|
hardening would translate to a `Containerfile`. Schedule for after
|
|
v0.5+ once the standard spin is stable.
|