| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: qubesome | Distribution: openSUSE Tumbleweed |
| Version: 0.1.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Sun Nov 1 08:57:15 2026 |
| Group: System/X11/Utilities | Build host: reproducible |
| Size: 21500799 | Source RPM: qubesome-0.1.0-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/qubesome/cli | |
| Summary: Containerize Window Managers, apps and config from a declarative state in Git | |
Define your Window Manager and Workloads in Git and run them as containers. Just like dotfiles management, but better.
Apache-2.0
* Sun Nov 01 2026 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.1.0:
* fix(deps): update module go.yaml.in/yaml/v3 to v3.0.6
* fix(deps): update module github.com/godbus/dbus/v5 to v5.2.4
* gateway: keep interface names and the spoofed counter in the guard check
* gateway: name the gateway an address came from under the same lock
* gateway: refuse to register with a gateway started since allocation
* sandbox: open a record's lock read-only
* gateway: compare a microVM's guard rule by rule
* sandbox: lock a record between reading and removing it
* gateway, workloads: unregister only from the gateway a workload was wired to
* gateway: keep workloads recorded before the gateway was named
* gateway, doctor: read a microVM's guard back whole
* doctor: report a microVM wired to a gateway that has gone
* gateway, sandbox, workloads: tie a workload's record to the gateway it was wired to
* sandbox: bring a guest's loopback up
* types: drop a machine's microvm block in limited mode
* gateway: let a test gateway be stopped before it serves
* README: give secret-tool the login collection by its path
* types: refuse a gateway name only for a reading a workload can have
* gateway: skip a new gateway's reload only for a policy it has loaded
* gateway: record the policy a gateway started from as an absolute path
* gateway: reload a policy edited during start, and refuse an unrecorded gateway
* gateway, types: check a gateway name where its address is handed out
* gateway: deliver host keyring secrets for injection
* runners: leave a record and a gateway name a reaper no longer owns
* workloads, cli: list the workloads that are running, and kill or restart them
* chore: update agent tooling config
* start: stop --detach from forking without end
* files, profiles, cli: remember the last config that opened
* types, qubesome, cli: run a workload stripped down with --limited
* headless: fall back to the active profile the way run does
* cli: unhide gateway and usb, and say what each flag is for
* clipboard: stop waiting on a pipe the forked xclip keeps open
* runners: unregister a workload whose launch fails after registering it
* runners, session: refuse a sandbox left running by a session that ended
* gateway, sandbox: report only the workloads this session wired
* launch, runners: record the sandbox's own init rather than the outer bwrap
* session: end and announce a session only from the holder that owns it
* qubesome, types: check a workload against the runner it will run under
* types: warn when a console takes an address it does not need
* firecracker: point a guest's ssh at the gateway proxy
* log, launch: say what a launch did, at INFO, on stderr
* gateway, session: replace a gateway left behind by a session that has gone
* gateway: hand the tap to the uid the session namespace maps
* sandbox: say why a guest's supervisor takes no gate
* gateway: show which workloads this session has wired
* doctor: report a microVM's wiring and its guard
* gateway: read a microVM's wiring back out of its namespace
* types, qubesome: let a microVM hold NET_ADMIN on the gateway
* firecracker: describe the sandbox the VMM runs in
* firecracker, sandbox: give a guest the network it was allocated
* firecracker: give a machine on the gateway an interface
* gateway: wire a microVM to the session gateway
* runners: share the gated launcher between the two runners
* sandbox: record the gateway address a workload holds
* hack: measure what a microVM's tap and guard need
* fix(deps): update module github.com/godbus/dbus/v5 to v5.2.3
* fix(deps): update module github.com/go-git/go-git/v6 to v6.0.0-beta.1
* fix(deps): update golang
* fix(deps): update module github.com/urfave/cli/v3 to v3.14.0
* chore(deps): update dependency golangci/golangci-lint to v2.14.0
* chore(deps): update dependency protocolbuffers/protobuf to v36.2
* fix(deps): update module github.com/urfave/cli/v3 to v3.13.0
* fix(deps): update module github.com/urfave/cli/v3 to v3.12.0
* fix(deps): update module google.golang.org/grpc to v1.84.0
* gateway: record which config the gateway was started from
* cmd: keep the Wayland warning off stdout
* gateway: undo slog's escapes when reading a log field
* gateway: keep a log's lines whole, and bound what reading one costs
* gateway, bwrap: give a workload's ssh a way through the gateway
* cmd: write an error to stderr, not to stdout
* gateway: say the subnet mismatch the same way in both places
* gateway: describe the address record, not a gateway that is not running
* gateway: wait for a stopped gateway to go before forgetting it
* gateway: say when the log will not close
* bwrap: tell a workload where to ask the gateway for a tunnel
* gateway: do not report a config the running gateway may not have
* doctor: report what the gateway has been doing with egress
* gateway: narrow the logs to one profile or one workload
* profiles: name the profile's display for the window manager
* xkb: prefer the running layout on an X11 session
* host-run: leave the launching session's variables behind
* gateway: keep the gateway's log where it can be read
* host-run: return while the command runs
* host-run: authorize the command against the profile's display
* profiles, bwrap: carry the host timezone with TZ, not a mount
* gateway: add a hidden gateway command with status and stop
* fix(deps): update module golang.org/x/net to v0.59.0
* gateway, session: stop opening a lock writable, and report a failed write
* sandbox: say what sharing the whole of /sys costs
* gateway: let qubesome ask the gateway to re-read its policy
* gateway: create the veth in a namespace the session owns
* images: count the gateway among the images a config names
* doctor: stop reporting a config it never read as a config with no gateway
* profiles: ask about preloading once, and never without a terminal
* gateway: own the network namespace the rules are programmed in
* doctor: tell an idle session from a broken one
* doctor: diagnose the session gateway
* images: call it refresh, and let the store go three days stale
* types: refuse the two configurations the gateway cannot serve
* bwrap: give a workload its gateway address
* gateway: wire a workload to the gateway with a veth
* gateway: give the gateway its uplink from its own image
* gateway: start one gateway for a session and wait for it
* session: hold one user namespace open for a session
* hack: record the answer the gateway was waiting on
* hack: record check 7, and ask the half of it that was missed
* hack: ask whether CAP_NET_ADMIN reaches a descendant's namespace
* xkb: prefer the configured layout to the running one
* sandbox, xkb: read a mounted /dev and a Wayland keymap correctly
* deps: drop the container runner from the firecracker path
* firecracker: boot any image, without docker
* firecracker: give a microvm a persistent data disk
* sandbox: carry a guest pty over the supervisor connection
* sandbox: run the supervisor as a guest init
* sandbox: reach a supervisor over vsock
* firecracker: build the rootfs from the unpacked bundle
* control: own the gateway wire contract
* gateway: speak to the gateway over its control socket
* clipboard, profiles: say why, instead of exit status 1
* clipboard: authenticate against both displays, not one
* profiles: give the compositor the keyboard layout of its host
* firecracker: say that a single instance machine is not built yet
* types: describe a backing microVM and refuse what it cannot do
* hack: measure what a microVM rootfs build needs
* types: describe the gateway in the config
* hack: record the veth result the gateway was waiting on
* bwrap: split a mapped path into all three of its fields
* deps: stop asking for bwrap to fill the image store
* deps: require the sandbox tools for workloads
* types: retire the container runner from the config
* doctor: diagnose a sandbox rather than a container
* images, profiles: expose what a sandbox diagnosis needs
* gpu: report what a sandbox gets, not a runner argument
* runners: delete the container runners
* runners: launch workloads under bwrap
* files: restore the rooted profile path
* sandbox: supervise a workload from inside its sandbox
* sandbox: let a workload outlive the launch that started it
* hack: record what the host answered, and fix the veth check
* bwrap: build a workload sandbox spec
* images: stop a workload launch waiting on every image in the config
* build: drop the filepath-securejoin dependency
* files: refuse a path that leaves its base instead of clamping it
* files: read config and workload files through an os.Root
* hack: also ask whether a veth can cross into a sibling namespace
* images: retire the container runner image store
* hack: answer whether a running sandbox can be re-entered
* types: decode workload YAML strictly, matching the config loader
* types: remove privileged from the workload grant
* profiles: stop reporting a closed profile as a failed one
* inception: give a launch call a deadline that fits a launch
* doctor: do not judge a profile whose container could not be inspected
* doctor: stop reporting a disabled network as a granted one
* doctor: separate a runner that failed from a profile that is not running
* doctor: tell a workload to drop a request, not a grant
* doctor: give the runner advice the runner it is talking about
* container: read the image home dir from the unpacked bundle
* sandbox: Add cap hint for args
* fix(deps): update golang
* profiles: name the compositor when it is the one that died
* dbus: send notifications with the hints type the spec requires
* sandbox: leave /run to the image and always create the runtime dir
* sandbox: share /sys so the GPU can be found
* profiles: fail the start when the profile's sandbox does
* images: give skopeo and umoci the image argument each one parses
* seccomp: deny the terminal injection ioctls
* sandbox: disable nested user namespaces for the profile
* images: keep a store key within its stated bound
* profiles: give the sandbox a home and a working directory
* profiles: gate every start on the running sandbox
* profiles: keep the profile devices out of the sandbox
* images: key the store on the whole reference
* deps: check the sandbox host requirements
* images: only pull a profile image the store cannot provide
* sandbox: pass bwrap its options through a descriptor
* profiles: launch the profile under bwrap
* sandbox: record and check sandbox liveness
* sandbox: fix devices preallocation to its exact element count
* sandbox: render a spec into bwrap arguments
* gpu: expose the CDI edits a bwrap sandbox needs
* images: reuse the bundle when a concurrent unpack wins the rename
* seccomp: deny a syscall an argument free group denies
* images: pull with skopeo and unpack with umoci
* images: read digests and bundle metadata from an OCI store
* seccomp: write the assembled filter to a memfd
* syscallgen: wrap the write error and record two assumptions
* seccomp: emit the profile as a BPF program
* seccomp: generate the syscall name to number tables
* seccomp: reject unknown fields during profile parsing
* seccomp: vendor and parse the containers/common profile
* doctor: report on the profile that is running
* cli: root a started profile's config where it was sourced from
* env: guard the expansion mapping against concurrent use
* doctor: report host devices a profile or workload asks for and lacks
* doctor: explain why a workload is not working, and wire the command up
* doctor: explain why a profile is not working
* doctor: check that the host can actually run qubesome
* profiles: only remove the profile socket when it is a socket
* profiles: satisfy the linter and relabel every podman mount
* profiles: stop when the profile does, and say when its socket is dead
* profiles: one display type, and cover the child environments
* profiles: point at host passthrough without naming a shortcut
* profiles: let a profile name the host passthrough shortcut
* profiles: add a fullscreen option, and stop advertising a dead shortcut
* profiles: connect the window manager with qubesome's X cookie
* profiles: put the compositor runtime dir somewhere the profile can write
* profiles: watch for an early exit rather than checking once
* files: move workload shared memory out of the shared runtime dir
* podman: send workloads to the profile display and isolate their shm
* profiles: present through the host X server on every host
* types: document the config fields against the new X server
* docker: send workloads to the profile display and isolate their shm
* profiles: stop sharing the host runtime dir with profiles
* profiles: quote the interactive hint and detect a dead container
* profiles: start the display through profile-display
* cli: add the hidden profile-display command
* profiles: log why the compositor went away
* profiles: run the compositor and Xwayland as the profile display
* profiles: close the test listener on the test goroutine
* profiles: wait for the compositor socket before starting Xwayland
* profiles: guard the disabled X extensions with a test
* profiles: build the profile Xwayland arguments
* profiles: say which half of the resolution was malformed
* profiles: build the profile compositor arguments
* files: add compositor and in-profile binary paths
* Sun Sep 06 2026 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.21:
* runners: Address the follow-up review findings
* types: Bound a device request before parsing it
* xauth: Build the auth records by parsing the parent file
* firecracker: Verify the downloaded kernel before using it
* runners: Resolve the runtime and image home dir without trusting input
* runners: Share only the requested USB device nodes
* runners: Keep the runtime seccomp profile and drop capabilities
* clipboard: Build the copy commands as argv
* inception: Carry workload arguments as a list over the RPC
* types: Validate workload and profile fields at their point of use
* config: Fail closed on strict YAML decode errors
* mounts: create missing mapped dirs as the current user
* gpu: Detect Mesa GPUs and share host drivers via CDI
* chore(deps): update dependency golangci/golangci-lint to v2.13.2
* chore(deps): update dependency protocolbuffers/protobuf to v36.1
* fix(deps): update module google.golang.org/grpc to v1.83.2
* chore(deps): update dependency protocolbuffers/protobuf to v36
* chore(deps): update dependency golangci/golangci-lint to v2.13.1
* fix(deps): update module github.com/stretchr/testify to v1.12.1
* fix(deps): update module github.com/urfave/cli/v3 to v3.11.0
* fix(deps): update module github.com/stretchr/testify to v1.12.0
* fix(deps): update module github.com/urfave/cli/v3 to v3.10.1
* build: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3
* build: Bump golangci-lint to v2.13.0
* test: make container runner lookup deterministic
* build: go fix ./...
* build: bump Go to 1.27
* Use libudev for USB device selection
* fix(deps): update module github.com/cyphar/filepath-securejoin to v0.7.0
* fix(deps): update golang
* build(deps): bump the go_modules group across 1 directory with 2 updates
* Thu Jul 23 2026 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.20:
* Redact container env vars in logs
* entire enable
* build(deps): bump the go_modules group across 1 directory with 2 updates
* chore(deps): update dependency protocolbuffers/protobuf to v35.1
* fix(deps): update golang
* Fix timezone symlink
* chore(deps): update dependency protocolbuffers/protobuf to v35
* fix(deps): update module golang.org/x/sys to v0.45.0
* chore(deps): update dependency protocolbuffers/protobuf to v34.2
* fix: resolve make verify failures with golangci v2.12.2
* chore(deps): update dependency golangci/golangci-lint to v2.12.2
* Tue May 19 2026 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.19:
* build(deps): bump github.com/go-git/go-git/v6
* fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
* fix(deps): update module google.golang.org/grpc to v1.81.1
* build(deps): bump github.com/go-git/go-billy/v6
* fix(deps): update module github.com/go-git/go-git/v6 to v6.0.0-alpha.3 [security]
* fix(deps): update golang
* fix(deps): update module google.golang.org/grpc to v1.81.0
* fix(profiles): adapt clone auth to go-git v6 client options API
* build(deps): bump github.com/go-git/go-git/v6
* fix(deps): update golang
* fix(deps): update module github.com/go-git/go-git/v6 to v6.0.0-alpha.1
* fix(deps): update module google.golang.org/grpc to v1.80.0
* fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
* chore(deps): update dependency golangci/golangci-lint to v2.11.4
* fix(deps): update module github.com/zalando/go-keyring to v0.2.8
* fix(deps): update module github.com/zalando/go-keyring to v0.2.7
* chore(deps): update dependency protocolbuffers/protobuf to v34.1
* fix(deps): update module google.golang.org/grpc to v1.79.3
* chore(deps): update dependency golangci/golangci-lint to v2.11.3
* chore(deps): update dependency golangci/golangci-lint to v2.11.2
* fix(deps): update module golang.org/x/term to v0.41.0
* fix(deps): update module golang.org/x/sys to v0.42.0
* fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
* fix(deps): update module google.golang.org/grpc to v1.79.2
* chore(deps): update dependency protocolbuffers/protobuf to v34
* build(deps): bump github.com/cloudflare/circl
* Fix gosec lint issues: G115, G706, G703 and update stale proto files
* Initial plan
* chore(deps): update dependency golangci/golangci-lint to v2.10.1
* Tue Feb 24 2026 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.18:
* chore(deps): update dependency golangci/golangci-lint to v2.9.0
* fix(deps): update golang
* chore(deps): update dependency protocolbuffers/protobuf to v33.5
* Add openSSF best practices badge
* fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
* Fix linter issues
* chore(deps): update dependency golangci/golangci-lint to v2.8.0
* fix(deps): update module github.com/go-git/go-git/v6 to v6.0.0-20260114124804-a8db3a6585a6
* chore(deps): update dependency protocolbuffers/protobuf to v33.4
* fix(deps): update golang
* fix(deps): update module google.golang.org/grpc to v1.78.0
* fix(deps): update module google.golang.org/protobuf to v1.36.11
* chore(deps): update dependency golangci/golangci-lint to v2.7.2
* chore(deps): update dependency golangci/golangci-lint to v2.7.1
* chore(deps): update dependency golangci/golangci-lint to v2.7.0
* fix(deps): update golang
* Add support for disabling network on workload Previously a workload could only have its network disabled when that was aligned with the Profile. This change enables the workload to be more restrictive than the Profile.
* chore(deps): update dependency protocolbuffers/protobuf to v33.2
* fix(deps): update module github.com/cyphar/filepath-securejoin to v0.6.1
* fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
* chore(deps): update dependency golangci/golangci-lint to v2.6.2
* Thu Nov 20 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.17:
* build(deps): bump golang.org/x/crypto
* fix(deps): update module google.golang.org/grpc to v1.77.0
* Sun Nov 16 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.16:
* build: Remove protoc version prefix
* fix(deps): update module golang.org/x/term to v0.37.0
* chore(deps): update dependency protocolbuffers/protobuf to v33.1
* chore(deps): update dependency golangci/golangci-lint to v2.6.1
* chore(deps): update dependency protocolbuffers/protobuf to v33
* chore(deps): update dependency golangci/golangci-lint to v2.6.0
* build: Remove renovate workflow This is being replaced by the workflow in qubesome/.github: https://github.com/qubesome/.github/blob/main/.github/workflows/renovate.yml
* build: Add renovate workflow
* build: Add renovate workflow
* build(deps): bump github.com/urfave/cli/v3 from 3.5.0 to 3.6.0
* build(deps): bump golang.org/x/sys in the golang-org group
* build: Transition to new archives config x-ref: https://goreleaser.com/deprecations/#archivesformat
* build: Add support for new cosign bundle
* Wed Nov 05 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.15:
* Enforce soft failure when mtls data not available The mtls data storage is largely a convenience feature which enables things such as mime handling. This change ensures that a profile can still be started regardless of it.
* Disable SELinux for profile and workloads In order for qubesome to work in environments where SELinux is enabled and enforced the container execution needs to opt-out from SELinux.
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump the github-actions-updates group with 4 updates
* build(deps): bump github.com/urfave/cli/v3 from 3.4.1 to 3.5.0
* build(deps): bump google.golang.org/grpc from 1.75.1 to 1.76.0
* build(deps): bump the golang-org group with 2 updates
* Wed Nov 05 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.14:
* run: Add support for X11/Wayland and NoGPU specific args This provides an easier way to customise a given workload so that it will work effectively regardless of running it on Wayland or X11. It will also avoid issues when no GPU is available.
* build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10
* Sun Oct 05 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.13:
* build: Bump PROTOC to v32.1
* build: Bump golangci-lint to v2.5.0
* build: Remove redundant tenv linter
* Drop redundant //nolint
* headless: Disable mime handling The way that mime handling works at the moment, it is incompatible with headless mode. Therefore always disables it before sending the workload to the runner.
* profiles: Mount dbus system bus path
* run: Expose Wayland env variables to workloads
* start: Improve start of profile in Wayland
* Add fallback resolution In cases were xrandr or wlr-randr are not available, or return an error, fall back to a 1440x1080 resolution. This avoids silent failures which can be difficult to pinpoint.
* Add headless subcommand
* build(deps): bump the github-actions-updates group with 5 updates
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9
* build(deps): bump google.golang.org/grpc from 1.75.0 to 1.75.1
* Mon Sep 08 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.12:
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump the github-actions-updates group with 5 updates
* build(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1
* build(deps): bump github.com/urfave/cli/v3 from 3.3.8 to 3.4.1
* build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0
* build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.8
* build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7
* build(deps): bump the github-actions-updates group with 3 updates
* build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.2
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump the github-actions-updates group with 4 updates
* Bump go-git to v6
* build: Update branch target
* build(deps): bump github.com/urfave/cli/v3 from 3.3.3 to 3.3.8
* build(deps): bump google.golang.org/grpc from 1.72.2 to 1.73.0
* build(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.2
* Sat Jun 07 2025 Paulo Gomes <pjbgf@linux.com>
- Update to version 0.0.11:
* firecracker: Refactoring code Split image used for network setup with the image used as the source for the rootfs. In the future, some of the qubesome specific logic in the latter should also be transitioned over to the firecracker image, so that the requirements from the workload image are decreased.
* firecracker: Ensure docker is used for privileged ops The use of Firecracker is experimental and heavily relies on Docker for the initial creation of the rootfs and the creation of the firecracker network taps.
* firecracker: Bump kernel to 6.1.102
* run: Add workload name to error message
* Update to new cli.StringArg API
* build(deps): bump google.golang.org/grpc from 1.72.1 to 1.72.2
* build(deps): bump the github-actions-updates group with 4 updates
* build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.1
* build(deps): bump github.com/urfave/cli/v3 from 3.1.1 to 3.3.3
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump the github-actions-updates group with 4 updates
* build(deps): bump google.golang.org/grpc from 1.71.1 to 1.72.0
* build(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0
* build(deps): bump golang.org/x/net in the go_modules group
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1
* build(deps): bump github.com/urfave/cli/v3 from 3.0.0-beta1 to 3.1.1
* build(deps): bump the github-actions-updates group with 5 updates
* build(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6
* build(deps): bump golang.org/x/net in the go_modules group
* build: Add CodeQL workflow
* profiles: Add desktop entries for workloads Instead of relying on users to create and map their own desktop entries, qubesome auto generate them based on all the workloads configured for the given profile.
* build: Add OpenSSF Scorecard workflow
* build(deps): bump the golang-org group with 2 updates
* build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.0
* Improve AMD GPU support Depending on the ROCm version, the binaries are not added to the PATH. Checking for /dev/kfd seems to be a more consistent way to check whether the AMD Kernel Fusion Driver is in place, which is what AMD uses.
* build(deps): bump github.com/go-git/go-git/v5
* build(deps): bump the github-actions-updates group with 3 updates
* Mon Feb 24 2025 pjbgf@linux.com
- Update to version 0.0.10:
* profiles: Add --detach/-d flag This new flag makes the detached mode opt-in, allowing for better user experience.
* build(deps): bump golang.org/x/term in the golang-org group
* profiles: Add interactive flag to start subcommand For improved debugging and troubleshooting, a new -i flag was added so that the profile container is started with all its dependencies, but the user has to then start the Window Manager.
* profiles: Skip image pull preemption for daemonised starts
* profiles: Inform user when pulling profile image
* flatpak: Add install subcommand To make it easier to install all flatpaks for a given profile, enumerate through all the linked Flatpaks installing one by one.
* build: Bump protoc to v29.3
* build: Bump golangci-list to v1.64.5
* build: Bump to Go 1.24
* start: Disable self-daemon call when debug is enabled
* Add support to run host Flatpaks A new subcommand flatpak run has been added to enable execution of Flatpaks installed on the host. The flatpak must be within an allow list of the Profile in order for it to be executed, however, no other HostAccess primitives are enforced.
* deps: List missing container images The deps subcommand now lists all workload (and profile) images, which are not present. To check the images across different runners, use the --runner flag:
* build(deps): bump golang.org/x/sys in the golang-org group
* build(deps): bump google.golang.org/protobuf from 1.36.4 to 1.36.5
* profiles: Daemonise profile start When a profile is started, it starts an inception server so that the containerised Windows Manager is able to execute new container workloads. The previous implementation required the start command to hold the process running for as long as the profile was running.
* Fix mime handling post mTLS implementation Workloads allowed to trigger mime handling require access to the inception server. Since the mTLS implementation, this feature stopped working as that connection could no longer be established due to the missing client mTLS credentials.
* Tue Feb 04 2025 pjbgf@linux.com
- Update to version 0.0.9:
CVE-2025-22869
* build: Remove .obs integration
* build: Bump go-git to latest from main
* Fix inception startup stutter During profile startup an inception server is initiated, with a socket file created at ~/.qubesome/run/<profile>/qube.sock. The profile dir was not present at the first attempt of starting a profile, which meant that a profile would need to be started, closed and started again for it to work.
* start: Expand GITDIR for local execution When running locally, users are not required to provide a -giturl. In such cases, the GITDIR should still be expanded based on the -local path provided.
* start: Warn users when mounting dirs that don't exist
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump the github-actions-updates group with 4 updates
* build(deps): bump google.golang.org/grpc from 1.69.4 to 1.70.0
* build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2
* build(deps): bump google.golang.org/protobuf from 1.36.3 to 1.36.4
* build(deps): bump google.golang.org/protobuf from 1.36.2 to 1.36.3
* build(deps): bump google.golang.org/grpc from 1.69.2 to 1.69.4
* build(deps): bump google.golang.org/protobuf from 1.36.1 to 1.36.2
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1
* build(deps): bump golang.org/x/sys in the golang-org group
* build(deps): bump github.com/go-git/go-git/v5
* build(deps): bump google.golang.org/protobuf from 1.36.0 to 1.36.1
* build(deps): bump google.golang.org/grpc from 1.69.0 to 1.69.2
* build(deps): bump google.golang.org/protobuf from 1.35.2 to 1.36.0
* build(deps): bump github.com/cyphar/filepath-securejoin
* Add Leap to README
* Add support for AMD GPU sharing AMD GPU sharing is based on ROCm, for Tumbleweed the installation can be done via:
* build(deps): bump golang.org/x/crypto in the go_modules group fixes CVE-2025-22869 boo#1239390
* build(deps): bump google.golang.org/grpc from 1.68.1 to 1.69.0
* build(deps): bump google.golang.org/grpc from 1.68.0 to 1.68.1
* build(deps): bump github.com/cyphar/filepath-securejoin
* build(deps): bump actions/attest-build-provenance
* Sat Feb 01 2025 Bernhard Wiedemann <bwiedemann@suse.com>
- Fix build with rpm-4.20
* Sun Dec 08 2024 pjbgf@linux.com
- Update to version 0.0.8:
* obs: Remove rebuild process
* build: Group dependabot updates
* profiles: Check whether profile is running Instead of erroring, confirm whether the profile is running, if it isn't it is safe to delete to file and start a new profile.
* build(deps): bump github.com/urfave/cli/v3
* Add GPU support for podman
* Move drive and env pkgs to internal/util
* obs: Add rebuild_package step on push
* Move ephemeral dir to ~/.qubesome/run Previously the ephemeral dir for qubesome was kept at /run/user/1000/qubesome, this has now moved to ~/.qubesome/run instead. Profile dirs are created inside the new dir and removed once 'qubesome start' finishes.
* build: Add fuzz testing checks
* profile: Enforce mTLS with inception server
* obs: Move source project to :unstable A new long standing project will be the home of qubesome packages when changes are merged into main. The new project name is: home:pjbgf:devel:languages:go:unstable
* build(deps): bump github.com/urfave/cli/v3
* obs: Trigger services on PR merge
* WSL: Eval symlink to .X11-unix dir
* xauth: Decrease min magic cookie length to 40 This is causing issues on Tumbleweed distrobox in WSL, where the cookie being generated is 49 chars long.
* Remove redundant files
* xauth: Add Fuzz tests
* clip: Show active profiles for autocomplete
* build: Pin GH Actions. Set bump interval to monthly
* obs: Change target project to align with branch convention
* build: Add OBS integration
* Mon Nov 25 2024 pjbgf@linux.com
- Update to version 0.0.7:
* host-run: Convert output to string
* start: Refactor Config loading Config loading needs to behave in different ways than other commands like xdg-open and run. Move it inside the start package instead.
* run: Simplify GITDIR sourcing
* inception: Ignore config and profile selection
* build(deps): bump github.com/urfave/cli/v3
* build(deps): bump anchore/sbom-action from 0.17.7 to 0.17.8
* build(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0
* build(deps): bump google.golang.org/protobuf from 1.34.2 to 1.35.2
* Add examples for cli commands
* Make profile setting optional Some commands in specific scenarios can infer the profile, decreasing the amount of parameters or flags to be used. Examples:
* wayland: Show experimental warning for all subcommands
* Add host-run subcommand
* Refactor inception to use gRPC
* build: Fix gofmt violations
* build: Enable dependabot
* build: Lock goreleaser to v2
* Add autocomplete subcommand
* Add flag -runner to enable runner override Runners can be defined at the workload level. Now those runners can be overriden by the -runner flag.
* deps: Print output in tabular format
* build: Add GH attestation for release artefacts
* build: Add version field to goreleaser config
* build: Bump goreleaser-action to v6
* clipboard: Add subcommand to-host
* build: Use urfave/cli for CLI wiring
* profile: Fix issue finding workloads dir For profiles started from a Git repository, the Config.RootDir was being initiated with a full path. Later in the workload run process, that full path was being joined to another full path, leading to an invalid workload dir.
* build: Update main.go reference on goreleaser.
* profiles: Preemptive pull workload images
* profiles: Clean up CLI messages
* wayland: Set additional params for xwayland-run Disable testing extensions and ensure the auth file is set.
* Add QS_DEBUG=true to run on debug mode
* wayland: Pass XDG_RUNTIME_DIR to profile container
* wayland: Initial support for profiles
* build: Fix golangci-lint warnings
* profiles: Remove dbus code This feature was work in progress and can be removed until it is fully implemented.
* build: Bump golangci-lint to v1.62.0
* build: Run make test and make verify on push
* build: Bump Go to v1.23
* build: Bump dependencies
* build: Move main.go for easier installation
* Add initial support for podman
* mime: Rename default mime handler to qubesome
* Add version subcommand
* Increase workload args max length to 250
* Update install steps
* Sun Jul 28 2024 Jeff Kowalczyk <jkowalczyk@suse.com>
- Packaging improvements:
* _service obs_scm param url add suffix .git for clarity
* _service obs_scm param filename to align with package name
* Align package name spelling with Go application binary name
* Remove define github project name components no longer needed
* Use name macro where applicable to normalize common lines
across Go app packages. Also makes renaming binary easier when
required to handle package name conflict.
* Use BuildRequires: golang(API) >= 1.22 instead of go >= 1.22.
The go metapackage points to a single go version that
increments at a date TBD after each go1.x major release. The
expression golang(API) is available immediately upon each go1.x
major release and is stable for expressing the minimum version
or a temporarily pinned version.
* Drop autosetup -p 1 arg only needed when package has patches
* Build PIE with pattern that may become recommended procedure:
%%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build
A go toolchain buildmode default config would be preferable
but none exist at this time.
* Remove ldflags -s (Omit symbol table and debug info) and -w
(Omit DWARF symbol table). This information is used to produce
separate debuginfo packages and binaries are stripped for
reduced size by GNU strip during RPM build.
* Remove ldflags -X entries for build time stamp.
This information is embedded in binaries with go1.18+ and
available via go version -m or runtime/debug.ReadBuildInfo().
* Remove go build arg -trimpath. Since this is a packaged binary,
build environment paths do not leak private information. Other
build scenarios such as minimal container builds could have a
use for -trimpath. Absent a clear need, use go build defaults.
* Add go build -o %{name}, default binary name is pkg of main().
Our packaging uses a different name for the binary.
* Sat Jul 27 2024 Paulo Gomes <pjbgf@linux.com>
- Initial package version 0.0.2
* Add validation to Profiles and Workloads
* Refactor Workload.HostAccess
* Set runtime to nvidia when using gpus
* firecracker: Change runner name
* profiles: Add error message for xhost failure
* Refactor package locations
* build: Bump dependencies
* Error on unsupported OSes
* Add initial information to README
* Set default logLevel to INFO
/usr/bin/qubesome /usr/share/doc/packages/qubesome /usr/share/doc/packages/qubesome/README.md /usr/share/licenses/qubesome /usr/share/licenses/qubesome/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Wed Nov 11 04:33:02 2026