WolOS 0.11.3: signed boot, a real installer, and updates that really roll back

The first release built the new way: per-computer Secure Boot keys, an installer that only touches what it planned, and a rollback that works.

WolOS 0.11.3 is out. It is the first image built from published sources only: one recipe repository, clean-chroot builds, and an ISO that is tested in a virtual machine before it is uploaded. Here is what changed for people using it.

Secure Boot with your computer's own keys

Every computer now makes its own boot keys at install. If the firmware is in Setup Mode they join Microsoft's; on most PCs you confirm the key once, on a blue screen at the first start, with the password boot. Each system copy boots one signed image that holds the kernel, the initramfs and the command line, with kernel lockdown and module signatures on. The Secure Boot page walks through the key screen.

Updates that really roll back

Before 0.11.3 the boot loader kept starting a failed system copy. Now three failed starts fall back to the other copy on their own, and an older copy can no longer be started once it is retired. The system file check that runs at every start went from 7 s to 0.4 s.

A real installer

Install WolOS now offers Erase Disk, Install Alongside with a size slider for Windows or Linux, and a Manual mode. You choose encryption with a password or the TPM chip, create an account, and read a summary of exactly what will change before anything is written. The plan names the partitions it may touch; if anything else moves, the install stops. Details are in Installing WolOS.

One app cannot take the desktop with it

Each app now runs with task and memory limits while the session keeps its share. A memory bomb used to stop new programs for 95 seconds; now they start in 3.5 ms. Memory Saver gives a background app's memory back 30 seconds after you stop using it, and leaves sound, video and games alone.

A first look at new programs

Downloads, removable disks, AppImages, Windows programs and new programs are checked the first time they open, on this computer only. Nothing appears when nothing is wrong. Full ClamAV signatures are optional and off by default.

Get it

The ISO, its checksum and the Secure Boot and VirtualBox notes are on the Download page. The full list of changes is in the Changelog.