lainOS/lainOS-layer-02
lainOS/lainOS-layer-02
4
1
Fork 0
Code Issues Pull requests Projects Releases 28 Packages Wiki Activity Actions
28 releases 29 tags
  • 2026.07.11-rc3 deb3df495b

    2026.07.11-rc3 layer 02: Protocol 7 Pre-release

    amnesia released this 2026-07-11 10:17:11 +02:00 | 30 commits to main since this release

    ####INSTALLATION####

    lainOS layer 02 user guide(access with lainos-help in the terminal.)
    lainOS Privacy Guide for Sensitive Work(access with lainos-privacy-help in the terminal)
    protocol7-core-Security Analysis(new valgrind and static analysis sections~zero mem leaks detected)

    lainOS layer 02 ~ 2026.07.10-rc3 Changelog

    Third release candidate to fix issues in second release candidate. This release is polished.

    All interfaces pass clean. This RC phase will continue for another week or two, and layer 02 will be released as stable thereafter.

    • ani-cli fixed!!!
    • Volume keys now work through wpctl

    ⚠️ To preserve privacy, WiFi does not autostart on first boot(read below for usage).

    WiFi (iwd) no longer starts automatically at first boot. Use wifi-autostart enable to activate WiFi autostart on subsequent boots. This is a deliberate change, consistent with lainOS's default-private posture elsewhere in the system (WiFi MAC randomization, ephemeral machine-id, boot clock randomization, time-sync over tor, IPv6 disabled by default etc...).

    To activate WiFi interface:

    wifi-toggle on

    To Scan for networks, use wifi (this tool prompts you to select your network and enter your password):

    wifi

    To activate WiFi autostart (start WiFi automatically at every boot):

    wifi-autostart enable

    See lainos-help for full documentation, or lainos-privacy-help for a guided walkthrough of using this alongside lainos-sdwdate and the new lainos-obfs4/lainos-snowflake bridge toggles for sensitive work.

    New Tools (lainos-utils)

    Tor Bridges ~ lainos-snowflake / lainos-obfs4

    Toggle scripts to enable/disable obfs4 or Snowflake pluggable transports, disguising Tor traffic to evade network-level censorship or hide Tor usage from your local network. Each writes a working bridge configuration on first use and toggles it on subsequent runs.

    snowflake enable    # or obfs4 enable
snowflake disable   # or obfs4 disable
snowflake status    # or obfs4 status

    WiFi Control ~ wifi-toggle / wifi-autostart

    • wifi-toggle {on|off|status} ~ fully powers the WiFi radio on/off (service + hardware rfkill block), not just disconnects.
    • wifi-autostart {enable|disable|status} ~ controls whether WiFi starts automatically at boot. Disabled by default for privacy (see warning above).

    Time Sync ~ lainos-sdwdate

    lainos-sdwdate enable   # activate time-sync over tor
lainos-sdwdate disable  # deactivate time-sync over tor; switches to chrony(default)
lainos-sdwdate status   # check if sdwdate or chrony is activated

    Toggle between chrony (default) and sdwdate (Tor-based). See New Packages below for details.

    Privacy Guide ~ lainos-privacy-help

    Opens a new, dedicated step-by-step privacy guide for sensitive work sessions, covering the correct order to enable WiFi controls, sdwdate, and bridges before connecting to any network, downloading Tor Browser safely over Tor, and returning to a clean default state afterward.

    New Packages

    sdwdate (new)

    Secure Distributed Web Date ~ Tor-based, fingerprint-resistant time synchronization. A lainOS port of Kicksecure/Whonix's sdwdate, fetching time from multiple independent Tor onion services and cross-validating against Tor's own network consensus data, instead of trusting plaintext, unauthenticated NTP.

    • Installed by default, but not enabled by default ~ chrony remains the active time-sync service out of the box. sdwdate has no fallback time source; if Tor is unreachable, it cannot sync time at all. Switching methods is a deliberate, local action: 
      lainos-sdwdate enable    # switch to Tor-based time-sync
lainos-sdwdate disable   # switch back to chrony (default)
lainos-sdwdate status    # check which is active
    • Verified working end-to-end on a fresh ISO install: real onion sources contacted, Tor consensus sanity checks passing, correct gradual clock correction applied via sclockadj.
    • Fresh-install log permission bug found and fixed during ISO testing ~ log file creation moved from the install-time hook into the init script's start_pre(), since the former was found not to reliably survive Calamares' chroot-based install process.
    • A separate first-sync permission bug was found and fixed after publishing: sdwdate's first-ever successful sync (or any hard clock jump) shells out to /bin/date directly rather than the gradual sclockadj path, and needed the same CAP_SYS_TIME capability grant.
    • See the package README for full technical details on what was ported, what was reimplemented for lainOS, and what was deliberately left out (AppArmor, privleap, Qubes-specific components).

    bootclockrandomization (new)

    Randomizes the system clock by a small amount (up to ±180 seconds) early in boot, before networking or Tor come up, so the machine's clock is never exactly aligned with another machine's during the boot window. A LainOS port of Kicksecure/Whonix's bootclockrandomization.

    • Installed and enabled by default ~ fully passive, no user decision or network dependency required.
    • Verified via a real reboot on baremetal (T480): fires correctly before networking, subsequently corrected to real time by the active time-sync service.

    snowflake-pt-client (new)

    Tor's official Snowflake pluggable transport client, packaged from upstream source. A dependency of lainos-snowflake.

    python-sdnotify (new)

    Small MIT-licensed Python implementation of the systemd sd_notify protocol, packaged from upstream source since it isn't available in Arch's official repos. A dependency of sdwdate.

    Bug Fixes

    • makepkg/doas: PACMAN_AUTH=(doas) is now shipped in the ISO's default /etc/makepkg.conf.
    • Tor control-port cookie access: DataDirectoryGroupReadable 1 (required alongside CookieAuthFileGroupReadable 1 for group-based access to Tor's control cookie, used by both nyx and sdwdate) confirmed present in the ISO's shipped torrc.

    Documentation

    • User guide fully updated: new "Pluggable Transports ~ Bridges," "Time Sync ~ sdwdate," and "Privacy Guide for Sensitive Work" sections; WiFi section updated with wifi-toggle/wifi-autostart; stale notes about LESME auto-configuring obfs4 removed.
    • New dedicated Privacy Guide for Sensitive Work, covering the correct sequencing of WiFi controls, sdwdate, bridges, and torbrowser-launcher for a single sensitive session.

    Known issues
    • Some Nvidia cards have trouble with Sway.

    Get connected
    • LainOS Matrix Chat: https://matrix.to/#/#lainos:catgirl.cloud
    • Discord Server (Discord violates your privacy by spying on you): https://discord.gg/JdMQvkHqwH
    • Onion XMPP Server and Chat: private-chat-c75bebbc-50f3-447d-811f-41f83de11811@conference.glcuf4hcwbm3lt6grg7jfwwus7sqpuojozfsnbzzcsf7vbm2jcfqckid.onion + full setup guide at https://lain.rocks (and our anon community lainboard)
    • Website: https://lainos.net
    • Onion Service: http://lainos3cbhrlsc4qyzu6o7jwhvnvakdtohcc46ds5aohdagakddftbid.onion
    • irc.libera.chat ~ #LainOS

    LALL<3

    Downloads