Start9Labs/start-technologies start-os/v0.4.1-rc.1

StartOS v0.4.1-rc.1

on GitHub

Highlights

• Added opt-in background conversion of existing backups to the authenticated filesystem format, with weighted overall progress, all phases listed upfront, explicit resumption after interruption, and success or failure notifications naming the target. Creating a backup offers to update this server’s older format or skip conversion; restoring marks each old-format server backup with an explanatory warning tag. Unconverted backups remain usable for backups and restores.

• Added named read-only snapshots to the startos-backup-fs utility, with explicit creation, listing, deletion, and recovery mounts. Snapshots share unchanged data and retain earlier versions as the current backup changes; retention is managed manually.

• Added bearer tokens for API clients that cannot sign requests: start-cli auth token create --name <name> prints a token once, and requests sent with Authorization: Bearer <token> authenticate as a session with that name, which the session list shows and can revoke. Tokens idle for 30 days are revoked like other sessions.

• Added an MCP server at /mcp: AI agents and other MCP clients can call the StartOS API as tools over the streamable HTTP transport, authenticating with a bearer token from start-cli auth token create.

• Added package.exec to the API, also offered as an MCP tool: it runs a command in a service's subcontainer to completion and returns its output and exit code, with optional standard input and a timeout.

• Manage named trusted keyrings in a responsive System table with row edit/delete menus and independent package/OS trust switches. New keyrings trust packages only by default. Import Ed25519 public keys in PEM or armored GPG format, honoring revocations present in GPG exports and retaining full certificates with names and email addresses. Built-in keyrings stay first, with read-only names and no Delete option; either trust switch can still be changed.

• Rename SSH Keys to SSH Access.

• Show trusted package signers, block untrusted Marketplace installs, and require explicit confirmation before sideloading untrusted software.

• Require trusted signers for CLI package installs and OS updates by default; --trust explicitly overrides signer trust while preserving signature and integrity checks.

• Enable push from the Notifications settings modal to receive StartOS notifications while the UI is closed, including through browser-provided self-hosted UnifiedPush endpoints.

• Format a backup drive from StartOS. System > Create Backup offers "Format a
  drive", which erases a connected drive and leaves it with a single Btrfs partition
  ready for backups. The drive holding StartOS or its data is refused. Also available
  as start-cli disk format.

• Compatible security updates announced by your selected OS registry appear in Notifications and use browser push when enabled. Their Software Update link opens System → General.

• Beta updates can replace an earlier build with the same OS version.

• Store structurally typed keys without PEM armor while preserving existing sign-ins and trusted update signers during upgrades.

• A service's Dependencies card shows the version of each dependency you have installed. A
  dependency at an incompatible version opens the Marketplace on a compatible one.

• Starting and loading health checks can show a clock while waiting for an external condition. All health statuses display nonempty service-provided messages as-is; empty messages use the status label.

• Proxy plaintext service connections through StartOS when HTTP proxying is enabled. Applications see StartOS as the TCP peer; client IPs are available through X-Forwarded-For when forwarded-header generation is enabled.

• Preserve client source IP addresses for raw TLS service connections that do not require HTTP proxying.

• Prevented stale backup data beyond a file's saved length from reappearing when the file grows after an interrupted write.

• Allow retrying an interrupted first backup when no encryption key was saved, reclaiming its unusable encrypted data through the target trash.

• Prevent concurrent first opens from publishing different encryption keys for the same backup store.

• Reclaim unused data-drive chunks with an initial background Btrfs balance after upgrading and weekly maintenance thereafter.

• Warn when data-drive metadata allocation space runs low, before services encounter write failures despite reported free space.

• Network-folder backups and recovery accept dotted DNS hostnames. Bare computer names remain NetBIOS-only, and lookup errors identify the resolver used.

• Accept subcontainer environment overrides through numbered JSON_ENV_* variables, including multiline values and variable removal.

• Preserve multiline image environment defaults in package attach.

• Respect explicit removal of HOME without restoring its default.

• Show release highlights and their full-changelog link in the server's language before and after an update, with English fallback when a translation is unavailable.

• Point the welcome notification's full-changelog link at the published changelog.

• Fixed dependency links leaving the Marketplace stuck loading.

• Backups to network shares are much faster, especially over high-latency links such as remote sites reached through StartTunnel. Backup data is now written in large batches with many requests in flight, instead of waiting for a network round trip on each small write.

• Updating from StartOS 0.3.5 carries each .onion address over on the ports it served there, including for services that finish migrating after Tor. An interface that had no Tor address on 0.3.5 gets none.

• Commands run through package attach that read stdin to EOF finish after their input ends instead of hanging.

• Fixed interface updates getting stuck after a StartOS update. The Refresh Needed dialog shows interface sync progress, offers Refresh after syncing completes, and provides recovery actions if syncing fails or stalls.

• Fixed adding public domains through port-range interfaces in the web UI and CLI.

• Enabled port ranges retain ownership of their configured domains when checking for duplicates.

• Removing a gateway also clears the address choices services made on it.

• Gateways selected for outbound traffic by the server or a service must be deselected before removal, preventing removal from cutting off outbound connectivity.

• Adding a tunnel reports an error after 30 seconds if its network interface remains unavailable, instead of waiting indefinitely.

• The UI offers recovery actions when its cached copy is corrupted.

• The UI picks up its own update sooner after a StartOS update.

Security

• Strengthened backup encryption authentication and password-protected key wrapping, and removed backup encryption keys from process arguments and recovery errors. Authenticated current references reject substitutions of individual stored records; rollback to a genuine older complete backup view remains possible. Existing backups remain usable for backups and restores until explicit conversion. Conversion rewrites encrypted data, resumes after interruption, and prevents older StartOS releases from reading the converted target.

• Enforce HTTP authentication on both plaintext and TLS service connections when an HTTP proxy authentication policy is configured.

• Websites you visit can no longer use your browser to control a server that is being set up or is in diagnostic mode. During setup and diagnostics, open the server at its .local address or IP address. Thanks to dritzps for reporting this.

• Update node-forge to 1.4.2.

• Updated service-container system packages to include available Debian security fixes, including the Brotli decoder fix.

Important

Existing OS-update trust selections are preserved during migration. If individual Start9 keys were removed, the remaining trusted keys are retained as separate entries rather than enabling the complete Start9 group for OS updates.

Production Marketplace packages must be re-signed with an enabled Start9 key before rollout. Packages signed only by Start9 Alpha or other untrusted keys remain blocked unless their publisher is explicitly enabled.

• Clients of an HTTP-proxied service with configured authentication must provide those credentials on plaintext connections too.

• Services with HTTP proxying enabled now see StartOS as their TCP peer on plaintext connections. Client addresses are available through X-Forwarded-For when the binding enables header generation.

• Downgrading to an earlier StartOS version restores that version's HTTP authentication behavior, including its unprotected plaintext connections. Downgrades are blocked for HTTP authentication policies without a TLS wrapper; add TLS to those bindings before downgrading.

Image Downloads

OS Images Checksums

SHA-256

f0b774bc93b271bcc8fb5103b7a89bd3c2fe4ee33cc4fcc3421153cd34d4e44f  startos-0.4.1-4a33d49_aarch64.iso
b987703f0d06c1034d259f1adb8165f1c1fc202dedc09a24b511bf16114add39  startos-0.4.1-4a33d49_aarch64-nonfree.iso
852d87c73272c35e1ddcd604f5d84e33513c1922cf4d7e9e23ab5cef535fbe41  startos-0.4.1-4a33d49_aarch64-nvidia.iso
9ccfccc6aa6562bdc3e0d6441d78077bb31c71e17ef152a8da466f2d4dcf0ae3  startos-0.4.1-4a33d49_riscv64.iso
41aa29c468772b54b4838d80321cf212fe9d41e98beabfc01ec0c656d68607be  startos-0.4.1-4a33d49_riscv64-nonfree.iso
61ef862bf505bf396c54c876f3e363c14d100c9c34ea986190020f3de338918c  startos-0.4.1-4a33d49_x86_64.iso
47a941d159ea0c0a936484b247945bdfff65e16b0897df277e911e23f55ca865  startos-0.4.1-4a33d49_x86_64-nonfree.iso
099c9979f8ca50f6ad63a88741b43841e77fa63f53c37c846656ef3f5c228773  startos-0.4.1-4a33d49_x86_64-nvidia.iso
50e49fbbe9ef6dabab3e4b0f061ee4b16ef27fe87669c8d9ae03d16f4e53797c  startos-0.4.1-4a33d49_raspberrypi.img
bac9f284f34b0c29b1ae1e5ed13d25dede6c984c4e140ff3f6467d3e9e8e1216  startos-0.4.1-4a33d49_raspberrypi.img.gz
d14a85dfb512b91ef3a0ae19508c6d387a055c2c0e457b873c64274ebf9b8106  startos-0.4.1-4a33d49_aarch64-nonfree.squashfs
39c5b369c68f4758b59821282fae00efebd6dea7da1b653b0e4ab3df6379f841  startos-0.4.1-4a33d49_aarch64-nvidia.squashfs
a20eae4b396ccd2174d1450fbf0ed3eb7980757cad46d4b4616d66b9490acc9a  startos-0.4.1-4a33d49_aarch64.squashfs
0b8392cf5cf08cd52962e3e796e4121b1dc109ed49bf5f7d1cfbbdfd4b65067b  startos-0.4.1-4a33d49_raspberrypi.squashfs
d2d8e097159e25979209896b2dd7cbc021c57247cf0f6e13a8064b2fc8cea221  startos-0.4.1-4a33d49_riscv64-nonfree.squashfs
e2e2198451e51dab663c3d0340777cef32fd058fcd50bb0eb11d169f5ef630a9  startos-0.4.1-4a33d49_riscv64.squashfs
80bbc03200df9dffc4bd35d243df6a675db077e463fc9443925683350dfe3717  startos-0.4.1-4a33d49_x86_64-nonfree.squashfs
acd61e7562972ca7bd301815e21bf3c44a76764613fb6530287078b160f59f60  startos-0.4.1-4a33d49_x86_64-nvidia.squashfs
5916ef4b571f6c4ce5f0c14723af3292750fc159e203d1ff90b45c5c70b0f6fc  startos-0.4.1-4a33d49_x86_64.squashfs

BLAKE-3

f08176d56ddd6b5cec0d955478f06827effe5a5df4587b904545f0c6a678d519  startos-0.4.1-4a33d49_aarch64.iso
e6fc233a54b4dcf6f2677c8dd77034d25ff1523feb5a2bd567a975176a0f1e7f  startos-0.4.1-4a33d49_aarch64-nonfree.iso
fb086f92d6559d14e297276c7a67f3cf1aae3e793c6b6e4646d2b0af51afc3c7  startos-0.4.1-4a33d49_aarch64-nvidia.iso
0f41b1f40f87e447291b0496e2b22b9ed80a1229a908bb2c00a89ad62c4937b7  startos-0.4.1-4a33d49_riscv64.iso
52a985ed96ede6136842398083edff4fbfdea5f901b267e33ee16b166b9f6d36  startos-0.4.1-4a33d49_riscv64-nonfree.iso
7957518b776c805182167dcd49d90dd50bd66349992c4275edc493ddecfaa8bd  startos-0.4.1-4a33d49_x86_64.iso
4984f9f62e974d450fe35b2f6a69bbc64bc3db05c7e089eef39ece429e38b6d0  startos-0.4.1-4a33d49_x86_64-nonfree.iso
a3d0c78fe7e0fecf12d91b6b4eb875ec70f6c6fa9dc11564730d107891585208  startos-0.4.1-4a33d49_x86_64-nvidia.iso
926f1396e54276adf3a7d2c0def8f6d4689168f810a93c7b7acb759243971bd2  startos-0.4.1-4a33d49_raspberrypi.img
02bdc447a5edb393885015acc1c4bc354a58c806c5c553580dacda66149cf3de  startos-0.4.1-4a33d49_raspberrypi.img.gz
9c43c698998c61016230fcc688176ffd8bdaffd45eafda81d2af49ac848c96db  startos-0.4.1-4a33d49_aarch64-nonfree.squashfs
1b716765c276e36cc9a98d72188c809ef4de9d23108e1f2fdb9144ef02ec6c43  startos-0.4.1-4a33d49_aarch64-nvidia.squashfs
e274eecf80614a73935fd9b13dbbfce24738f4a7b9f235e77e0286c65588602c  startos-0.4.1-4a33d49_aarch64.squashfs
2ef8bd84bb6f06a159403c8275a01a0d2e922f863ee7fd70db74850d66b5460a  startos-0.4.1-4a33d49_raspberrypi.squashfs
00d59ceae86ba60d99cbe2de0a28940ff4bfab6cfc25ca42c246644c4700fd47  startos-0.4.1-4a33d49_riscv64-nonfree.squashfs
7f41855ea0ed83c1815e6e67dda94b8fb0d44a1a356e466b59784d2dbf56a7bc  startos-0.4.1-4a33d49_riscv64.squashfs
351766b630d425ede87d0f8b5377a6fbf77da4caab0a9fbb6f144001ce0e4b13  startos-0.4.1-4a33d49_x86_64-nonfree.squashfs
a0efd21cd7d0936a198bdd0dd455c202d306689760ef17ba58973b8ea215ddf8  startos-0.4.1-4a33d49_x86_64-nvidia.squashfs
ff34b3caf942f25b43eb8d9431395c3217b91b86f044b7c1b66c821975d61666  startos-0.4.1-4a33d49_x86_64.squashfs