Polaris v1.3.9

Polaris v1.3.9 is a Linux reliability and security patch for private-stream capture, Gamescope and portal ownership, high-refresh cadence, and hostile-input boundaries.

Important: upgrading from v1.3.8

Nothing extra is required beyond the usual package, --setup-host, and restart sequence. Existing configuration remains valid.

This release is especially relevant if you use Gamescope Stream, a Hyprland virtual display, high-refresh private streaming, or a VAAPI encoder on the private headless route.

Fedora 44

wget --output-document=./Polaris-fedora44-x86_64.rpm https://github.com/papi-ux/polaris/releases/download/v1.3.9/Polaris-fedora44-x86_64.rpm &&
sudo dnf install "./Polaris-fedora44-x86_64.rpm" &&
sudo -H polaris --setup-host &&
systemctl --user restart polaris

Arch Linux / CachyOS

wget --output-document=./Polaris-arch-x86_64.pkg.tar.zst https://github.com/papi-ux/polaris/releases/download/v1.3.9/Polaris-arch-x86_64.pkg.tar.zst &&
sudo pacman -U ./Polaris-arch-x86_64.pkg.tar.zst &&
sudo -H polaris --setup-host &&
systemctl --user restart polaris

Ubuntu 24.04

wget --output-document=./Polaris-ubuntu24.04-x86_64.deb https://github.com/papi-ux/polaris/releases/download/v1.3.9/Polaris-ubuntu24.04-x86_64.deb &&
sudo apt install ./Polaris-ubuntu24.04-x86_64.deb &&
sudo -H polaris --setup-host &&
systemctl --user restart polaris

Bazzite users should follow the exact-output rpm-ostree flow in the Bazzite guide. SteamOS 3.8 uses an exact output target and a read-only restoration trap; follow the SteamOS guide. SteamOS remains an experimental Desktop Mode package rather than certified Game Mode support.

Changes

VAAPI and capture safety

• Allows VAAPI GPU-native capture on the private headless ext-image-copy route only when the captured DMA-BUF reports DRM_FORMAT_MOD_LINEAR.
• Keeps tiled, invalid, missing, windowed-private, and direct physical-monitor modifiers on SHM capture. A failed import or conversion retires the headless GPU-native probe for the process and preserves the exact reason in Doctor telemetry.
• Hardens Wayland frame ownership, VAAPI DRM PRIME object/layer/plane validation, KMS render descriptors, capture shutdown, and high-refresh frame pacing.

Gamescope, portal, and virtual displays

• Drops executable capabilities before portal-oriented worker threads start and restores ordinary same-user /proc access, allowing xdg-desktop-portal to authorize a Polaris binary installed with cap_sys_admin=ep. Explicit capture=kms remains available on a separate restart that retains the capability.
• Accepts capability-enabled owned Gamescope generations and closes inherited Polaris descriptors before launching owned Gamescope, so Gamescope/Xwayland descendants cannot keep RTSP or HTTPS ports bound after Polaris exits.
• Warns when unsupported nested Gamescope WSI can hide a blocking native dialog. The supported route remains Gamescope Stream through gamescope_stream, not a nested Gamescope client inside the private labwc session.
• Creates, verifies, and removes only the exact process-scoped Hyprland virtual output, failing closed rather than silently streaming a physical display.

Session, API, and network hardening

• Surfaces private-session launches that never attach, recognizes override-redirect windows during attach, snapshots the session environment under the lifecycle lock, and bounds preparation commands without releasing ownership early.
• Reapplies an explicit session stream mode when its canonical ID still matches but deterministic runtime, capture, or display companion state has drifted, while preserving the normalized no-op and session-scoped restoration paths.
• Validates client launch-key length, peer-declared control lengths, KMS descriptors, Steam app ids, artwork URL hosts and redirect hops, pairing PIN claims, and Doctor action rate limits.
• Prevents duplicate control-channel network-risk ingestion while preserving telemetry from secondary clients.

Field-validation limits

• The release is scoped to the exact-head unit, sanitizer, compile, package-build, and package-smoke matrix. No separate affected-host candidate smoke is claimed.
• Linear VAAPI headless capture is policy-, unit-, sanitizer-, and package-build tested, but the affected AMD 4K route still needs hardware confirmation of first frame, sustained requested cadence, truthful capture_gpu_native=true, clean fallback, and no return of the prior AV1/startup failures.
• Hyprland virtual-display ownership and the Gamescope Stream portal route still need affected-host end-to-end confirmation. Nested Gamescope inside the private labwc session remains unsupported.
• Same-mode session normalization is unit- and sanitizer-tested but still needs an affected-host launch confirming that drift is corrected, an already-normalized launch stays a no-op, and teardown restores the prior host defaults.
• Windowed-private and direct physical-monitor VAAPI GPU-native capture remain deliberately disabled pending the separate #410 and #411 hardware work.

Official assets

• Polaris-arch-x86_64.pkg.tar.zst
• Polaris-fedora44-x86_64.rpm
• Polaris-steamos3.8-x86_64.pkg.tar.zst
• Polaris-ubuntu24.04-x86_64.deb