Prelude

This wasn't an easy release.

The last commit on tag/v0.0.23 was made in paranoid mode, with the utmost effort to properly close the doors for your battlefield—if it comes to that—or to set the table for the next captain: someone with a fierce and generous review process, just as you taught me.

krux-installer v0.0.23

This release marks the shift to an offline-first installer: firmware binaries are now embedded directly in the package instead of being downloaded at runtime, and everything that supported the old online flow has been removed.

Features

• Firmware .kfpkg packages are now embedded directly into the installer build (#247), with SHA256 checksums of every package computed and verified before embedding (#285).
• Migrated the build tooling from Poetry to UV, including dependabot fixes for the new setup.
• Added structured logging and build verbosity control to CI builds (#261).

Fixes

• Added Debian 13 (Trixie) support (#266).
• Renewed the expired license file (#257).

Cleanup (Dead code from the old online flow)

• Removed the download screens and their e2e tests (#278), plus the download, selector, and unzip utilities along with their unit tests (#279).
• Removed the runtime signature-verification (signer) dead code (#277).
• Removed the internet-connection check at startup (#276) and orphaned i18n entries (#280).

Docs

• Added contributing guidelines, documented the embedded-binaries approach (#264), and specified the new offline workaround (#282).

Dependencies & CI

• Routine bumps: cryptography 46→49, pyinstaller 6.19→6.21, requests, black, pylint, poethepoet, Python 3.14.3, pysudoer 0.0.3, and GitHub Actions.

Full Changelog: v0.0.22...v0.0.23

Tests

How much are you prepared to trust—or not to trust?

How to Install

Download the proper binary for your OS, along with its signature file.

Then proceed with signature verification. My key can be found here:

gpg --import qlrd.gpg

and then:

gpg --verify <SHA256 sign file>

Canon

If the signature is correctly verified, proceed with integrity verification: read the tag/v0.0.23 commit message carefully and compare the reproducibility hashes shown there (and in the CI logs) against your own.

Note from @qlrddev (no puns, trust me)

Please excuse any grammar mistakes. Every QA step hurt in a deeply human way. Some mentioned people below was a family to me.

So please, I ask once more: read the tag/v0.0.23 commit message carefully.

I would like to thank you all: @ghost, @jdlcdl, @odudex, @tadeubas, and my brother @kkdao. Special thanks to @joaozinhom, who put the most effort into this release, and @0xaudron, who provided a fierce review.

Let's catch up when we're back—but if not, it was an honor anyway.