Breaking Changes

2026-11-01: root disk key is now bound to early boot

The key of your encrypted root partition was sealed to a TPM policy that stays valid for the whole boot. A crafted root partition booted with our signed images could therefore get the TPM to release your real key once the system had left the initrd.

New installs now seal the key so that it can only be unlocked in the initrd. Existing installs keep working, but prompt for your recovery key until you re-enroll:

1. Update and reboot into the new version.

2. Make sure you have your recovery key.

3. Re-enroll the TPM.

2026-10-31: features need a second updatectl update

Feature configuration now ships as separate confexts, which the update to this version doesn’t download yet. If you have any feature enabled, run updatectl update again after rebooting into the new version, then reboot once more. Until then, your features run without their configuration (e.g. firewalld won’t start).

2026-09-26: cosmic-greeter keeps crashing

Note

Fixed in 20260926224913

cosmic-greeter 1.9 has a problem on fresh installs where it can’t start itself. You can work around it with the following steps:

1. Open a TTY by pressing Ctrl + Alt + F2.

2. Log in with your username and password.

3. Start the COSMIC session manually:

   start-cosmic

4. Go through the cosmic initial setup.

Once setup is complete, cosmic-greeter will work normally on future reboots.

Upstream is working on fixing the issue. fixed in pop-os/cosmic-greeter#553.

2026-08-30: we have rotated our keys

Current and future Secureboot users must follow our key-rotation guide. Everyone else only needs to re-enroll the TPM.

2026-08-26: the steam-gaming extension is now simply called gaming

Your system will fail to update until you disable the Steam-Gaming extension. So, run updatectl disable --now steam-gaming && updatectl update, and then re-enable the gaming extension after rebooting into the newly installed version.

2026-07-21: switch from tmpfiles to confext for /etc

Action required before you reboot

Applies to every system updating from build 20260721000055 or earlier.

If you boot the new image without completing those steps, the new image will start without your user account and will re-run first-boot setup. Nothing is lost permanently as the account is still present after a rollback.

1. Persist /etc before updating

Copy the current /etc into the mutable extensions directory and drop the symlinks that point back into the factory tree:

sudo mkdir -p /var/lib/extensions.mutable
sudo cp --archive --no-target-directory /etc /var/lib/extensions.mutable/etc
sudo find /var/lib/extensions.mutable/etc -lname '*share/factory*' -delete

2. Update and reboot

updatectl update
sudo systemctl reboot

Log in to confirm your user account is intact before continuing.

3. Remove the stale /etc

The old /etc is still on disk and could cause problems in the future.

• Roll back to build 20260721000055 or earlier.
• Confirm which build you booted:

   cat /etc/os-release

Do not continue unless this reports 20260721000055 or older.

• Delete the stale configuration:

   sudo rm -rf /etc/*

• Reboot back into the new image.