Authority-signed OS images. Upgrade a box in place with admin upgrade <url>.
On the box: admin upgrade https://www.rowan.id.au/pros/dist/pros-current.img
| Release | Build | Version | Date | Notes | Image |
|---|---|---|---|---|---|
| r53 | 252 | 1.1.0 | 2026-07-10 09:28 UTC | (no notes) | pros-r53.img (9 MiB) |
| r52 | 234 | 1.1.0 | 2026-07-10 04:37 UTC | (no notes) | pros-r52.img (9 MiB) |
| r51 | 224 | 1.1.0 | 2026-07-10 01:08 UTC | (no notes) | pros-r51.img (9 MiB) |
| r50 | 216 | 1.1.0 | 2026-07-10 00:42 UTC | (no notes) | pros-r50.img (9 MiB) |
| r49 | 214 | 1.1.0 | 2026-07-10 00:37 UTC | (no notes) | pros-r49.img (9 MiB) |
| r48 | 200 | 1.1.0 | 2026-07-09 21:57 UTC | (no notes) | pros-r48.img (9 MiB) |
| r47 | 197 | 1.1.0 | 2026-07-09 14:58 UTC | (no notes) | pros-r47.img (9 MiB) |
| r46 | 195 | 1.1.0 | 2026-07-09 14:38 UTC | (no notes) | pros-r46.img (9 MiB) |
| r45 | 193 | 1.1.0 | 2026-07-09 14:18 UTC | (no notes) | pros-r45.img (9 MiB) |
| r44 | 191 | 1.1.0 | 2026-07-09 13:43 UTC | (no notes) | pros-r44.img (9 MiB) |
| r43 | 189 | 1.1.0 | 2026-07-09 13:17 UTC | (no notes) | pros-r43.img (9 MiB) |
| r42 | 187 | 1.1.0 | 2026-07-09 12:36 UTC | (no notes) | pros-r42.img (9 MiB) |
| r41 | 185 | 1.1.0 | 2026-07-09 11:56 UTC | (no notes) | pros-r41.img (9 MiB) |
| r40 | 183 | 1.1.0 | 2026-07-09 11:41 UTC | (no notes) | pros-r40.img (9 MiB) |
| r39 | 180 | 1.9.0 | 2026-07-09 10:54 UTC | Two real-hardware fixes (Dell). SERVICES ON REAL HARDWARE: ring-3 services (tintin, nemo, queequeg) now bind their ports on real hardware / KVM. The LAPIC preemption timer used TSC-deadline mode, and re-arming an absolute deadline from inside the timer ISR livelocked a preempted ring-3 process on KVM (it never advanced past its entry, so e.g. tintin never reached its listen). Now uses the LAPIC initial-count one-shot unconditionally (a preempted process always resumes and completes; identical on emulation and real hardware). Proven on KVM: `admin service start tintin` then `curl :80` returns the page. PRANO OVER SSH: the full-screen editor no longer freezes during render over SSH. A tcp send-loop yield (added last release) let the global poll() drain another socket, stealing the sender frames and desyncing the interactive stream; removed. Charon SSH and normal transfers unaffected. | pros-r39.img (9 MiB) |
| r38 | 178 | 1.8.6 | 2026-07-09 09:45 UTC | New `admin service restart <name>` — stops then starts a service in one command (handy for relaunching a service that got stuck from a failed autostart). tintin still prints its startup progress so a failing start shows where it stops. | pros-r38.img (9 MiB) |
| r37 | 177 | 1.8.5 | 2026-07-09 09:40 UTC | tintin now prints its startup progress (starting / config loaded / web root ready / logs ready / listening, or failed to bind). If a tintin start fails silently, the last line printed on the console pinpoints which step died. On a healthy store it reaches "tintin: listening" and binds port 80. | pros-r37.img (9 MiB) |
| r36 | 175 | 1.8.4 | 2026-07-09 08:50 UTC | New `ports` command (alias `netstat`): lists every active TCP socket — local port, state (LISTEN/ESTAB/...), peer, and owning task. Run it on the console to see what is actually bound and connected (e.g. whether a service really has its listener up). Read-only diagnostic. | pros-r36.img (9 MiB) |
| r35 | 173 | 1.8.3 | 2026-07-09 07:34 UTC | Admin cross-store access: root can now read, write, and cd into any user or service store by absolute path (e.g. `echo page > /data/tintin/files/default/www/index.html`, or `cd /data/bob/files`). Previously writes were confined to root own files/ (an effective chroot), so provisioning a service store from the console was impossible. Own-store writes are unchanged; cross-store is root-only. This unblocks provisioning tintin/queequeg stores from the console. | pros-r35.img (9 MiB) |
| r34 | 170 | 1.8.2 | 2026-07-09 06:43 UTC | tintin now self-provisions its web root on startup: on boot it creates default/www in its own service store and writes a built-in index.html if none exists, so a freshly-started tintin serves a page immediately with no manual setup (which previously needed DIR_SERVICE and deadlocked over SSH). Start it with `admin service start tintin` and browse the box on port 80. Replace default/www/index.html to serve your own site. | pros-r34.img (9 MiB) |
| r33 | 169 | 1.8.1 | 2026-07-09 05:34 UTC | Adds the crypto foundation for TLS serving: P-256 ECDSA signing (deterministic per RFC 6979, verified against the RFC test vectors) and self-signed X.509 certificate generation, in crates/cert. Additive and self-contained (no_std, no new deps) — not yet wired into a live TLS path, so no behaviour change; it is the building block for tintin serving HTTPS. All 27 crypto tests pass. | pros-r33.img (9 MiB) |
| r32 | 168 | 1.8.0 | 2026-07-09 04:23 UTC | New tools + a networking fix. TOOLS: `argo` joins the toolkit — it fetches what another user has published (`argo owner:name`, `argo --list owner`), the inter-user role that used to live in wget; `wget <url>` is now the traditional HTTP downloader (saves to files/; `curl` still prints). TINTIN: ships default web content (a static page, a psh dynamic page, and a SQL-backed psh page) so the web server has something to serve out of the box. NETWORKING: fixed a bug where a slow or retransmitting TCP send could monopolise the CPU and freeze the whole box — send now yields while waiting for ACKs (thanks Dell). Plus refreshed documentation across the board and a GUIDE typo fix. Built on the v1.7.0 concurrent-SSH + cache release. | pros-r32.img (9 MiB) |
| r31 | 157 | 1.7.0 | 2026-07-09 01:36 UTC | Concurrent SSH + storage cache map. SSH: multiple users can now hold sessions at the same time — the server spawns a worker task per connection instead of running one session to completion before accepting the next (which made a second login block, or time out, until the first logged out). Two people can work simultaneously, each with their own privileges. STORAGE: ring-3 programs can now open files as random-access, RAM-cached descriptors (open/read/write at offset/flush/close) over the encrypted store — the foundation for services like the SQL server to cache their data. Also raises the per-task kernel stack so session workers have headroom. Built on the v1.6.0 security + TCP release. | pros-r31.img (9 MiB) |
| r30 | 151 | 1.6.0 | 2026-07-08 12:56 UTC | Security + networking release. SECURITY: fixes an HMAC-SHA256 forgery hole — the MAC verify silently truncated its input at 1024 bytes, leaving the tail of any sealed file or SSH packet over 1 KB unauthenticated under the stream ciphers; now streamed over the whole message (with regression tests). BREAKING: sealed /data files larger than ~1 KB from earlier releases will fail their MAC and must be re-saved. NETWORKING: new Linux-style TCP — RTT/RTO estimation, Reno congestion control, and peer-window handling — which should improve bulk-transfer throughput. SSH: non-interactive `ssh <box> <cmd>` output now streams instead of truncating at 8 KB. Includes the r27 download-hang fix, the r29 48K window, and the half-size stripped image. | pros-r30.img (9 MiB) |
| r29 | 149 | 1.5.4 | 2026-07-08 11:05 UTC | Faster upgrades: the TCP receive window is raised from 32 KB to 48 KB (kept under the 64 KB NIC ring), keeping ~1.5x more data in flight so bulk downloads fill the pipe better. Also merges the features branch: a new rand_test tool (128 bits of hardware RDRAND entropy from ring 3, demonstrating the kernel/program isolation) and a build fix pinning the bootloader crate so the tree builds on current Rust nightlies. | pros-r29.img (8 MiB) |
| r28 | 146 | 1.5.3 | 2026-07-08 10:51 UTC | Re-test build — same code as v1.5.2 (which fixed admin upgrade hanging at the last MiB: outbound connections are no longer wiped when the server closes, so end-of-stream is detected). Published so a box already on the fix can run admin upgrade -y again and confirm the download completes cleanly. | pros-r28.img (8 MiB) |
| r27 | 145 | 1.5.2 | 2026-07-08 10:36 UTC | Fixes admin upgrade hanging at the very end of the download. Outbound connections were being torn down incorrectly when the server closed the connection at end-of-response (a side effect of the scan-noise socket cleanup), so the downloader received every byte but never recognized end-of-stream and hung at the last MiB. Downloads now complete. Also includes the v1.5.1 half-size image and v1.5.0 RAM-staging downloader. | pros-r27.img (8 MiB) |
| r26 | 143 | 1.5.1 | 2026-07-08 10:00 UTC | Half-size image: the shipped kernel is now stripped of debug symbols (never loaded at runtime), cutting the image from 13.5 MB to 8.5 MB. admin upgrade downloads are ~2x smaller and faster, and a box that was stalling near the end of a ~13 MB download should now complete. Same runtime as v1.5.0 (loadable code is byte-identical) plus the v1.5.0 RAM-staging cache downloader. | pros-r26.img (8 MiB) |
| r25 | 141 | 1.5.0 | 2026-07-08 09:02 UTC | Faster OS upgrades: the image now downloads into a 32 MB RAM staging cache and writes to the boot disk in one verified burst, instead of interleaving thousands of small disk writes with the network (which throttled downloads to a crawl). The NIC receive ring is enlarged to 64 KB so it can absorb a full in-flight window during disk activity. First step toward a unified storage cache. The signature is still verified before anything is written, from the same cached bytes, so a failed download never touches the boot disk. | pros-r25.img (13 MiB) |
| r24 | 135 | 1.4.6 | 2026-07-08 05:21 UTC | Fixes concurrent console + SSH sessions clobbering each other identity ("one root interrupted the other") - the per-command user context is now saved per task, so a file operation in one session can no longer land in another session store. Logging in as multiple SSH users at once is still serialized (a separate concurrency fix is in progress). | pros-r24.img (13 MiB) |
| r23 | 127 | 1.4.5 | 2026-07-08 03:06 UTC | SSH commands now stream their output in real time instead of going silent until they finish. admin upgrade (and any long-running command) shows live progress, and full-screen editing (prano) updates per keystroke. This is the last piece of making SSH behave like the local console before hardening access. | pros-r23.img (13 MiB) |
| r22 | 125 | 1.4.4 | 2026-07-08 02:45 UTC | Fixes SSH sessions dropping with "Corrupted MAC" during full-screen editing (prano) or on any command whose output exceeds ~4KB. The channel was truncating large sends into malformed packets; it now chunks them correctly. This is what made prano saves appear to fail over SSH - editing remote files (including into another user/service store like tintin) now works end to end. | pros-r22.img (13 MiB) |
| r21 | 123 | 1.4.3 | 2026-07-08 02:01 UTC | Fixes charon (SSH) going unreachable over time: the socket pool leaked when connections dropped before being accepted (internet port-scan noise on the public :2222 filled all 8 sockets, and a restart did not recover them). Dead unaccepted connections are now freed immediately, and the pool is raised from 8 to 32. If you are locked out, one reboot clears the stuck pool; this image prevents it recurring. | pros-r21.img (13 MiB) |
| r20 | 120 | 1.4.2 | 2026-07-07 03:55 UTC | Fixes prano (and other full-screen tools) over SSH: text now displays on your terminal instead of leaking to the machine console, and the screen clears cleanly on exit. The SSH prompt now shows the current directory - user@pros:<path>> - so you always know where you are. | pros-r20.img (13 MiB) |
| r19 | 118 | 1.4.1 | 2026-07-07 03:09 UTC | Documentation and in-OS help brought up to date: prano works over SSH, ssh <box> "<command>" runs one command non-interactively, and the command references reflect the current PiROS feature set. No functional change. | pros-r19.img (13 MiB) |
| r18 | 116 | 1.4.0 | 2026-07-07 02:55 UTC | SSH now runs non-interactive commands: ssh <box> "free" (etc.) returns output + exit status. Plus MacBurger server-monitoring support - the box answers MacBurger SSH metrics probes (ed25519 pubkey + BatchMode exec) and reports memory/load/uptime/processes so it shows on the dashboard like a Linux server. Memory is real; load and per-process percentages are approximate (PiROS has no idle accounting yet). | pros-r18.img (13 MiB) |
| r17 | 111 | 1.3.0 | 2026-07-07 02:09 UTC | prano (the full-screen editor) now works over SSH: edit files remotely, arrow keys and all. The SSH shell wires the session channel to the tool so keystrokes reach it and the screen paints in real time. Also cut the service NIC busy-poll further last release for responsiveness. | pros-r17.img (13 MiB) |
| r16 | 108 | 1.2.1 | 2026-07-07 01:30 UTC | Renamed PROS to PiROS (display name). Speed: the background services (tintin, queequeg, sshd) polled the NIC two million times per scheduler turn before yielding, each poll a NIC register read; cut to twenty thousand so services yield ~100x sooner and the box is responsive again with services running. (No interrupt-driven idle yet - that is the next milestone.) | pros-r16.img (13 MiB) |
| r15 | 106 | 1.2.0 | 2026-07-07 01:09 UTC | Preemptive scheduling for spawned processes via a Local APIC one-shot timer: a runaway service is now preempted instead of freezing the box, so the console and SSH stay responsive under it. Console tools unchanged. Known limitation: a runaway typed directly at the console is not preempted yet (see the Scheduling & preemption doc). Real hardware uses TSC-deadline mode; QEMU/emulator uses the LAPIC initial-count fallback. | pros-r15.img (13 MiB) |
| r14 | 68 | 1.1.6 | 2026-07-06 11:09 UTC | Services you start now auto-start on boot (safe-boot key skips it). Partial preemption: a runaway in the console/kernel context no longer freezes the box — other tasks (SSH) keep running. Full preemption of ring-3 processes is next. | pros-r14.img (13 MiB) |
| r13 | 66 | 1.1.5 | 2026-07-06 10:27 UTC | Fix prano over SSH (and the console slowdown it caused): only the serial console reads serial input now, so a tool run over SSH can't steal the console's keystrokes. prano detects it has no interactive terminal over SSH and exits cleanly instead of hanging. | pros-r13.img (13 MiB) |
| r12 | 63 | 1.1.4 | 2026-07-06 09:58 UTC | Features: (1) network config now persists to /root and is restored on boot, so no manual 'net dhcp' after a reboot. (2) 'admin upgrade' with no URL now checks for a newer build; 'admin upgrade -y' installs the current image without typing a URL. Includes the #DF and clean-reboot fixes. | pros-r12.img (13 MiB) |
| r11 | 62 | 1.1.3 | 2026-07-06 09:25 UTC | Clean SSH-upgrade test target. Identical code to r10 (the #DF-fixed build) except version/build, so once you're on r10 an in-place 'admin upgrade https://' over SSH proves the whole loop: verbose log to the client, no #DF, clean connection drop at reboot, back up on v1.1.3 build 62. | pros-r11.img (13 MiB) |
| r10 | 61 | 1.1.2 | 2026-07-06 09:22 UTC | Fix #DF (stack overflow) during admin upgrade https:// over SSH: the TLS handshake buffers now live off the kstack. Handshake was overflowing charon's deep call stack right after the pinned-cert check. | pros-r10.img (13 MiB) |
| r9 | 56 | 1.1.2 | 2026-07-06 08:42 UTC | SSH upgrade log fix: admin upgrade now defers its reboot so the full verbose log reaches the SSH client before the connection drops (previously only the serial console saw it). Upgrade FROM this build to see it. | pros-r9.img (13 MiB) |
| r8 | 55 | 1.1.2 | 2026-07-06 08:28 UTC | admin reboot / power off now RST open TCP connections first, so SSH clients drop cleanly instead of hanging. Includes the verbose staged upgrade output. | pros-r8.img (13 MiB) |
| r7 | 53 | 1.1.2 | 2026-07-06 07:52 UTC | Upgrade target for verbose live-update testing. Identical to r6 except version/build, so a box on r6 (build 52) upgrading to this shows the full staged output and lands on v1.1.2 build 53. | pros-r7.img (13 MiB) |
| r6 | 52 | 1.1.1 | 2026-07-06 07:52 UTC | Verbose upgrade build: admin upgrade now prints staged progress (connect > TLS handshake > download MiB > verify > write). Re-image ONTO this one, then upgrade to see the output. | pros-r6.img (13 MiB) |
| r5 | 51 | 1.1.1 | 2026-07-06 07:42 UTC | Live-update test build: bumped to v1.1.1 with a 'https self-upgrade' banner tag so an in-place admin upgrade https:// is visibly confirmed. No functional change from r4. | pros-r5.img (13 MiB) |
| r4 | 50 | 1.1.0 | 2026-07-06 07:27 UTC | HTTPS in-place upgrade: PROS now has a TLS 1.3 client (X25519 + AES-128-GCM + ECDSA-P256), pinning the repo's leaf key. 'admin upgrade https://www.rowan.id.au/pros/dist/pros-current.img' works over real TLS. Also fixes two TCP flow-control bugs. Proven end-to-end against the live server. | pros-r4.img (13 MiB) |
| r3 | 45 | 1.1.0 | 2026-07-06 06:08 UTC | admin upgrade over plain HTTP: kernel gives a clear https-not-supported message; dist .htaccess serves /pros/dist over http so the box can pull pros-current.img (images are authority-signed, so HTTP is safe). | pros-r3.img (12 MiB) |
| r2 | 44 | 1.1.0 | 2026-07-06 05:44 UTC | Documentation now linked on the release page (rendered HTML: Overview, User guide, Architecture, Services, Glossary, Writing programs, Test notes). Same build features as r1. | pros-r2.img (12 MiB) |
| r1 | 43 | 1.1.0 | 2026-07-06 05:30 UTC | v1.1.0 — first public release: 3-disk layout (dedicated /root secret disk), per-instance /data encryption, break-glass recovery key, in-place HTTP upgrades with authority-signature verification, 64 KB multi-block files, Tab completion + history over SSH, admin reboot. | pros-r1.img (12 MiB) |
Generated 2026-07-10 09:28 UTC.