v4.0.2

Download ISO ↓ on GitHub ↗

This is an additional set of security fixes that were validated and examined by the Omarchy Security team. If you ever find security issues with Omarchy, please follow the responsible disclosure procedure on omarchy.org/security. 🙏

You can upgrade existing machines with Update > Omarchy.

Install on new machines with the ISO:

Download: https://iso.omarchy.org/omarchy-4.0.2.iso
SHA256: 2ef8e624aa1bec7e277e28056b8535a6c9373ba48d7ede3f1a01cb6d2373cfb8

Improvements

Repair legacy paths and privileged files from retired installers by @acrogenesis
Skip Chromium’s new first-run EULA by @hjanuschka
Improve Apple display brightness detection reliability by @bastidotnet
Point the RC channel to the dedicated release candidate repository by @ryanrhughes
Prevent the desktop bar visibility toggle from becoming unresponsive by @ryanrhughes
Improve automated test suite reliability by @ryanrhughes, @Skeptomenos

Fixes

Fix shell injection in theme and application installers by @mdisec, @Adolanium
Fix Codex usage collection on version 0.149 by @orienw
Fix migration failures on Bash 5.3 by @ryanrhughes
Fix SSH hardening verification failing on OpenSSH 10.x by @ryanrhughes
Prevent web app installers from creating nested directories via the app name by @Chessing234

Security

Require signed packages from the Omarchy repository by @ryanrhughes
Harden CUPS printer discovery and administration by @mdisec
Secure Plymouth and SDDM asset publication by @AFOliveira, @ErikMelton, @itz4blitz
Secure Windows VM host mounts in Codex by @AFOliveira
Prevent remote image injection in shell text elements by @ErikMelton
Harden browser policy directory permissions by @acrogenesis
Restrict sudoers rule for timezone updates by @omarchybot
Validate web app URLs and escape desktop entry values by @bastidotnet, @Chessing234
Harden existing SSH installations and disable password authentication by default by @acrogenesis, @ryanrhughes
Close unprivileged input and SSH escalation paths by @acrogenesis, @fuchsblau, @ryanrhughes

Deprecations

Temporarily remove automatic printer discovery by @omarchybot