Images, builds, and releases

UnisonOS does not yet publish a supported appliance. v0.6.0-preview.1 is the current unsupported software preview for the native Ubuntu 24.04 LTS x86-64 bundle.

Supported-runtime candidate

compose/compose.supported.yaml defines 13 required services. A release environment must provide an immutable digest for each image. The profile removes developer host ports from internal services and binds its renderer and operational surface to loopback.

This contract is distinct from mutable development Compose files.

Reproducible manifest

scripts/generate_supported_manifest.py creates the release bill of materials. It requires a controlled source timestamp and records:

Identical inputs produce byte-identical output. Publication rejects missing, mutable, and example zero digests.

Update metadata

Development, preview, and stable channel metadata is independently signed. Before an artifact can be staged, the client verifies threshold signatures, expiration, monotonic metadata and target versions, selected channel, hardware compatibility, length, and SHA-256. Root-key rotation requires authorization from both the existing and proposed root thresholds.

Published image and release evidence

The preview workflow rebuilds ten project images from exact source commits and uses pinned upstream Redis, PostgreSQL, and NATS images. Project images are published under platform-owned preview package names, signed with keyless Cosign, scanned, and recorded by immutable digest.

The release contains the signed bundle, manifest, image inventory, source correspondence, aggregate SPDX inventory, provenance, checksums, preview public key, support record, vulnerability summary, and Sigstore bundles. Publication rejects incomplete image or scan evidence and critical findings with an available package fix.

Older WSL, QCOW2, VMDK, and split ISO assets are archived evaluator outputs. They are not generated by the current release workflow and are not current download options.

What a release must publish together

The current preview publishes the native bundle, release manifest, checksums, signatures, SBOM, provenance, source correspondence, vulnerability summary, release notes, and machine-readable support status. Hardware compatibility results, promoted update metadata, and a support window remain promotion gates.

CI retrieves the public bytes, verifies them, performs a clean install without repository knowledge, and rejects partial or modified mirrors. Release bytes cannot be silently replaced; a correction requires a new preview version.

See releases, release lifecycle, and compatibility.