CTRL-OS 26.05 Released!

Welcome to the latest CTRL-OS update! Find the last update from April here.

If you don’t know yet, CTRL-OS is a downstream distribution of NixOS designed to extend the release lifecycle to 5 years. It gives you a stable foundation with commercial support so you can build your products without having to maintain the packages you depend on.

The CTRL-OS 26.05 release is finally out. You can find the release blog post on our website. Or head over to our technical documentation and try it out.

As long as NixOS 26.05 has community support, CTRL-OS 26.05 will be in the co-maintenance phase. In this phase, we will monitor our supported package set and contribute any security fixes back to NixOS. After community support ends, we enter the stability phase, and maintenance shifts completely to us. We’ve detailed this model on our blog.

As of now, we support a small but useful package set. We’ll share more details here soon, but our goal is to cover the usual packages you deploy on a server or embedded system, i.e., that dusty plastic box in the corner that quietly does its job for years.

We actively monitor and backport CVEs for a core set of packages. To fund this work, commercial subscriptions provide SLA guarantees and cover custom package sets.

While we aim to stay very close to NixOS 26.05, we will pull in important security fixes quickly to keep our SLAs. This creates a divergence that will automatically resolve itself once the security fixes make it to the NixOS release branch as well.

Finally, to avoid a maintenance burden for the community, our CTRL-OS 26.05 release is lightly branded. By making it easy to identify a CTRL-OS system via nix-env -m, we ensure that bug reports originating from CTRL-OS users don’t accidentally get filed against upstream NixOS, respecting the time and effort of upstream maintainers.

With the EU’s CRA requirements taking effect this September, shipping embedded Linux products is about to require a lot more infrastructure. While Nix allows us to generate SBOMs with ease, the long-term vulnerability patching remains a challenge.

CTRL-OS bridges this gap. By handling the 5-year backporting of CVEs for the core package set, we provide the underlying patch pipeline needed to meet CRA requirements. Our goal is to give you a stable foundation so you don’t have to maintain a permanent, private fork of nixpkgs just to keep a device compliant.

So much from our side. We’re eager to hear your thoughts. Give CTRL-OS a shot and tell us about it in our Matrix chat!

1 post - 1 participant

Read full topic