OpenRiot v8.0.0: One File to Point Them All

“The map had been copied onto every wall in the building. One copy in the lobby, one in the basement, one taped inside a cabinet nobody opened. Every copy agreed with every other copy until the day the street moved. Then the lobby map was right, the basement map was wrong, and the cabinet map had been printed with the wrong year. So we took the maps down and kept one ledger by the door. The ledger does not care which room you are standing in. It knows where the street went.” – The OpenRiot Crew, v8.0.0

Release Overview

OpenBSD 8.0 is here, and OpenRiot 8.0.0 moves with it. This is not a patch release with a new number. The machine learned to stop carrying the OpenBSD version in its pockets.

The release target now lives in OPENBSD_VERSION. The sets date lives in OPENBSD_RELEASE_DATE. The build reads both and stamps them into the binary. setup.sh fetches the required release before it touches anything. The image builder asks the host what it is running. The package pins were rebuilt against the signed 8.0 indexes. When the next release arrives, the version moves in one place, not twelve.

The desktop work is smaller but visible. The lock rotation was cut from forty-two frames to sixteen deliberate ones, and sixteen backgrounds were repainted for the new release.

Total changes: OpenBSD 8.0 support, one version source, a setup gate that refuses to guess, and a repainted glass.

The Eight Point Zero

OpenBSD supports upgrades one release at a time. A 7.8 machine cannot jump straight to 8.0. It goes through 7.9 first, or it gets a fresh install. A 7.9 machine has a clear path:

openriot --backup
doas sysupgrade -R 8.0 -n
doas reboot

-n downloads the 8.0 sets, verifies them with signify, and writes /bsd.upgrade without rebooting. doas reboot then runs the one-shot upgrade. After the reboot:

doas sysmerge
doas fw_update
doas pkg_add -u
curl -fsSL https://openriot.org/setup.sh | sh

sysmerge is the step that deserves attention. OpenRiot edits /etc/pf.conf, /etc/sysctl.conf, /etc/rc.conf.local, and /etc/X11/xenodm/Xsetup_0. The merge may ask about any of them. Re-running setup after the merge puts the OpenRiot versions back.

There is no supported downgrade from 8.0 to 7.9. Keep the backup until the machine has booted, locked, and connected at least once.

The full runbook is in docs/Migration-8.0.md.

One File to Point Them All

The old binary carried TargetOpenBSD as a Go constant, a date as a Go literal, a second version in main, a third in the Makefile, and a fourth in the image builder. Every copy had to be edited together. Missing one produced a setup script that believed two different things about the same release.

Now there is one source:

OPENBSD_VERSION        -> 8.0
OPENBSD_RELEASE_DATE   -> 2026-10-06

The Makefile reads both with bmake syntax and injects them into source/buildinfo. The installer, the migration checks, the update notifier, and the package URL all read the same values.

The image builder no longer starts with install80.img baked into its defaults. It asks uname -r what the host is running, derives the sets name, and lets --version override it when a different target is intentional.

This is the part that matters beyond 8.0. When 8.1 ships, the ledger changes, the build stamps the new value, and the code does not need a scavenger hunt.

Somewhere a vendor is printing the same version number onto twelve different boxes and calling it a release strategy. We kept one ledger and one door.

The Door That Says Not Yet

Running setup.sh on 7.9 used to start doing work. It would clone the new tree, try the new package pins, fall back to base names, and leave a 7.9 system wearing parts of an 8.0 release. The finish banner still said success.

That door is closed.

setup.sh now fetches the required OpenBSD release from openriot.org/OPENBSD_VERSION. It falls back to the repository file on GitHub, then to the installed copy. If the running release is older than the required one, it prints the upgrade plan and waits for ENTER. No doas, no package install, no config copy.

If the running release is newer than the target, setup warns and continues with base package names. That is the window where OpenRiot has not caught up to a new OpenBSD yet, and pretending otherwise would be a lie.

openriot --check-upgrade shows the same plan. The Polybar update indicator now notices an OS upgrade, not just an OpenRiot version, and opens that plan in a terminal.

Packages From the Signed Index

The 8.0 package list was rebuilt against the signed repository index, not against a release announcement or a guessed revision.

102 package pins.
5 firmware pins.
Every package name and version exists in the signed 8.0 package index.
Every firmware archive exists in the 8.0 firmware index.
No base-name fallback is needed for the target release.

The notable moves include Python 3.14.7, FFmpeg 9.0.2, Firefox 157, LibreOffice 26.8, and the Intel and DRM firmware updates.

On a release newer than the pin set, packages install by base name and fw_update handles firmware. The machine does not pretend an 8.0 archive belongs on 8.1.

The Glass, Repainted

The lock set was cut from forty-two frames to sixteen. Every one of the sixteen was repainted. The full background set remains fifty images, with the first sixteen replaced for 8.0.

The lock cache remains at:

~/.local/share/openriot/Locked/.cache/<width>x<height>/

After the upgrade, rebuild it:

rm -rf ~/.local/share/openriot/Locked/.cache
openriot --build-lock-cache

🧾 Files Changed

File	Change
`OPENBSD_VERSION`	NEW version source
`OPENBSD_RELEASE_DATE`	NEW sets date source
`source/buildinfo/buildinfo.go`	NEW build-time values
`Makefile`	Reads version files, injects buildinfo
`setup.sh`	Release gate, remote version, plan
`source/installer/version.go`	Release compare and requirement
`source/installer/cmd.go`	Package install guard
`source/commands/helpers.go`	Upgrade plan and install guard
`source/commands/commands.go`	Upgrade check and 8.0 URLs
`source/update/update.go`	OS upgrade notification
`source/imaging/prereqs.go`	Host-derived image defaults
`source/imaging/build.go`	Version-derived sets path
`source/imaging/runner.go`	Help text follows host
`source/main.go`	Removed duplicate version
`install/packages.yaml`	8.0 pins and firmware
`docs/Migration-8.0.md`	NEW migration runbook
`README.md`	Upgrade section and 8.0 links
`backgrounds/01-16.webp`	Repainted for 8.0
`Locked/01-16.webp`	Repainted for 8.0
	Set reduced from 42 to 16
`Locked/17-42.webp`	Removed
`source/*_test.go`	8.0 fixtures and release compare

🗣️ Final Words

“The street moved and every copy of the map argued about it. So we stopped copying the map. One ledger by the door, written in the only hand that signs the release. When the next street moves, the ledger moves first, and the machine follows it without a committee. The people who sell maps for a living will call that a governance problem. We call it knowing where we are.” – The OpenRiot Crew, v8.0.0