OpenRiot v8.0.1: The Prompts Were Always There

“The door was there the whole time. We had painted it the same color as the wall, hung a sign on it in a room nobody entered, and then stood outside wondering why the building felt empty. The lock worked. The handle worked. The only thing missing was someone telling the person on the other side that the door existed. So we opened it, turned the lights on, and let the prompts speak for themselves.” – The OpenRiot Crew, v8.0.1

Release Overview

OpenRiot 8.0.0 moved the desktop to OpenBSD 8.0. OpenRiot 8.0.1 is the release that makes the move behave correctly in the places where 8.0.0 made the machine too quiet.

This note carries the complete 8.0.0 story plus the repairs. If you are landing on 8.0.1, you have everything you need here.

The 8.0.0 release introduced one version source, a setup gate for old releases, 8.0 package pins, host-derived image defaults, and a repainted glass. The 8.0.1 release fixes the setup script’s temporary-file template, makes prompts visible while setup runs, updates packages whose installed version is older than the pin, and updates the dependency stack before installing those pins.

Total changes: everything from 8.0.0, plus visible prompts, honest package updates, and a dependency base that is current before the pins land.

8.0.1 Fixes

The Temp File Had No Xs

OpenBSD mktemp requires six X characters in the template. setup.sh used mktemp -t openriot-setup, which fails on OpenBSD before the install can begin. It now uses an explicit template:

mktemp "${TMPDIR:-/tmp}/openriot-setup.XXXXXX"

The Prompts Were Buffered

Setup captured each OpenRiot command’s output in a temp file and only printed it after the command exited. That was done to capture the exit status. It also hid every prompt. The release notes pager and the syspatch question would wait on /dev/tty while the terminal showed nothing.

Setup now streams output live and captures the status separately:

{ ./openriot "$flag" 2>&1; echo $? >"$tmp"; } | tee -a "$logfile"

The prompt is visible. The status is still returned.

Older Packages Were Called Newer

The package filter skipped any package whose base name was already installed, even when the installed version was older than the pin. It printed a false warning and moved on. The filter now skips only exact matches and queues version changes:

Updating rsync: rsync-3.5.0p0 -> rsync-3.5.1

Dependencies Were Stale

The pins are top-level packages. Their dependencies can be older than the current 8.0 tree. That produced real failures:

  • gnupg needed gcrypt.22.1, installed libgcrypt had gcrypt.22.0.
  • fio needed a newer libnfs.
  • kate needed newer glib, cairo, freetype, atk, and gio.

Setup now runs pkg_add -Iu before installing pins. The dependency stack moves first. The pins land on a base that can satisfy them.

The Eight Point Zero

OpenBSD supports upgrades one release at a time. A 7.8 machine cannot jump straight to 8.0. It goes through 7.9 first, or it gets a fresh install. A 7.9 machine has a clear path:

openriot --backup        # optional
doas sysupgrade -R 8.0 -n
doas reboot

Skipping the backup removes the only rollback path. -n downloads the 8.0 sets, verifies them with signify, and writes /bsd.upgrade without rebooting. doas reboot then runs the one-shot upgrade. After the reboot:

doas sysmerge      # recommended: merge base config changes
doas fw_update     # optional: only if firmware updates are available
curl -fsSL https://openriot.org/setup.sh | sh

Setup runs pkg_add -Iu before installing pins. You do not need to run pkg_add -u separately unless setup cannot complete.

sysmerge is the step that deserves attention. OpenRiot edits /etc/pf.conf, /etc/sysctl.conf, /etc/rc.conf.local, and /etc/X11/xenodm/Xsetup_0. The merge may ask about any of them. Re-running setup after the merge puts the OpenRiot versions back.

There is no supported downgrade from 8.0 to 7.9. If you made a backup, keep it until the machine has booted, locked, and connected at least once.

The full runbook is in docs/Migration-8.0.md.

One File to Point Them All

The old binary carried TargetOpenBSD as a Go constant, a date as a Go literal, a second version in main, a third in the Makefile, and a fourth in the image builder. Every copy had to be edited together. Missing one produced a setup script that believed two different things about the same release.

Now there is one source:

OPENBSD_VERSION        -> 8.0
OPENBSD_RELEASE_DATE   -> 2026-10-06

The Makefile reads both with bmake syntax and injects them into source/buildinfo. The installer, the migration checks, the update notifier, and the package URL all read the same values.

The image builder no longer starts with install80.img baked into its defaults. It asks uname -r what the host is running, derives the sets name, and lets --version override it when a different target is intentional.

This is the part that matters beyond 8.0. When 8.1 ships, the ledger changes, the build stamps the new value, and the code does not need a scavenger hunt.

Somewhere a vendor is printing the same version number onto twelve different boxes and calling it a release strategy. We kept one ledger and one door.

The Door That Says Not Yet

Running setup.sh on 7.9 used to start doing work. It would clone the new tree, try the new package pins, fall back to base names, and leave a 7.9 system wearing parts of an 8.0 release. The finish banner still said success.

That door is closed.

setup.sh now fetches the required OpenBSD release from openriot.org/OPENBSD_VERSION. It falls back to the repository file on GitHub, then to the installed copy. If the running release is older than the required one, it prints the upgrade plan and waits for ENTER. No doas, no package install, no config copy.

If the running release is newer than the target, setup warns and continues with base package names. That is the window where OpenRiot has not caught up to a new OpenBSD yet, and pretending otherwise would be a lie.

openriot --check-upgrade shows the same plan. The Polybar update indicator now notices an OS upgrade, not just an OpenRiot version, and opens that plan in a terminal.

Packages From the Signed Index

The 8.0 package list was rebuilt against the signed repository index, not against a release announcement or a guessed revision.

  • 102 package pins.
  • 5 firmware pins.
  • Every package name and version exists in the signed 8.0 package index.
  • Every firmware archive exists in the 8.0 firmware index.
  • No base-name fallback is needed for the target release.

The notable moves include Python 3.14.7, FFmpeg 9.0.2, Firefox 157, LibreOffice 26.8, and the Intel and DRM firmware updates.

On a release newer than the pin set, packages install by base name and fw_update handles firmware. The machine does not pretend an 8.0 archive belongs on 8.1.

The Glass, Repainted

The lock set was cut from forty-two frames to sixteen. Every one of the sixteen was repainted. The full background set remains fifty images, with the first sixteen replaced for 8.0.

The lock cache remains at:

~/.local/share/openriot/Locked/.cache/<width>x<height>/

After the upgrade, rebuild it:

rm -rf ~/.local/share/openriot/Locked/.cache
openriot --build-lock-cache

🧾 Files Changed

File Change
OPENBSD_VERSION NEW version source
OPENBSD_RELEASE_DATE NEW sets date source
source/buildinfo/buildinfo.go NEW build-time values
Makefile Reads version files, injects buildinfo
setup.sh Release gate, streamed output, pre-update
  Fixed mktemp template
source/installer/packages.go Queues outdated package updates
source/installer/version.go Release compare and requirement
source/installer/cmd.go Package install guard
source/commands/helpers.go Upgrade plan and install guard
source/commands/commands.go Upgrade check, 8.0 URLs, pkg_add -Iu
source/update/update.go OS upgrade notification
source/imaging/prereqs.go Host-derived image defaults
source/imaging/build.go Version-derived sets path
source/imaging/runner.go Help text follows host
source/main.go Removed duplicate version
install/packages.yaml 8.0 pins and firmware
docs/Migration-8.0.md NEW migration runbook
README.md Upgrade section and 8.0 links
backgrounds/01-16.webp Repainted for 8.0
Locked/01-16.webp Repainted for 8.0
  Set reduced from 42 to 16
Locked/17-42.webp Removed
source/*_test.go 8.0 fixtures and release compare

🗣️ Final Words

“The door was never locked. It was never even closed. It was simply quiet, and the machine had learned to wait without saying why. We taught it to speak while it waits, to update what is old instead of calling it new, and to bring the foundation up before the roof. The people who sell silence as a feature will call that noise. We call it a machine that tells you where the door is before you walk into the wall.” – The OpenRiot Crew, v8.0.1