0 Releases 4 Tags

RSS Feed

• v2.3.0 b3bd5b6740

  Compare

  **✨ New**

  kevinveenbirkenbach released this 2026-07-24 16:16:57 +00:00 | 0 commits to master since this release

  • Guided setup wizard, now the default command: lim with no --type (or
    lim --type guided) asks everything up front — distribution, target device,
    hostname, login user + SSH key, password — then builds an encrypted,
    Tor-remote-unlockable image unattended.
  • Debian / Raspberry Pi OS remote LUKS unlock. The initramfs unlock stack is
    now distro-agnostic behind an InitramfsBackend abstraction: mkinitcpio
    for Arch/Manjaro, initramfs-tools (cryptsetup-initramfs + dropbear-initramfs
    • a Tor onion) for Raspberry Pi OS / moode / RetroPie.
  • Flash full disk images into LUKS. Distributions that ship a .img rather
    than a rootfs tarball (Raspberry Pi OS, moode, RetroPie, Manjaro ARM) are
    loop-mounted and their boot + root partitions copied into a fresh LUKS
    container. New Raspberry Pi OS catalog (lite64 / desktop64 / lite32).
  • New remote-unlock command: reach a waiting initramfs over Tor (onion, via
    torsocks) or plain SSH (host/IP), running cryptroot-unlock or presenting
    the passphrase prompt. The wizard saves a target record under
    ~/.config/lim/unlocks so lim --type remote-unlock offers it directly.
  • Cross-architecture builds. Building a foreign-arch image (e.g. arm64
    Raspberry Pi OS on an x86 host) auto-installs qemu-user-static and registers
    binfmt, or aborts before the target is erased with per-distro instructions.
  • RTC-less clock hardening. A clock floor (build epoch baked into the initramfs)
    plus a numeric tor_ntp= cmdline let the clock sync without DNS, so the Tor
    onion still publishes on boards without a real-time clock (which boot at 1970).
  • Numbered selection menus for distribution and version prompts; typing the
    name still works.
  • CI: a full Debian build → boot → LUKS-unlock QEMU end-to-end job runs on
    push (make test-qemu-debian).

  🐛 Fixes

  • Raspberry Pi OS Bookworm boots the encrypted image: the initramfs is placed on
    the ​/boot/firmware FAT partition instead of the ext4 root, so cryptsetup is
    present at boot (no more (initramfs) emergency shell).
  • Chroot package installs are robust cross-host: a Debian-safe PATH (so
    update-initramfs / useradd resolve) and apt-get update before install
    (stock images ship stale lists whose superseded .deb URLs 404).
  • Stock-image fstab is normalized (the existing ​/ line is replaced, not
    duplicated) when copying a distro image into LUKS.
  • Large copies show progress (rsync --info=progress2, cp fallback).

  💥 Breaking / behavior

  • lim with no --type now runs the guided wizard (previously --type was
    required).
  • The long-deprecated --extra argument is removed.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)