APEX-OS 2026.09.28.3Before the rename

Preparing machines for the Rime OS name

The last APEX-OS release before the rename. It teaches machines to trust images from the renamed repository and to follow the image to its new name, so updates keep arriving after the rename. Nothing is renamed yet.

Released
Channel
edge
OS revision
795a1face
Shell revision
cb7add74

Highlights

SecuritySecurity

The update check accepts both the old and the new build identity

Image signatures name the repository that built them, so renaming the repository changes the signer of every later image. The update check now accepts images signed by either the apex-os or the rime-os build workflow, so a machine keeps verifying and updating across the rename.

A trust override may list several signers and still replaces the defaults. apex trust --json keeps expectedSigner and adds expectedSigners.

rime-os #70

SystemNew

Updates move a machine to the new image name

The registry does not redirect a renamed image. apex update now moves a machine that tracks a tag of ghcr.io/andrenijman/apex-os to the same tag of ghcr.io/andrenijman/rime-os, once the new name serves that tag.

The move uses bootc switch, and the trust check verifies the name being deployed. If the switch fails, the update checks and upgrades under the old name as before. A machine pinned to a digest, or following a fork's image, never moves.

rime-os #70

System

  • NewEvery image is published under both names

    Each build is published as ghcr.io/andrenijman/apex-os and ghcr.io/andrenijman/rime-os, with the same digest and tags, and a signature and SBOM attestation made under each name.

    rime-os #70build 36372134350

Known issues

  • Machines on images built before 2026-09-23 refuse this update

    Every build since 2026.09.28.2 carries an SBOM attestation, which an older update check misreads and refuses. A machine on an image built before 2026-09-23 needs provenance=off in /etc/apex/trust.conf for one update, which brings the fixed check.

    rime-os #69rime-os dd56a92f

Provenance

Release
2026.09.28.3
Image digest
sha256:be973425dc97caccacd25a14f2aa32aac5f36f89331c5ff436a2e3a630974804
Channel
edge
Released
2026-09-28T03:37:42.000Z

Published to every image tag (apex, daily, edge, gaming-mesa, gaming-nvidia). All of them are the edge channel today. This page explains the release; it is never consulted by an update. What a machine installs is decided by the registry and the image signature (see Security). Machine-readable: 2026.09.28.3.json.

If something is wrong

Go back to the image you were running before this one. It becomes the default at the next boot; your files and settings stay as they are.

sudo rime rollback && sudo systemctl reboot

On an APEX-named system the command is apex. You can also pick the previous entry in the boot menu. More in Rolling back and Recovery.