Rime updates

Rime 2026.09.28.4: APEX-OS is now Rime

Mon, 28 Sep 2026 13:45:01 GMT

The first release under the Rime name: APEX-OS becomes Rime OS and APEX Shell becomes Rime Shell. The first boot and first login move your system and desktop settings to the new names, the old names keep working as aliases, and a rollback to APEX keeps working. The core layer was rebuilt, so this is a full download.

APEX-OS is now Rime OS, and APEX Shell is now Rime Shell — The system, the shell, the boot splash wordmark (RIME OS) and the image carry the new name. The command is now `rime`; `apex` still works and prints a one-line note that the command is now `rime`.
The first boot moves system state to the new names — A one-time service moves APEX's state and settings (/var/lib/apex* and /etc/apex*) to their Rime names, re-points which services are enabled, renames a saved Rime Remote firewall exception, and updates the login screen's remembered session to its new name.
Your first login moves your desktop settings to the new names — Your apex folders under ~/.config and the other XDG directories, ~/.config/hypr/apex, the shell's config, cache and state, and your user services move to their Rime names. The shell's old directories are left behind as links, and its migration never overwrites anything.
Packages you installed keep working — Packages added with `apex install` live in an extension named apex-user. The renamed package tool adopts it as-is, so nothing is rebuilt or downloaded at the first boot.
Images are signed by the renamed repository — Because the repository is now AndreNijman/rime-os, images are signed by its build workflow. Machines on 2026.09.28.3 already accept that identity, so they verify and install this update.
The image moves to ghcr.io/andrenijman/rime-os — Every build is published under both ghcr.io/andrenijman/rime-os and ghcr.io/andrenijman/apex-os, with a new `rime` tag beside `apex`. A machine on 2026.09.28.3 that tracks an apex-os tag switches to the same tag under rime-os on its next update.
Rolling back to APEX keeps working — The secret store stays where APEX expects it, the generated Hyprland keybinds stay usable by APEX Shell, and niri's config no longer collects a duplicate block on each round trip.

Known issues

Machines that skipped 2026.09.28.3 do not know the new signer: Images built after the rename carry a new signer, and machines learned it in 2026.09.28.3. A machine on an older image, with the default signature=enforce, refuses images signed only by the new identity.
Your own apex-shell IPC binds stop working after a rollback: A bind of your own in labwc or niri that calls `qs -p /usr/share/apex-shell` is rewritten for Rime, so it does nothing if you roll back to APEX.
labwc keybinds saved on Rime use the new command: labwc keybinds saved again on Rime run `rime shell …`, which an APEX image does not have, so they fail after a rollback.
Both package extensions merge after a rollback: If you change packages on Rime and then roll back to APEX, APEX merges both apex-user.raw and rime-user.raw.
Full download: This build rebuilt the core layer, so the update is a full download for every machine.

APEX-OS 2026.09.28.3: Preparing machines for the Rime OS name

Mon, 28 Sep 2026 03:37:42 GMT

The last APEX-OS release before the rename. It teaches machines to trust images from the renamed repository and to follow the image to its new name, so updates keep arriving after the rename. Nothing is renamed yet.

The update check accepts both the old and the new build identity — Image signatures name the repository that built them, so renaming the repository changes the signer of every later image. The update check now accepts images signed by either the apex-os or the rime-os build workflow, so a machine keeps verifying and updating across the rename.
Updates move a machine to the new image name — The registry does not redirect a renamed image. `apex update` now moves a machine that tracks a tag of ghcr.io/andrenijman/apex-os to the same tag of ghcr.io/andrenijman/rime-os, once the new name serves that tag.
Every image is published under both names — Each build is published as ghcr.io/andrenijman/apex-os and ghcr.io/andrenijman/rime-os, with the same digest and tags, and a signature and SBOM attestation made under each name.

Known issues

Machines on images built before 2026-09-23 refuse this update: Every build since 2026.09.28.2 carries an SBOM attestation, which an older update check misreads and refuses. A machine on an image built before 2026-09-23 needs `provenance=off` in /etc/apex/trust.conf for one update, which brings the fixed check.

APEX-OS 2026.09.28.2: Signed SBOM on every image, and updated documentation

Mon, 28 Sep 2026 01:09:09 GMT

From this build on, every image carries a signed software bill of materials that the update check verifies alongside the signature. The documentation in both repositories was brought up to date with the shipped system.

Every image carries a signed SBOM — Each published image now has a signed software bill of materials (SBOM) attached, and the provenance half of the update check verifies it alongside the image signature.
Documentation matches the shipped system — Every current doc and README in both repositories was checked against the code and corrected, then rewritten in plain prose.

Known issues

Machines on images built before 2026-09-23 refuse this update: An older update check misread the SBOM's signature and refuses attested images. A machine on an image built before 2026-09-23 needs `provenance=off` in /etc/apex/trust.conf for one update, which brings the fixed check.

APEX-OS 2026.09.28: Games on the discrete GPU, a Gaming Mode freeze fix, and a faster offline first boot

Sun, 27 Sep 2026 17:44:44 GMT

Steam and its games start on the discrete GPU, Gaming Mode no longer stalls for half a minute at a time, an offline first boot no longer waits minutes on Flathub, and the login screen types in the lock screen's shapes. This update rebuilds the image's core layer, so it is a larger download than usual.

Steam and its games run on the discrete GPU — Steam's desktop entry asks for the non-default GPU, but the shell's launcher ignored that, so Steam and every game it started ran on the integrated GPU. Apps that ask for the discrete GPU are now started on it.
Gaming Mode no longer freezes for half a minute — The scx_lavd scheduler Gaming Mode uses (scx-scheds 1.1.3 from the CachyOS COPR) could strand a task until the kernel's watchdog ejected it, freezing the game for 31 to 37 seconds. The image now ships scx_lavd 1.1.3 with upstream's fix for that stall.
An offline first boot no longer waits 9+ minutes — Without a network, the first boot sat on 'A start job is running' while the Flathub setup retried ten times. Boot now continues, and the setup keeps retrying in the background.
The login screen types in the lock screen's shapes — The login screen's password field draws the same Material 3 Expressive shapes as the lock screen, moving on the last user's own motion settings (Reduce Motion, speed, scale). If the shapes cannot load, it falls back to the dotted field.
A refused login's red outline stays visible — After a wrong password, the red outline was cleared in the same frame it appeared. It now stays until you start typing.

Known issues

Restart Steam once: A Steam that was already running needs one restart to start on the discrete GPU.
The discrete GPU stays awake while Steam is open: This applies in every mode, not only Gaming Mode, because Steam is usually running before a mode switch and games inherit its environment.
Offline first boot not tested end to end: The first-boot change was checked with systemd's own tools, but an offline first boot was not tested end to end.

APEX-OS 2026.09.27.3: Windows open, move and switch workspaces on springs

Sun, 27 Sep 2026 15:08:06 GMT

Hyprland's window and workspace motion now uses the same springs as the shell, so windows grow in rather than mostly fading.

Windows open, move and switch workspaces on springs — A new window grows in on a spring from 80 % of its size and is opaque within 180 ms. A tile moved again mid-glide keeps its speed, and a workspace slide comes to a clean stop. Closing a window takes 200 ms.

APEX-OS 2026.09.27.2: A redesigned shell with fluid motion, and a new boot splash

Sun, 27 Sep 2026 14:35:07 GMT

APEX Shell's redesign ships: panels grow out of the bar on springs, settings have one home, the lock screen has an arrival and departure, and volume and brightness show in the top notch. The boot splash is redrawn as a calm focus pull on black.

A new boot splash on plain black — The logo comes into focus out of a soft glow, a halo settles, and the APEX OS wordmark fades in. The old comet trails and the gradient background are gone, and the splash runs at 60 Hz instead of about 48.
Panels grow out of the bar instead of fading in — Every panel now grows out of the bar or a screen edge on a spring: the Dashboard from the centre notch, network, notifications, audio and toasts from the right notch, the power menu and quick controls from the side strips, the clipboard from the corner and the wallpaper picker from the bottom. Reversing mid-way keeps the motion's speed.
Settings have one home — All settings live in the Nexus window. The Dashboard's Config tab is gone; Settings is now the last tab in the Dashboard's tab bar and opens the Nexus. Its navigation is grouped into five sections.
The lock screen pours down from the notch — Locking pours a shape down from the top notch over the desktop, and unlocking plays the same motion in reverse back onto the desktop.
Password shapes on the lock screen — Each character you type on the lock screen appears as a Material 3 Expressive shape instead of a dot. The shapes show only how many characters you have typed.
Volume and brightness show in the top notch — Changing the volume or brightness widens the centre notch and shows the level inside it, then returns to what the notch was showing.
Workspace dots show only what is there — The workspace indicator shows workspaces with windows, the one you are on and an urgent one, instead of a fixed row of ten. Each dot carries its number.
Area screenshots freeze the screen — Starting an area screenshot freezes every screen while you pick the region, so a video frame, tooltip or open menu is captured as it was when you pressed the key.
New settings for the bar, clock, recordings and avatar — You can keep the volume and battery percentages visible in the bar, choose a 12-hour, 24-hour or system clock, pick the folder screen recordings are saved to, and set your own profile picture.
Light mode is available — Every text colour and glyph now follows the palette, so the shell is readable on light surfaces, and the Light or dark control is back on the Appearance page.
The shell works from the keyboard — Every transient surface, application tray menus, the network panes, the notification centre, the clipboard history and the Dashboard tabs can be used from the keyboard. Icon buttons are named for what they do, and focus rings show only when you use the keyboard.
Motion speed and Reduce Motion apply to windows too — The shell's motion speed setting now also scales Hyprland's window and workspace animations. With Reduce Motion on, window and workspace movement is turned off and fades are kept short.
Notifications show when they arrived, and can be flung away — Each notification card shows when it arrived ('now', '12 min', a time, 'Yesterday', then a date), and cards can be flung away.
Closed notifications no longer linger — A notification that arrived during Do Not Disturb stayed in the list after its app closed it, and toasts kept showing notifications their sender had already closed. Both are fixed.

Known issues

Animation smoothness not yet measured on every display: The shell's frame timing for this build was tested on headless and nested compositors; measurement on real panels was still open, and setups mixing monitors with different refresh rates were not tested.
New splash's passphrase prompt not yet seen on a real encrypted boot: The new boot splash, including its passphrase prompt, was tested in a real plymouthd in a lab, not on a real encrypted boot or on real display hardware.
Splash images are upscaled on high-density panels: Where the boot splash runs at device scale 2, every image is upscaled 2x, as it was before this release.

APEX-OS 2026.09.27: SUPER+drag moves and resizes windows again

Sun, 27 Sep 2026 10:32:40 GMT

A single fix: holding SUPER and dragging a window moves or resizes it again.

SUPER+drag moves and resizes windows again — Holding SUPER and dragging with the left mouse button moves a window, and with the right button resizes it. Both had done nothing since the desktop's Hyprland configuration moved to Lua.

Known issues

Already-migrated configs keep the broken binds: If your Hyprland config was migrated from the old format, your own ~/.config/hypr/apex/user-overrides.lua still declares SUPER+drag with `{ drag = true }`, and the migrator does not run again. Changing those two binds to `{ mouse = true }` fixes them.

APEX-OS v2.1.0: A visible unlock prompt, and an installer that survives its screen

Sat, 26 Sep 2026 02:47:43 GMT

Fixes the two known issues v2.0.0 shipped with. The ISO was installed and booted end to end in a VM, including killing the installer's display partway through an install, before it was published. Machines already running APEX-OS get the boot-screen fix through `sudo apex update`.

The disk passphrase prompt is visible again — On an encrypted install, the boot screen dimmed its star and drew nothing else: no prompt, no dots as you type, no keyboard hint. It now shows the prompt, the dots, the keyboard layout in use, and a reminder that the recovery key works there too.
Switching to a text console can no longer wreck an install — Pressing Ctrl+Alt+F2 while the installer was open could crash its display; the installer restarted from the first page while the install carried on unseen. Now the installer's screen comes back by itself and reconnects to the install in progress, then shows the normal final page, recovery key included.
Published ISOs keep working — Each release's image now gets a permanent tag, so registry cleanup can never remove the build an ISO downloads.

Known issues

Some networks and adapters don't work in the installer: Captive-portal Wi-Fi doesn't work in the installer, and neither do USB Wi-Fi adapters that need out-of-tree drivers.
Tablets without a keyboard cannot finish the account page: Tablets without a keyboard can't complete the account page.

APEX-OS v2.0.0: One image, encrypted by default

Fri, 25 Sep 2026 23:38:00 GMT

The installer for APEX-OS as it is today: one image for every machine, disk encryption on by default, and an installer that was installed and booted end to end from this exact ISO before it was published. Machines already running APEX-OS do not need it; `sudo apex update` keeps them current.

One image for every machine — The Daily and Gaming editions became one. The ISO installs ghcr.io/andrenijman/apex-os:apex and the machine updates from that tag.
The ISO installs the exact build it was tested with — The ISO downloads one pinned image, and the ISO build refuses it unless it carries the signature of APEX's own build pipeline. The first `sudo apex update` after installing brings the system current.
Whole-disk encryption is on by default — Installs use LUKS2 whole-disk encryption. A recovery key is shown at the end, and Reboot stays locked until you tick that you have written it down.
Keyboard and time zone come first — You pick them before setting passwords, so passwords are typed on the layout you will use. Both carry into the installed system.
ERASE means this disk — The confirm page records each disk's serial, size and partition IDs, and the installer checks them again just before its first write. A USB drive that is unplugged or swapped during the download cannot be erased in its place.
Single-disk laptops can be installed — With no second drive, the download is staged on the disk being installed to, never in RAM.
Secure Boot key enrolment is offered again — The installer offers to enrol the Secure Boot key, so Secure Boot can be switched on later without reinstalling.
Network installs no longer fail at 'Preparing the installer runtime' — A network install could download the OS and then fail because the USB session's scratch space filled up, with no error shown. Found by installing from this ISO in a VM, fixed and re-verified before release.

Known issues

Switching to a text console restarts the installer: Don't press Ctrl+Alt+F2 while the installer window is open: it restarts the installer from the first page. Fixed in v2.1.0.
The boot splash may not show the passphrase box: On an encrypted install, type your passphrase and press Enter anyway, or press Esc to see the text prompt. The fix reaches installed machines through `apex update`.
Some networks and adapters don't work in the installer: Captive-portal Wi-Fi and USB Wi-Fi adapters that need out-of-tree drivers don't work in the installer.
Tablets without a keyboard cannot finish the account page: There is no way to complete the account page without a keyboard.

APEX-OS v1.0.0: First stable release

Wed, 29 Jul 2026 18:28:54 GMT

The first release where a clean install boots straight to a working desktop with nothing to fix by hand. The shell now ships inside the OS image, so one update moves the OS and the desktop together, and updates never install or reboot on their own.

The shell ships inside the OS image — APEX Shell is now part of the image at /usr/share/apex-shell. `apex update` moves the OS and the desktop together, and `apex rollback` reverts both.
Updates and reboots only happen when you run apex update — Fedora's automatic update timer was found active on a test machine and rebooted it mid-session without asking. It is now masked, so the system only updates when you run `apex update`.
The bar, launcher and idle lock start on the first boot — On a fresh install the compositor could start before the shell was in place, leaving a bare desktop with no bar, launcher, idle management or lock timeout, and it stayed that way. The shell now waits until it is ready, and the first-boot setup checks its own work before reporting success.
Your keyboard layout is used instead of a US fallback — An unconfigured keymap was written into the desktop config as the text '(unset)', which fell back to a US layout, including at the lock screen. Layout and variant are now validated against the keyboard database.
SUPER+Q only closes a window — SUPER+Q closed the window and opened the launcher, and SUPER+W opened Firefox and the wallpaper picker. The launcher is now ALT+SPACE and the wallpaper picker SUPER+SHIFT+W.
The APEX wallpaper and theme are selected on first login — The default wallpaper was copied but never selected, so the shell used an upstream wallpaper and derived the bar, border, GTK and terminal colours from it.
No config error on first boot — The first Hyprland start always reported a config error because a file the shell creates later did not exist yet, and every shell keybind was lost with it. The first-login setup now creates those files ahead of time.
Locale, keymap and time zone are set on install — Nothing set them before: the login screen fell back to a US layout, LANG stayed at C.UTF-8, and the clock ran on UTC. The installer now writes them into the installed system, and the image ships working defaults.
Compressed swap in memory — The system had no swap at all, which made out-of-memory handling abrupt. Fedora's standard zram device (half of RAM up to 8 GB, zstd) is now set up.

APEX-OS v0.1.0: First public release

Tue, 28 Jul 2026 07:46:48 GMT

The first public APEX-OS installer: a graphical netinstall ISO in two editions, Daily and Gaming (NVIDIA). It was verified in QEMU but had not yet been installed on real hardware.

Two installer ISOs, Daily and Gaming (NVIDIA) — Daily is the general-purpose desktop. Gaming is performance-tuned and includes the NVIDIA driver. Both use the same installer, and each ISO records its own edition as the update origin, so updates keep you on the edition you installed.
A six-screen graphical installer — The installer walks through network, disk, whole disk or a single partition, your account, Secure Boot, and a final confirmation. Your account is created during the install, so the first boot does not lock you out.
Nothing is erased until you type ERASE — No disk is touched until you type ERASE on a screen that lists every partition and whether it will be erased, kept or shared.

Known issues

Not yet installed on real hardware: Everything was verified in QEMU and by measurement (four boot paths, 33 automated tests, every installer screen at two panel sizes), but nobody had installed this release on real hardware yet.
No ISO for the Gaming-Mesa (non-NVIDIA) edition: A Gaming-Mesa image exists in the registry but has no published ISO. You can build one with EDITION=gaming-mesa.
Secure Boot enrolment depends on a signed kernel: The installer offers Secure Boot enrolment, but it only works if the downloaded image carries a signed kernel. If it does not, the installer says it has nothing to enrol and the system installs and boots normally with Secure Boot off. Once signed images are published, the same ISO enrols without any change.
Tablets without a physical keyboard cannot finish the account screen: There is no on-screen keyboard.
US keyboard layout for passwords: The installer assumes a US keyboard layout when you type your password.