Gnu-Linux on Javier Orozco | Observer

Fedora 44 | Deep Technical Analysis: Kernel, Desktops and the Immutable Future

Sun, 03 May 2026 12:00:00 +0000

Also available on Odysee: https://odysee.com/@javierorozco.observer:6/Fedora-44---An%C3%A1lisis-T%C3%A9cnico-Profundo--Kernel,-Escritorios-y-el-Futuro-Inmutable:b

I’ll take a deep technical dive into Fedora 44. I won’t focus on the visuals: I’ll do an overall review of Fedora 44 as such, regardless of whether it’s Workstation, the server edition, or a spin, since technically almost everything applies to any edition of the 44 branch. I’ll briefly review highlights from some desktop environments, but not much more, since the most interesting part is neither in the looks nor in the wallpapers.

What I’ll do is open the terminal, check versions, and understand what changed in the kernel, in the tooling and development environments, in the Atomic Desktops, and in the OS image philosophy that Fedora is actively pushing toward the future.

Fedora: Lead, Don’t Follow

Let’s start by looking at what Fedora is and where it stands in the GNU/Linux ecosystem. The first thing to clarify is that Fedora is not Ubuntu, nor does it emulate Debian’s idea of “stability”: its explicit philosophy is to lead, not follow. That means you’ll find versions of compilers, libraries, and frameworks that other distros don’t have yet, but also that major behavioral changes can appear from one release to the next.

Red Hat Enterprise Linux uses Fedora as its base, that is, what gets tested here is what will reach the enterprise world. That gives Fedora a weight that goes far beyond being a “cool” distro.

Support for each release is approximately 13 months. There is no “LTS” here, but new versions every six months: upgrading on time is not optional if you want to stay supported, but the system makes upgrading very easy, as we’ll see later.

Editions, Spins, and Variants: More Options Than Ever

Fedora 44 has more variants than ever. The three main categories are:

Flagship editions: here we have the main ones with the desktop of your choice, either GNOME on Workstation or KDE Plasma, these two being its official desktop versions. But also the spins with XFCE, Cinnamon, MATE with the Compiz window manager, i3, LXQT, LXDE, Sugar, Sway, Budgie, Miracle, Plasma Mobile, and COSMIC: there is literally something for every taste. Also an ISO for servers, IoT devices, cloud virtual machines, and a minimal edition ideal for containers.

The second category is Atomic Desktops: in these the filesystem is read-only. To put it simply, it works like a mobile device running Android, where you simply have an app store and install everything from there. Base system updates are transactional and you can roll back from boot: Silverblue with GNOME, Kinoite with KDE, Sway, Budgie, and Cosmic. These atomic distributions are the future Fedora is actively pushing.

And the third category is Fedora Asahi Remix: this is Fedora running on Apple Silicon hardware natively, with KDE Plasma as the project’s flagship desktop. This is not emulation: it is the Linux kernel compiled for ARM with drivers specific to Apple hardware.

System Requirements, LLVMpipe, and Additional Desktops

Let’s also look at the recommended system requirements: nothing revolutionary here compared to previous versions. The most interesting point is LLVMpipe: Fedora can run GNOME even on hardware without graphics acceleration, using the CPU for rendering. Obviously performance won’t be the same, but it’s functional for virtual machines without 3D acceleration or very old hardware.

And it also lets us add a different desktop on an existing installation. We can see the available options with:

1

dnf environment list

If we wanted to install, for example, Cinnamon:

1

sudo dnf install @cinnamon-desktop-environment

Installation: Anaconda, Btrfs, and Disk Encryption

Let’s quickly go through the installation process. The installer change is subtle but relevant for administrators: previously, Anaconda created NetworkManager profiles for every network device it detected, even if you didn’t configure them during installation. Now only the profiles you actually configured persist. That means fewer ghost configuration files on the system. In partitioning we also have the BTRFS filesystem by default with @root and @home subvolumes, and as I always insist and will insist: enable full disk encryption to protect your data, with no exceptions. In fact, I think distributions should ship with encrypted system installation by default and enforced, and what should be done manually is disabling it.

Support for aarch64 EFI and automatic DTB selection matters to the ARM community: for example, Fedora ISOs can now boot directly on Snapdragon laptops with no manual intervention to select the correct Device Tree.

GNOME: Parental Controls, Color, RDP, and IBus

I’m going to dedicate a separate article to GNOME, so I won’t go into every detail of the desktop here. But I do want to name what Fedora’s own release notes called out as relevant.

The most striking change from an everyday user’s point of view is the native Parental Controls system, part of the Digital Wellbeing initiative (for those unfamiliar, it’s a term used to describe the impact of digital technologies and services on people’s mental, physical, social, and emotional health): for the first time you can set screen time limits and usage schedules directly from Settings, without installing anything extra. Useful on shared or family machines.

The improvements in color management and in RDP Remote Desktop matter for professional workflows: Fedora has had native RDP support for several versions and GNOME 50 refines it further.

Accessibility got improvements, and the default applications were also updated, such as the document viewer, the file manager, and the calendar.

As for IBus 1.5.34: the change in support for Wayland input-method protocols applies mainly to environments like KDE, Sway, Hyprland, and COSMIC. GNOME handles input methods its own way, so on Fedora Workstation that IBus change isn’t felt directly. What is universal is the new WhisperCpp voice backend in ibus-speech-to-text, which now competes with Vosk by offering better accuracy, real multilingual support, and compatibility with quantized models.

I’m also going to dedicate a full article to Plasma, so here we’ll stick to the essentials.

The two most important changes at the Fedora KDE level specifically are the Plasma Login Manager (the new session manager) and Plasma Setup, which complement each other: before you log in you’re greeted by the new Login Manager, and when you boot a fresh installation for the first time, Plasma Setup takes over to configure the user, timezone, and basic preferences. This makes Fedora KDE a viable option for OEM deployments: I can install the system on someone’s machine without creating their user in advance; they configure it on first boot, as in Windows.

Replacing SDDM is architecturally significant: SDDM is a project external to the KDE ecosystem, while the new Login Manager is Plasma-native and integrated with systemd. Note that installations upgrading from Fedora 43 are not migrated automatically: SDDM stays. You have to switch it manually if you want it:

1
2


sudo dnf install plasma-login-manager kcm-plasmalogin
sudo systemctl enable --force plasmalogin

The change takes effect starting with the next reboot.

As for Plasma 6.6 itself: we get a new on-screen keyboard with a more modern implementation, an option to save your current setup as a custom global theme, color accent with per-window-frame tint strength adjustment, per-application volume from the taskbar (no need to open the audio mixer to adjust a specific app), and the new Spectacle with OCR screenshot feature, among the most useful for day-to-day use: you take a screenshot and can extract text directly with no need for external tools. You can also connect to WiFi using a QR code.

We also get new accessibility options, and the per-window filter in screencasting from the title bar solves a flow that used to be awkward: selecting exactly which window you’re sharing without leaving the application. One curious thing worth adding is that since the distribution’s release day, the manufacturer Star Labs, which builds machines with the open coreboot firmware, sells its machines directly with Fedora 44 preinstalled as one of the options to choose from.

NTSYNC in the Kernel and Goodbye to cert.pem

This is the technical core of the analysis.

Let’s talk about NTSYNC: it’s a kernel module that reimplements Windows synchronization primitives (such as mutexes or mutual exclusions, semaphores which are synchronization mechanisms between processes and threads, and events which are records generated by the operating system kernel listing critical activities such as memory allocation, input/output operations, system calls, and hardware errors). All of this now runs directly in kernel space.

Without NTSYNC, Wine has to emulate these operations at user-space level, which introduces latency. With NTSYNC, the kernel speaks the same language as Windows applications, significantly reducing hardware resource overhead, especially in multithreaded games.

We also need to talk about a silent change that can break things, and it’s the most dangerous change for production environments upgrading from Fedora 43: the /etc/pki/tls/cert.pem file no longer exists by default. Any application hardcoding that path will fail certificate validation. The correct approach is to use the cryptographic libraries’ APIs to resolve certificates, not a fixed path. Review your scripts and applications if you upgrade.

DNF5 Completes the Transition: PackageKit on libdnf5

Let’s also analyze the package manager. DNF5 is not new in Fedora 44: it’s been the default package manager since Fedora 41. But in this release an important chapter of the transition is completed: PackageKit migrates to the DNF5 backend. What does that mean in practice? That GNOME Software, Plasma Discover, and Cockpit, which use PackageKit underneath, now all talk to the same library: libdnf5. Before F44, those tools still used the DNF4 backend, which produced inconsistencies between what you saw in the terminal and what the graphical interface did; for example, differences in how dependencies were resolved or in transaction history state. Now there is a single source of truth.

The technical difference between DNF4 and DNF5 matters: DNF4 was written in Python, DNF5 is written in C++ on top of libdnf5. That translates into faster dependency resolution, lower memory usage, and better performance on systems with many repositories. For users with RPM Fusion, COPR, and several active repositories, the difference is noticeable.

If you come from an older Fedora and have scripts calling dnf4 directly, the compatibility package is still available, but you should migrate your commands since dnf4 is transitional and will disappear at some point.

One important point: PackageKit with DNF5 as its backend is what makes Cockpit work correctly on Fedora Server 44. If you administer Fedora servers via Cockpit and were on F43, this change consolidates the browser-based management experience.

Development Stack: Ruby 4.0 and MariaDB 11.8

As for the development stack, Fedora always ships loaded with the very latest. Ruby 4.0 is the most delicate case, since it makes a major version jump from 3.4, which is what Fedora 43 had. Packages using binary extensions need to be recompiled. If you have gems with native (C/C++) extensions, they must be rebuilt. Upstream paid attention to source-level compatibility, so in many cases you don’t need to change the Ruby code itself, but you do need to rebuild the extensions. We also get MariaDB 11.8 with a new default charset and vector functions optimized for machine learning, plus parallel dump and restore.

Nix Arrives in the Official Repositories

Quite an important addition is that the Nix package manager now ships in the official repositories, and its operation is practically the same as what I showed in the Trisquel 12 analysis. Having Nix in the repos is an interesting signal, since it tells us Fedora accepts coexisting with other package managers, recognizing that Nix solves a real problem: reproducible environments and multiple versions of tools in isolation. The classic use case is development: for example, you need Python 3.9 for an old project and Python 3.13 for the new one; with Nix you can have both without them clashing.

Atomic Desktops: The Read-Only System

Atomic Desktops are Fedora’s most philosophically different bet. The root filesystem is read-only: you can’t modify it directly even as root. Updates don’t go package by package mutating the live system, but instead a complete new deployment is prepared in the background, and on reboot the system switches everything at once, atomically. If something fails, from the GRUB menu you can go back to the previous deployment with no complicated recovery process.

This completely changes the relationship with the package manager. On an Atomic Desktop you don’t use DNF directly for the base system: you use rpm-ostree, which is what manages deployments. For user applications, the recommended route is Flatpak, which runs in its own sandbox and doesn’t touch the base system. And for cases where you need development tools or commands that don’t exist as Flatpaks, there’s Distrobox: a container where you can run any other GNU/Linux distribution that integrates with your terminal and your home directory as if it were part of the system, but isolated from the real operating system.

Bootable Containers and Sealed Images with bootc

Let’s also talk about bootable containers. This is the most ambitious architectural change Fedora has underway. The idea is to bring the OCI container model to the complete operating system. Instead of a package system that keeps mutating with every dnf upgrade, your OS is an immutable, versioned, signed image, exactly like a Docker image, but one the hardware can boot directly.

bootc is the tool that manages this:

1
2


sudo bootc upgrade
sudo bootc rollback

With bootc upgrade you update to a new OS image, or with bootc rollback you go back if something fails, without depending on rpm-ostree for the workflow.

F44’s Sealed Images add a complete chain of trust on top: from firmware to the last byte of the rootfs, everything cryptographically verified. The immediate practical benefit is TPM-based disk unlocking without a password in a reasonably secure way (because the TPM only releases the key if the entire boot chain is as expected).

Fedora Cloud: /boot as a Subvolume and End of QEMU on i686

This section focuses on Fedora Cloud, which is the edition designed for infrastructure deployments: virtual machines on cloud providers, QEMU/KVM instances, OpenStack images, and the like. It’s not the edition most people install on the desktop, but the changes it introduces have implications for Fedora’s overall direction.

One of the changes is removing the separate /boot partition. Historically, /boot lived on its own partition because old bootloaders had limitations reading complex filesystems like Btrfs or LVM: they needed a simple partition with ext4 or similar to live on. That restriction no longer applies on modern UEFI systems with GRUB2 or systemd-boot, which understand Btrfs perfectly. So Fedora Cloud 44 takes the step: /boot becomes a Btrfs subvolume inside the main volume, instead of its own partition.

Why does this matter? Three concrete reasons. The first is space efficiency: before, you had to reserve a fixed size for /boot at partitioning time. The dilemma was that if you made it too small it could fill up with old kernels, and if you made it too large you wasted space. With a subvolume inside Btrfs, space is shared and allocated according to real need. The second reason is that the resulting Cloud images are smaller because they don’t need to include that separate partition. And the third: this is consistent with the direction of the Bootable Containers from the previous section. If the entire operating system is going to live in a cryptographically verifiable Btrfs image, having /boot as a subvolume of the same volume simplifies the whole chain.

The change applies to all architectures supported by Fedora Cloud except IBM Z, which has its own scheme conventions, and UEFI-UKI images, which already have their own partitioning scheme for the Unified Kernel Image.

The other change in this section is removing QEMU as a 32-bit host. To avoid confusion let me clarify this: QEMU still exists as an emulation target, that is, you can keep creating and running 32-bit virtual machines inside QEMU. What was removed is running QEMU itself on an i686 host, which is a practically nonexistent use case today. No current cloud server runs a 32-bit hypervisor.

Asahi Remix: Official Mesa for Apple Silicon

Asahi Remix is a separate project but one that follows Fedora’s pace. Retiring the hand-patched Mesa is significant: it means the driver work for Apple Silicon has matured enough to be merged into official Mesa, which is what arrives directly from Fedora’s repos. Fewer custom patches, more long-term maintainability.

Post-Install: RPM Fusion, Codecs, Drivers, and Firmware

Fedora comes out of the installer in a deliberately minimal state. It doesn’t ship with full ffmpeg, it doesn’t ship with proprietary codecs, and depending on the hardware the drivers may be in a basic state. That’s not a defect: it’s a conscious decision to honor the free software policy in the official image. But in practice, there’s a set of steps every Fedora installation needs to be ready for real use, and that’s what we’re going to do now.

First is always syncing repository metadata and pulling in all updates released since the ISO was generated. The --refresh flag forces synchronization even if DNF thinks the cache is current, important on installation day:

1

sudo dnf upgrade --refresh

With the system up to date, next is enabling RPM Fusion. By policy Fedora doesn’t include patented software or proprietary code in its official repos, such as H.264 and H.265 codecs, and NVIDIA’s proprietary drivers aren’t there either. RPM Fusion exists precisely for that: Free for free software Fedora doesn’t include for licensing reasons, and Non-Free for what is directly non-free. They’re Fedora’s de facto complementary repos, maintained by the community for over a decade:

1

sudo dnf install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm

With RPM Fusion active we can now install full ffmpeg. --allowerasing is needed because Fedora ships with a trimmed ffmpeg-free that conflicts with RPM Fusion’s full ffmpeg: we’re telling DNF it may remove that package to resolve the conflict. For hardware decoding via VA-API, on Intel you need intel-media-driver; on AMD the Mesa drivers already included are normally enough:

1
2


sudo dnf install ffmpeg --allowerasing
sudo dnf install intel-media-driver

If you have an NVIDIA GPU, this is the time to install the proprietary drivers. I leave it commented out because I don’t have NVIDIA on this machine, but the flow is from RPM Fusion Non-Free with akmod-nvidia, which compiles the kernel module automatically for each kernel update:

1
2


# Only if you have an NVIDIA GPU (RPM Fusion Non-Free):
# sudo dnf install akmod-nvidia

Flatpak comes preinstalled on Fedora Workstation, but Flathub isn’t enabled by default: you have to add it manually. Flathub is the central Flatpak repository and has the vast majority of applications you’ll want to install:

1

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

fwupdmgr manages firmware updates directly from Linux: BIOS, NVMe SSD controllers, compatible peripherals. Many manufacturers already publish their firmware updates through LVFS, the service fwupd queries. Worth running on every fresh installation:

1
2


fwupdmgr refresh
fwupdmgr update

Fedora’s “Development Tools” group installs the base toolchain: GCC, make, autoconf and company, the minimum for compiling from source or working with native extensions:

1

sudo dnf group install "Development Tools"

Lastly (although really I should have done this at the start), two lines that notably improve DNF speed in /etc/dnf/dnf.conf: max_parallel_downloads=10 downloads up to ten packages simultaneously instead of the default of three, and fastestmirror=True automatically selects the fastest available mirror for your connection:

1
2


max_parallel_downloads=10
fastestmirror=True

Upgrading to Fedora 44: Upgrade, Rebase, and Golden Rules

The most frequent question every time a new Fedora version comes out is whether it’s worth doing an in-place upgrade or better to wipe and install clean. The short answer is that Fedora’s upgrade is remarkably well implemented and in most cases works without problems. But there are nuances worth being clear about before running it.

Fedora’s upgrade is not like that of a rolling distro: it’s not DNF resolving dependencies live while the system runs. It can be done from the graphical interface or the console. What it does is download all packages needed for the new version in the background, and when the reboot runs, the system boots into a special, isolated update environment, with no services running, with nothing using the files about to be replaced. That drastically reduces the live-update problems that plague other distros. When you’re back on the desktop, you’re already on Fedora 44:

1
2


sudo dnf system-upgrade download --releasever=44
sudo dnf system-upgrade reboot

An absolute rule: never skip versions. If you’re on Fedora 41 or 42, first upgrade to 43, and from there to 44. Fedora’s upgrade system is neither designed nor tested for jumps of more than one version, and the chances of something ending up in an inconsistent state increase a lot.

For Atomic Desktops, the flow is different and in many ways cleaner: instead of an upgrade process, you do a rebase to the new reference with rpm-ostree rebase. The system downloads the complete new Fedora 44 image, and on reboot you simply activate the new deployment. The previous one stays available for immediate rollback if something fails. If you have RPM Fusion packages layered on Silverblue or Kinoite, you must first update the RPM Fusion reference to the new release before rebasing, or the layers will be left in an inconsistent state.

And this edition’s specific warnings, which we already covered in earlier sections but must be kept in mind before running the upgrade: the removed cert.pem if you have scripts or applications hardcoding that path, FUSE 2 removed on Atomic Desktops with the impact on AppImages and Plasma Vaults, and the Ruby 4.0 ABI break if you have gems with native extensions that need recompiling.

Conclusion: Fedora 44 Is Not a Filler Release

Fedora 44 is not a filler release. It has real technical moves: the GNU Toolchain takes a major leap with GCC 16, Ruby 4.0 is a major version change with real implications for those using it in production, MariaDB 11.8 brings vector support for machine learning directly into the database, and NTSYNC in the kernel concretely improves Wine and Steam performance.

But the most important change isn’t in any package version: it’s in the architectural direction. Sealed Images, Bootable Containers, bootloader unification, the Cloud migration to Btrfs subvolumes. Fedora is actively building the operating system model of the future: immutable, cryptographically verifiable, managed as code infrastructure.

If you come from other distros and Fedora has always seemed “too bleeding-edge” to you, confusing that with “instability” or “malfunction”, this is the time to revisit it. The base is solid, the toolchain is the most modern in the RPM ecosystem, and the direction is crystal clear.

Sources and Resources

Official Fedora Linux 44 announcement — Fedora Magazine: https://fedoramagazine.org/announcing-fedora-linux-44/
What’s new in Fedora Workstation 44 — Fedora Magazine: https://fedoramagazine.org/whats-new-fedora-workstation-44/
Fedora 44 ChangeSet — Fedora Wiki: https://fedoraproject.org/wiki/Releases/44/ChangeSet
Fedora downloads and editions: https://getfedora.org/

Ubuntu 26.04 LTS: Security, AI, Gaming and Kernel 7.0 | A New Era

Mon, 27 Apr 2026 12:00:00 +0000

Also available on Odysee: https://odysee.com/@javierorozco.observer:6/Ubuntu26.04:1

On the channel I already covered the ethical, purist approach to free software with the Trisquel 12 release. Now it is time for the industry heavyweight.

On April 23, 2026, Ubuntu 26.04 LTS, codenamed “Resolute Raccoon”, was released. I know that every two years a new LTS comes out and every two years someone says “this is the most important one in history”, but this time I am going to argue why that claim carries more weight than ever.

This edition brings changes that had been years in the making: the definitive move to Wayland, core tools rewritten in Rust for memory safety, CUDA and ROCm directly in the official repositories with no external repositories, and a 7.0 kernel that natively integrates artificial intelligence ecosystems.

This is not a maintenance update. It is a change of era. If you manage servers, deploy infrastructure, game on Linux, or simply want to squeeze the most out of your hardware without depending on Windows, here I break down what this release really brings and what each change means.

Installation and TPM encryption

Installing the system is quite intuitive and easy to understand. At the start, the usual: choose a language, keyboard layout, internet connection, installation type, extended selection for more default applications, proprietary drivers and codecs which are disabled by default, partitioning, and the most important part, encryption, which as I said in the previous article is something everyone should always enable, and under no circumstances or pretext should you use a disk or operating system without encryption. In this edition they have added hardware-backed protection with the TPM chip, and to try it out I used it this way in my installation.

Basic details such as username, machine name, password, and the option to require the password at login, which I also always recommend enabling, especially with TPM, since the device boots automatically. Then we have timezone selection and a summary to confirm the installation; once completed, we simply reboot.

The desktop: GNOME 50 and the definitive farewell to X.org

On boot we find a welcome wizard. The first thing it asks is whether we want to enable location services and telemetry to report errors or usage statistics. Both are anonymous, and Canonical has proven over the years to be a very ethical company, so this is left as each person’s individual choice. Then we have the choice between light and dark themes and highlight colors.

As always, the first thing I recommend is installing the updates; there are not many, since this edition came out just a few hours ago:

1
2


sudo apt update && sudo apt upgrade
sudo apt install fastfetch

Let us start with what most people notice first: the desktop. Ubuntu 26.04 ships with GNOME 50 and marks a historic milestone: it is the first Ubuntu LTS with no X or X.org session available in GNOME. Wayland is now the absolute king of the GNOME desktop. If you have old applications developed for X11, do not worry: XWayland is still there as a compatibility layer and in most cases you will not notice the difference.

But the benefits of Wayland are already undeniable. If you have a high-refresh-rate monitor, VRR or variable refresh rate, also called G-Sync and FreeSync, can be enabled on supported displays. Per-monitor fractional scaling is now production-worthy. And the desktop flows without tearing, that is, without desynchronization, even under heavy load and at high refresh rates.

The settings center covers the essentials quickly and concisely: the blue light or night light filter, wired networks, Wi-Fi, VPN and proxies, Bluetooth adapters, audio devices for both output and input and system sounds, power profiles, multitasking and screen edges, appearance and desktop customization, application management, permissions and notifications, dash search configuration, online accounts, and local file sharing and media streaming.

The new default applications

GNOME 50 is not just the shell. The default application ecosystem changes quite a bit:

Showtime as the video player. More modern, better system integration, and the option to install missing proprietary codecs if needed.

Resources replaces the old System Monitor. This one is especially interesting: it not only shows CPU and RAM, it also tracks GPU usage, hardware clock frequencies, and NPU (if you have one) and groups processes by application instead of listing them individually. It is written in Rust with GTK4. It is what the system monitor should have been long ago.

Ptyxis is the new default terminal. What sets it apart is native support for managing containers with Podman, Toolbox, and Distrobox. As an example, I installed Fedora inside Ubuntu using Distrobox; yes, just as it sounds. That deserves a separate article, so I will not go deeper into it here, but the process is quite simple, and in the new terminal we always have access to all the containers we have listed: Ubuntu and Fedora living together on the same system. The new terminal also has session restore to recover your tabs and working directory locations when reopening. If you work with containers every day, this is a real quality-of-life change.

Loupe is the new image viewer, also developed in Rust. Papers is the new PDF viewer, based on the same code as the previous one but partially rewritten in Rust with GTK4.

Visual changes

Visually, the dock no longer has transparency; it is completely opaque. Folder icons are now colorful. Notifications are grouped by application, ending the visual mess of having 40 individual notifications.

The App Center now fully manages system .deb packages —install, update, uninstall— in addition to snaps. More cohesion, less need to go to the terminal for basic operations. As an example, I installed a YouTube Music client this way.

You may have noticed that two new search providers were added to the dash: there are App Center results and direct access to web searches in Firefox. Small details, but useful.

NVIDIA and Wayland

If you use NVIDIA, historically the headache of Wayland on GNU/Linux, there are no more excuses: the proprietary 595.x series drivers are the standard in this release, Wayland support is complete, and the freeze issue when waking the machine from suspend is fixed. Versions 535, 550, 560, 570, 575, 580, and 590 are also available.

There is also a new telemetry panel —Ubuntu Insights— to opt in or out of sending anonymous metrics to Canonical. Important: it is completely opt-in. Nobody sends your data without your explicit consent, and the controls are accessible from the welcome wizard.

The notable absence

The “Software & Updates” application —which many used to manage PPAs, repositories, and drivers— no longer comes installed by default. Canonical has not given a fully clear reason for this, and there is debate in the community. But it is still available in the repositories, and its departure from the base system is striking and worth mentioning:

1

sudo apt install software-properties-gtk

Security in its DNA: the Rust revolution

Here is where things get serious. As someone who works in cybersecurity, seeing this in a mainstream distribution that is the parent of so many others is music to my ears.

Ubuntu 26.04 is the first LTS to aggressively embrace Rust, the programming language that eliminates at compile time entire classes of vulnerabilities that have plagued C software for decades: buffer overflows, use-after-free, and memory race conditions.

sudo-rs

You will notice it immediately in the terminal: sudo has been replaced by sudo-rs, the reimplementation in Rust. The most visible change is cosmetic but symbolic: you now see asterisks as you type your password. But what matters is underneath: the code that runs privileged operations on your system is no longer written in C.

The original sudo is still available as sudo.ws if you need specific features that sudo-rs does not cover yet.

rust-coreutils (uutils)

Even deeper: the coreutils —the most fundamental tools of the system, ls, cat, base64, head, and dozens more— are now rust-coreutils by default, the implementation of the GNU utils in Rust.

For most users this is transparent. But there is an important technical detail worth clarifying: cp, mv, and rm are still the GNU versions in this release, because there are unresolved bugs in the Rust implementations. If you need to switch back to GNU coreutils for everything, you can, and if you want to go back to Rust, you can too:

1
2


sudo apt install coreutils-from-gnu
sudo apt install coreutils-from-uutils

There are also new kernel components written in Rust. This is not just Ubuntu; it is part of the Linux kernel project’s effort, but Ubuntu 26.04 brings it to LTS-user mainstream for the first time. As a curiosity, rolling-release distributions such as Arch and openSUSE are still on the 6.x branch.

Preventing memory vulnerabilities at the very foundation of the operating system raises the defensive posture of millions of installations. The Rust Foundation celebrated this publicly, noting that Canonical is raising security for millions of users in production.

TPM-backed FDE: serious disk encryption

Hardware TPM-backed full-disk encryption leaves its experimental phase in this release. It is the option we saw in the installer, and it is production-ready.

What does this mean in practice? The encryption keys are tied to your motherboard’s TPM chip. Unlike traditional LUKS where you type a password on every boot, here the disk unlocks automatically when the TPM verifies that the system has not been tampered with, that is, that the hardware is the same, the bootloader was not altered, and there is nothing suspicious. If someone physically removes the disk and connects it to another machine, they cannot access the data. And if you want an extra layer, you can add a PIN.

Against physical-access attacks, this raises the attacker’s cost significantly.

Post-quantum cryptography

One last point that few people notice but that is strategically important: OpenSSL in this release includes support for post-quantum algorithms: ML-KEM, ML-DSA, and SLH-DSA.

Why does it matter now? Because quantum computers, once powerful enough, will be able to break the RSA and ECC cryptography that protects practically all of today’s digital infrastructure. Preparing the ecosystem for this transition before it becomes urgent —and not after— is exactly what needs to be done. Ubuntu 26.04 starts laying the groundwork.

Kernel 7.0, hardware, and gaming

The engine behind all of this is Linux 7.0. It is the highest version number to reach an Ubuntu LTS in a long time, and it comes loaded.

Intel Panther Lake and NPU support

Kernel 7.0 adds full support for Intel Core Ultra Series 3 processors, codenamed Panther Lake. This includes optimizations for the integrated Xe3 graphics and for the integrated NPU (Neural Processing Unit). If you are on a modern Intel laptop and want to run local AI inference efficiently without depending on a server, this combination of hardware and kernel starts to make real sense.

AMD and NVIDIA

On AMD, Mesa 26 brings ray tracing with the ACO compiler by default and general performance improvements. GPUs from the RX 6000 series onward benefit directly. For those of us running a Radeon card, there are concrete improvements in rendering performance and compute workloads.

On NVIDIA, as I mentioned before: Wayland works fully, suspend is fixed, and the 595 series drivers are the standard. There are no longer technical reasons to avoid Linux on NVIDIA machines, although there are ethical ones —but that is another topic.

Kernel Livepatch for ARM64

Until this release, Canonical’s Kernel Livepatch —which applies critical security patches directly to the running kernel without rebooting— only worked on x86-64. With Ubuntu 26.04, it comes to ARM64 for the first time.

For organizations with ARM servers, this is huge. Before, a critical kernel security patch meant a reboot with a maintenance window and downtime. Not anymore.

EtherCAT for industrial automation

An addition that goes unnoticed by common users but is significant for specific sectors: the IgH EtherCAT Master module and the Generic Ethernet driver are now integrated directly into the kernel. EtherCAT is a real-time industrial networking protocol with microsecond precision, used in robotics, motion control, and factory automation. Having this in the kernel of an official LTS removes a huge integration burden for engineers in that sector.

Gaming: NTSYNC and the end of the Windows pretext

And we reach the point I know several of you were waiting for.

If you are one of those who spend hours cleaning up Windows —disabling telemetry, bloatware, background processes— or installing trimmed-down builds of dubious origin to avoid losing FPS in the middle of a game, this kernel has something for you.

The kernel ships NTSYNC built into Linux 7.0, which emulates Windows NT kernel synchronization primitives directly. This strongly impacts the performance of Windows games and applications running through Wine and Proton. Titles that depend heavily on inter-thread synchronization see real, measurable performance improvements.

Combined with Wayland, Mesa 26, and well-supported NVIDIA and AMD drivers, gaming on GNU/Linux is no longer “an alternative”. It is a direct threat to Windows’ dominance on the gaming desktop. There are still edge cases where Windows is necessary, but the gap is closing with every release, and this one in particular accelerates that process.

CUDA and ROCm in the repositories: Ubuntu’s AI moment

This is the change that will have the most impact over the coming years for AI and machine learning developers.

For the first time in Ubuntu’s history, NVIDIA CUDA is available directly in the official repositories. Before, installing CUDA meant adding NVIDIA’s repository manually, dealing with versions that could break system dependencies, and resolving driver conflicts. Now it is simply:

1

sudo apt install cuda

No external repositories. No surprises.

The same applies to AMD ROCm, AMD’s open-source ecosystem for GPU-accelerated workloads —artificial intelligence, machine learning, HPC—. For those of us with AMD hardware, having ROCm available this cleanly completely changes the equation for experimenting with frameworks like PyTorch or JAX on AMD GPUs.

Why does it matter that they are in the official repos and not in external PPAs? Because the packages go through Canonical’s validation and security chain. Updates are tested to work together with the rest of the system. For organizations deploying this in production, the difference between “it works today and breaks with the next apt upgrade” and “it is validated for this LTS” is fundamental.

AMD’s own vice president of Software highlighted that this allows developers to build and deploy on AMD Radeon and Ryzen GPUs with direct access from the repositories, without friction.

Ubuntu 26.04 is making a very clear positioning statement: it wants to be the reference platform for AI development and deployment. With CUDA + ROCm in the repos, native Intel NPU support in the kernel, and confidential computing for private AI, the argument is solid.

System plumbing: APT and systemd

There are “plumbing” changes that go unnoticed but that for the daily work of sysadmins, programmers, or advanced users are as important as anything else.

APT 3.1: transaction history at last

The package manager moves up to version 3.1 and brings the functionality we all dreamed of: interactive transaction history.

1
2
3
4


sudo apt history-list
sudo apt history-info 0
sudo apt history-undo 0
sudo apt history-rollback

apt history-list shows what you installed, when, and what changed. apt history-info 0 details a specific transaction. apt history-undo 0 undoes an installation. And apt history-rollback takes you back to an earlier point of the system.

In production, this is a lifesaver. Did you update a package and something broke? Now you have a clean path to roll back. Tools like dnf and pacman have had something like this for a long time; its arrival in APT is welcome.

apt-key, long deprecated, was also removed. Signature verification now uses gpgv directly. If you have automation scripts that use apt-key, review them.

systemd 259: two important changes

First: support for cgroup v1 (legacy and hybrid) is removed. If you have containers or configurations that depend on legacy cgroups, you need to migrate. This must be reviewed before upgrading production systems.

Second: this is the last LTS with System V script compatibility in systemd. From here on, if you have services with SysV-style init scripts, the clock is ticking to migrate them to native systemd units. It is not urgent today, but the signal is clear.

One extra technical detail: the /tmp directory is now mounted by default as tmpfs in RAM. It reduces SSD wear on servers and improves the performance of temporary operations.

Dracut replaces initramfs-tools

The initial ramdisk system is now Dracut by default, replacing initramfs-tools. It uses systemd in the initial RAM disk and natively supports Bluetooth and NVMe over Fabrics, which offers a faster and more efficient connection between storage and servers, in addition to reducing host CPU utilization by applications. If you have very specific scripts or hooks that depended on initramfs-tools, check compatibility.

Chrony and time synchronization

Chrony replaces systemd-timesyncd as the default time daemon, with support for Network Time Security, NTS for short (authenticated and encrypted time), using Ubuntu’s time servers. For high-availability clusters where precise time synchronization is critical, Chrony is the right choice. On the GNOME desktop we can also add other time zones; in my case, since I casually work with the stock market, I am always interested in adding New York and London times to keep stock exchange opening and closing hours in mind.

amd64v3: opt-in performance for modern hardware

If your CPU is more than a few years old and is 64-bit, it probably supports level 3 microarchitecture, which includes AVX2 —which delivers better performance by accelerating operations in parallel— and other modern instructions. Ubuntu 26.04 offers packages compiled for amd64v3 as an opt-in variant. To enable them:

1
2


echo 'APT::Architecture-Variants "amd64v3";' | sudo tee /etc/apt/apt.conf.d/99enable-amd64v3
sudo apt update && sudo apt upgrade

Real performance improvements in applications that take advantage of them. No risk: if your hardware does not support it, it simply will not activate.

Cloud, enterprise, and virtualization

For the enterprise and cloud segment, there are several points worth noting.

Confidential Computing

Ubuntu 26.04 supports both Intel TDX and AMD SEV for confidential computing, both as host and guest. Simply put: you can run virtual machines where neither the hypervisor nor the host system can access the VM’s memory. Memory is encrypted at the silicon level.

The most relevant use case is AI workloads on shared infrastructure where the privacy of training or inference data is critical. This is not science fiction: it is infrastructure available today, in a long-supported Ubuntu release.

Authd: cloud authentication without extra infrastructure

Authd, the authentication service with cloud providers, is now in the official Ubuntu repositories. You can authenticate Ubuntu devices with Microsoft Entra ID, Google IAM, or any standard OIDC provider, with no additional infrastructure needed on the network.

For organizations managing fleets of Ubuntu machines that already have centralized identity in Azure or Google, this greatly simplifies onboarding and deployments.

Improved WSL

If for work reasons you are forced to use Windows, Ubuntu’s integration in the Windows Subsystem for Linux improves in this release: better handling of usernames with non-ASCII characters, cloud-init integration, Ubuntu Pro for WSL, and management of multiple machines through Canonical’s Landscape.

Toolchain, flavors, and requirements

Developer toolchain

Ubuntu 26.04 ships a very up-to-date development stack: GCC 15.2, Python 3.14 by default, LLVM 21, Rust 1.93, Golang 1.25, OpenJDK 25 with versions 8, 11, 17, and 21 also available with Java TCK certification.

And an important debut: Zig 0.14.1 is finally in the official Ubuntu repositories. For those who have been following the Zig language as an alternative to C for low-level systems, it is now one apt install away.

Also .NET 10 in the official archive, PHP 8.5 with property hooks and the pipe operator, PostgreSQL 18 with a new I/O subsystem promising up to triple the improvement in disk reads, and MySQL 8.4 LTS, the first official LTS release of MySQL.

Official flavors

If GNOME is not your thing, the flavors are still there. Kubuntu ships with KDE Plasma 6.6. Xubuntu with Xfce 4.20. Lubuntu with LXQt 2.3. There are also Ubuntu Budgie, Cinnamon, Kylin, and Unity, although the latter is not catalogued as LTS and will be released in 2 days.

One absence worth noting: Ubuntu MATE has no 26.04 release. The most direct and similar alternative is Xubuntu.

System requirements

Canonical raised the recommended requirements to 6 GB of RAM and a dual-core 2 GHz CPU. This is not a hard requirement —you can install with 4 GB— but they are being honest about what 2026 workloads demand in practice. The desktop ISO weighs more than 6 GB, so you need a good connection or patience.

When should you upgrade?

The answer depends on your situation.

If you are on Ubuntu 25.10: in the coming days you should see the upgrade notification. You can do it without major risk.

If you are on Ubuntu 24.04 LTS: the direct upgrade is not enabled until July 2026, when Ubuntu 26.04.1, the first point release, comes out. Canonical always follows the same procedure: they wait until post-release bugs are fixed before opening the mass upgrade to LTS users. It is the standard policy and makes a lot of sense.

You can upgrade manually before July if you want, but you take on the risk of bugs that will probably be fixed within weeks.

My recommendation: if it is a production server or a critical work machine, wait for 26.04.1 in July. If it is your personal computer and you want to explore, go ahead, just have a recent backup and free time in case something breaks.

Closing

Ubuntu 26.04 is not a package update. It is a statement of intent.

Wayland as the sole backend in GNOME. Rust in the kernel, in sudo, in the coreutils. CUDA and ROCm in the repos with no external repositories. Kernel 7.0 with 2026 hardware supported from day one. APT with transaction history. Production-ready confidential computing.

And for those of us in the cybersecurity world, seeing the foundation of a mainstream operating system move toward languages with memory-safety guarantees, with hardware-tied disk encryption, with post-quantum cryptography in the default stack, is exactly the direction and standard things should head toward.

This is not a consolidation LTS. It is a transition LTS. And those are the most interesting ones.

Ubuntu 26.04 LTS “Resolute Raccoon” is not a simple package update. It is a change of era. In this analysis I focus on what is under the hood: Rust in the kernel and coreutils, production-ready TPM encryption, post-quantum cryptography, CUDA and ROCm in the official repositories, NTSYNC for gaming, APT with transaction rollback, and much more.

Sources and resources

Ubuntu 26.04 LTS release notes: https://documentation.ubuntu.com/release-notes/26.04/
Official Canonical announcement: https://canonical.com/blog/canonical-releases-ubuntu-26-04-lts-resolute-raccoon
Release announcement on the community forum: https://discourse.ubuntu.com/t/ubuntu-26-04-resolute-raccoon-lts-released/80833
Installation images (ISO): https://releases.ubuntu.com/resolute/

4 Myths About Trisquel 12 | Installation and Configuration

Sat, 18 Apr 2026 12:00:00 +0000

Also available on Odysee: https://odysee.com/@javierorozco.observer:6/Trisquel12:c

“It’s only for fanatics.”

“It doesn’t work on real hardware.”

“It’s a dead distro.”

I have heard that about Trisquel for years. And Trisquel 12.0, codenamed “Ecne”, deserves better press than it gets: none of those claims survive contact with reality. But I am not going to ignore the real limitations that do exist either, because that would be doing exactly what I criticize.

I am not here to sell an ideology. I come from systems administration and cybersecurity, and from that perspective Trisquel has a solid technical argument that is rarely explained well.

What Trisquel Is: a 100% Free Ubuntu

Trisquel is a GNU/Linux distribution based on Ubuntu (which is itself based on Debian), but what makes it stand out is that it is certified by the Free Software Foundation as a 100% free distro.

It uses linux-libre: an alternative version of the kernel from which all proprietary firmware blobs have been manually removed. Not only does it not include the blobs, it patches the kernel so it does not even try to load them if it found them on the system. That is closed binary code that manufacturers ship inside the regular Linux kernel and that runs on your hardware without you being able to read it, audit it, or know exactly what it does — just like proprietary drivers on other operating systems.

Free software in general grew out of an anecdote related to this. Richard Stallman worked as a programmer at the MIT Artificial Intelligence Laboratory in the 1970s and 80s, when it was common for researchers to share source code freely: if someone improved a program, they made it available to the community.

The lab received as a donation from Xerox a high-speed laser printer with a serious problem: it jammed frequently. With the previous printer, Stallman had solved that kind of problem by modifying the software, because they had access to the driver source code. With the new Xerox it was impossible: the software was only a binary and Xerox did not hand over the source code. And the most revealing twist: someone did have that source code, but refused Stallman a copy because he had signed a non-disclosure agreement (NDA) with Xerox.

That moment showed him the dangers of proprietary software: it turns you into a prisoner of your software, it stops you from fixing real problems, it breaks cooperation between users, and it gives the manufacturer disproportionate power over the user. In September 1983 he announced the GNU Project, in 1985 he founded the Free Software Foundation, and he defined the Four Freedoms of Free Software: to run the program for any purpose, to study and modify it, to distribute copies, and to distribute modified versions. And a point he always clarifies: “free” refers to freedom, not price. As the famous saying goes: think free speech, not free beer.

That is not paranoia, fanaticism, or extremism. In systems administration and security, software you cannot audit is a risk by definition, not an optional convenience. And the FSF does not certify distributions lightly: it is one of the strictest filters out there.

Myth 1: “It’s Only for Fanatics”

This argument assumes that using fully free software is an emotional decision, a rejection of companies, and it is a comfortable way of not having to evaluate the real argument.

The technical argument is this: when your kernel includes binary firmware, you are running code with extremely high privileges, at the hardware level, that you cannot inspect. In a security context that is an attack surface. Not theoretical: real. There have been documented vulnerabilities in the firmware of network cards, storage controllers, and audio chips.

Does that mean everyone should use linux-libre? Not necessarily. There are contexts where that trade-off does not pay off. But saying that whoever chooses it does so out of fanaticism is ignoring the argument. And in security, ignoring arguments is exactly what you should not do.

Myth busted. Moving on.

Installation: the Ubiquity Installer and APT 3.0

The ISO is downloaded from trisquel.info, in its main edition with the MATE desktop. There are also editions with KDE Plasma, LXDE, and an educational version based on Sugar, but here I focus on the main one.

The installer is Ubiquity, the same one Ubuntu uses. If you ever installed Ubuntu, everything will feel familiar: language, time zone, partitioning, user. No surprises. My recommendation, valid for any operating system, is to always enable the full-disk encryption option.

One detail worth mentioning: in Trisquel 12 the installer already uses the deb822 repository format natively. That is APT 3.0. It is not a visible change for the end user, but it is modern infrastructure and engineering work the Trisquel team did from scratch, inherited not from Ubuntu 24.04 but directly from Debian 13.

During installation it will not ask you for any proprietary firmware. There is no “install additional drivers” option like in Ubuntu. That is intentional: if your hardware needs blobs to work, Trisquel will not install them. And that takes us straight to the next myth.

Myth 2: “Without Blobs There Is No Wi-Fi or GPU”

This myth has a true part and an exaggerated part, and it is worth separating them.

The true part: there is hardware that requires binary firmware and linux-libre does not include it. The most common cases are Broadcom Wi-Fi cards, some Realtek models, and certain NVIDIA GPUs. If you have one of those, it will not work on Trisquel. Period.

But the exaggerated part, where the argument collapses, is assuming that applies to all modern hardware. It does not: Intel and AMD graphics, Intel wired network cards, and recent integrated Realtek audio work without proprietary firmware.

For physical machines, my practical recommendation is to check your hardware beforehand on h-node.org, the catalog of free-software-compatible hardware maintained by the FSF. It is not a complicated step and it saves you surprises.

Is it a real limitation? Yes. Does it rule out Trisquel for any hardware? No. Those are different things.

The MATE Desktop and Preinstalled Software

MATE has been Trisquel’s default desktop environment for years: simple, stable, and accessible. It does not need 3D acceleration, which makes it viable on old hardware and in virtualized environments.

It comes with the basics preinstalled: Abrowser, which is Firefox reconfigured without Mozilla telemetry or services, LibreOffice, a media player, a file manager, and the standard system tools.

The system ships with a bit of everything: disk usage analyzer, calculator, dictionary, archiver, file search, character map, on-screen keyboard, PDF editor, text editor, blue-light filter, magnifier, screen reader, terminal, screenshots, and font and PDF viewers. For multimedia and graphics there is a disc burner, webcam viewer, media players, sound mixer, scanner software, photo editor, color picker, and photo organizer. For the internet: email client, decentralized, private, and encrypted chat software with calls and video calls, news reader, browser, multiprotocol messaging, BitTorrent client, and remote desktop client. And for the system: full office suite, backups, file explorer, system monitor, ISO image mounter, log viewer, updater, software installer, bootable USB creator, .deb package manager, printer wizard, and management of users, networks, disks, power, and repositories. Most settings are centralized in the Control Center.

Myth 3: “It’s No Good for Real Work”

The Trisquel repositories hold thousands of available packages. We are not talking about ten tools in a plain-text directory, but a package base derived from Ubuntu 24.04 and cleaned of non-free dependencies. WireGuard, KeePassXC, networking tools, editors, version control: nothing critical is missing for a systems administration and programming workflow.

Trisquel 12 also has an active backports repository: LibreOffice in its latest version, yt-dlp, Inkscape, Nextcloud Desktop, Kdenlive. Updated software without waiting for the Ubuntu LTS cycle.

And on browsers: in this release the team added GNU IceCat and ungoogled-chromium as additional options alongside Abrowser. Three fully free browsers available from the official repositories.

The “it has no useful software” argument confuses “free” with “scarce”. They are not the same thing: free means you can read the code, modify it, and redistribute it, not that there is less software.

Post-Installation: Updates, Backports, and Browser

Updating the System

The first thing after a clean install is to install the pending updates. APT 3.0 feels noticeably faster at resolving dependencies than previous versions:

1

sudo apt update && sudo apt upgrade

Something the Trisquel team worked on specifically in this version 12: they reviewed and expanded the AppArmor rules for graphical environments. More applications running with active confinement profiles by default. It is silent work, nothing visible, but exactly the kind of security work that matters.

Enabling Backports: LibreOffice 24 → 26

Without enabling backports, LibreOffice ships in version 24, the same one Ubuntu 24.04 carried by default. Enabling the repository is easy from the graphical interface: Menu, System, Administration, Software & Updates; in the “Other Software” tab you enable the Backports repository, authenticate with your password, click “Close” and then “Reload”. You can also do it faster from the terminal, but through the interface the process stays visible. Then go back to Menu, System, Administration, Software Updater, click “Check for Updates” and the backport packages appear: just click “Install Now”. When you reopen LibreOffice you can verify it is now on version 26.

Resource Usage

With htop you can see the distro’s real resource usage: used RAM sits between 800 and 900 MB:

1

htop

I also installed fastfetch, which is in the now-enabled backports, to show the system information:

1

sudo apt install fastfetch

Keep in mind that fastfetch usually shows an extra RAM figure above 200 MB, because it includes its own memory overhead.

Abrowser, the Default Browser

Abrowser even lets you sign in with a Firefox account to sync across devices. But it has one quirk: when you try to install extensions, the browser sends you to the Mozarella page on Ñugzilla, which only contains 100% free extensions… with the problem that they are outdated, as I verified with the two I use in every browser: uBlock Origin for blocking intrusive ads and Bitwarden as my self-hosted password manager.

It is not a serious problem: just go manually to the Firefox extensions page, search for the ones you need, and install them.

The browser also ships with strict anti-tracking mode. I recommend leaving it that way and, if some site has problems, selectively enabling the option to fix major site issues.

MATE Customization

This is already personal taste: I removed the three taskbar icons for the menu, the file manager, and the browser. Then, with right-click and “Add to Panel”, I added the advanced MATE menu, which supports search; I moved it to the edge and locked it to the panel so I would not move it by mistake. Then I added back Caja, the file manager, and the browser, although you can add as many as you want.

To test the centralized configuration I switched to the dark theme from the Control Center. When you do this, I recommend logging out and back in: that way the change applies to all applications, including the menu.

GNU Guix: More 100% Free Software

And to finish breaking myth 3, there are two ways to get more fully free software compatible with the distro’s philosophy and the FSF’s.

The first is GNU Guix. On the official Trisquel website, searching for “Guix” takes you to the “All Manuals” page and from there to the “GNU Guix Package Manager” manual, with a short description of what it is. If you know the Nix package manager or the NixOS distribution, this is the same thing, but in a 100% free version: it is both a package manager and a NixOS-style distribution.

One of its advantages is that you can even install different versions of the same package, with all dependencies included and bundled, and generally everything stays at its latest version.

Installing it means following some fairly simple steps, although parts of the process take around half an hour. That is completely normal, but it only happens the first time. When finished I recommend logging out and back in so the added environment variables take effect, for example so installed applications show up in the menu.

Installing and Searching Packages with Guix

Guix can be used at the user level, without administrator privileges, which is the most recommended way. As a demonstration I installed the LibreWolf browser, also Firefox-based but with a strong focus on privacy:

1

guix install librewolf

From the console you can also search for packages. I searched for GIMP, the photo editor, and with the keyboard arrows I moved through the results: at recording time GIMP 3.2.0 was available, the latest version, but also 2.10.38. There you can see what I said before: there are several versions of the same software in case you need them:

1

guix search gimp

If you prefer searching from the browser you can also do it on the Guix packages page, where the command appears ready to paste into the terminal and install.

I staged this demonstration on purpose: GIMP already comes preinstalled from the official Trisquel packages in an older version, but I installed 3.2.0 via Guix. To avoid conflicts just log out and back in: the menu ends up with the Guix-installed edition. It is a huge, practical, and very simple repository to use, with the guarantee that the software is 100% free because it is an official GNU and FSF project.

Flatpak Limited to Free Licenses

The other way to install additional software is Flatpak by adding the Flathub repository. But that repository normally contains hundreds of proprietary closed-source programs, so there is a way to force it to only show software with free and verified licenses.

The simplest path is to install the Flatpak plugin for the GNOME software store: with a single command you install the store, the plugin, and Flatpak together. Afterwards I recommend logging out and back in, for the same reason as with Guix:

1

sudo apt install gnome-software gnome-software-plugin-flatpak flatpak

Then, from the terminal you add Flathub in user mode, without root privileges and limited to free licenses. From there you just open the GNOME software store: you already have access to all those applications without breaking, relatively speaking, the distro’s philosophy.

Why do I say “relatively”? Because inside a lot of open-source software there is an easy path to installing non-free software: closed plugins, proprietary and unethical third-party services, and so on. The FSF is not in favor of using software like that. Even so, the final choice belongs to the user, who could even add the full Flathub with all the proprietary software… but that would defeat the purpose of using a 100% free distribution only to then install closed programs on it. It would not be coherent.

Myth 4: “The Project Is Dead”

This myth comes from the release pace. Time passed between Trisquel 10 and 11, and between 11 and 12 as well, and people read that as abandonment. It is not abandonment: it is the cost of doing something difficult with limited resources.

Trisquel 12 ships with APT 3.0, with extensive kernel work to make its modifications more modular, with expanded AppArmor, with three free browsers available, and with active backports. And the team has already announced it is starting preliminary work to support the RISC-V architecture, which is the next frontier of free hardware.

An abandoned project does not do that. A project with limited resources but clear direction does.

Trisquel is non-profit and sustained by donations and memberships. If after trying the project you find it valuable, that is the concrete way to support it.

Who It Is For (and Who It Is Not For): Conclusions

Trisquel is for those who value having a fully auditable system, for those who work in environments where non-free software is a real rather than theoretical risk, for those who want an Ubuntu-based system but without the compromises Ubuntu makes with proprietary firmware and Canonical packages, and for those who want a stable platform with support until 2029 and active backports.

Who is it not ideal for yet? Those who depend on Wi-Fi or GPU hardware that requires binary firmware, although that universe shrinks every year as more manufacturers free their drivers. And those who need proprietary software with no free equivalent. That exists; I am not going to deny it.

But those real limitations are very different from the myths I started with. And the difference matters, because the myths keep people who would benefit from Trisquel from ever considering it.

If you use Linux and never gave Trisquel a chance because you heard it is useless or for fanatics, I hope this changes that. At least so you evaluate it with real information.

Sources and Resources

Official Trisquel site: https://trisquel.info/
Trisquel downloads (12.0 LTS “Ecne” edition): https://trisquel.info/en/download
h-node, free-software-compatible hardware catalog: https://h-node.org/
GNU Guix, transactional package manager: https://guix.gnu.org/
Guix package search: https://packages.guix.gnu.org/
FSF-recommended free GNU/Linux distributions: https://www.gnu.org/distros/distros.en.html
GNU/Linux-compatible hardware (FSF): https://www.fsf.org/resources/hw

Gnu-Linux on Javier Orozco | Observer

Fedora 44 | Deep Technical Analysis: Kernel, Desktops and the Immutable Future

Fedora: Lead, Don’t Follow

Editions, Spins, and Variants: More Options Than Ever

System Requirements, LLVMpipe, and Additional Desktops

Installation: Anaconda, Btrfs, and Disk Encryption

GNOME: Parental Controls, Color, RDP, and IBus

KDE Plasma 6.6: Login Manager, Setup, and Spectacle with OCR

NTSYNC in the Kernel and Goodbye to cert.pem

DNF5 Completes the Transition: PackageKit on libdnf5

Development Stack: Ruby 4.0 and MariaDB 11.8

Nix Arrives in the Official Repositories

Atomic Desktops: The Read-Only System

Bootable Containers and Sealed Images with bootc

Fedora Cloud: /boot as a Subvolume and End of QEMU on i686

Asahi Remix: Official Mesa for Apple Silicon

Post-Install: RPM Fusion, Codecs, Drivers, and Firmware

Upgrading to Fedora 44: Upgrade, Rebase, and Golden Rules

Conclusion: Fedora 44 Is Not a Filler Release

Sources and Resources

Ubuntu 26.04 LTS: Security, AI, Gaming and Kernel 7.0 | A New Era

Installation and TPM encryption

The desktop: GNOME 50 and the definitive farewell to X.org

The new default applications

Visual changes

NVIDIA and Wayland

The notable absence

Security in its DNA: the Rust revolution

sudo-rs

rust-coreutils (uutils)

TPM-backed FDE: serious disk encryption

Post-quantum cryptography

Kernel 7.0, hardware, and gaming

Intel Panther Lake and NPU support

AMD and NVIDIA

Kernel Livepatch for ARM64

EtherCAT for industrial automation

Gaming: NTSYNC and the end of the Windows pretext

CUDA and ROCm in the repositories: Ubuntu’s AI moment

System plumbing: APT and systemd

APT 3.1: transaction history at last

systemd 259: two important changes

Dracut replaces initramfs-tools

Chrony and time synchronization

amd64v3: opt-in performance for modern hardware

Cloud, enterprise, and virtualization

Confidential Computing

Authd: cloud authentication without extra infrastructure

Improved WSL

Toolchain, flavors, and requirements

Developer toolchain

Official flavors

System requirements

When should you upgrade?

Closing

Sources and resources

4 Myths About Trisquel 12 | Installation and Configuration

What Trisquel Is: a 100% Free Ubuntu

Myth 1: “It’s Only for Fanatics”

Installation: the Ubiquity Installer and APT 3.0

Myth 2: “Without Blobs There Is No Wi-Fi or GPU”

The MATE Desktop and Preinstalled Software

Myth 3: “It’s No Good for Real Work”

Post-Installation: Updates, Backports, and Browser

Updating the System

Enabling Backports: LibreOffice 24 → 26

Resource Usage

Abrowser, the Default Browser

MATE Customization

GNU Guix: More 100% Free Software

Installing and Searching Packages with Guix

Flatpak Limited to Free Licenses

Myth 4: “The Project Is Dead”

Who It Is For (and Who It Is Not For): Conclusions

Sources and Resources