Download orchy

# orchy v0.1.10

Released 2026-10-16 · 1 change since v0.1.9 · commit `6e3f46d`

## Documentation

- the 0f073af9 rollout measured (the proof is the next one); trunk pushed and v0.1.9 tagged (`a8e87e7`)

## Known limits

- **Hosting other people's apps for money is not offered yet.** The plans, usage records, grants and the
  commercial service are in the tree; no plan is defined and no payment path is live.
- **GPUs:** an app cannot use a device's GPU in the jailed or sealed tiers; GPU access is planned as a paid
  plan quota.
- **Platforms:** Linux (amd64, arm64) is what the acceptance drills prove; the Windows service has run on one
  machine; macOS is built but has never been run. Container images and data disks are Linux only.
- **A device whose only allowed home restarts:** an app whose required placement rule admits one device (for
  example "always-on devices only" with one such device) is down while that device restarts; visitors get a
  503 that says so. Change the rule to a preference, or add a device the rule admits.
- **Upgrading a fabric whose brain runs v0.1.8 or older:** that brain must be updated in place once (put the
  new orchy over its daemon's binary and run `orchy tools daemon restart`); the refusal says so. Rollouts from
  any device work from then on.
- **Diskless Alpine (root on tmpfs):** after `orchy up` or `orchy tools daemon restart` installs the service,
  run `lbu commit -d`, or the service is gone at the next reboot.
- **gVisor hosts:** running jailed apps on gVisor needs `orchy tools gvisor install`, subordinate ids for the
  daemon's account, and `user_allow_other` in `/etc/fuse.conf`; `orchy status` says what a device lacks.
- **Event history from builds before 2026-10-15** may hold repeated blocks that the compactor folds away over
  its first hours after the update; until then explanations of a quiet app can be slow.
- **A device in the fabric is trusted for election and key-ceremony messages:** the mesh checks that a sender
  is a member (mutual TLS), and the election and threshold-key handlers do not yet check which member sent a
  claim or a share, so one compromised member could disturb leadership. Not a concern for a fabric of your own
  devices; it is before hosting strangers (finding 79).
- **One listener per app:** an app's routes all reach the same port; an app that listens on several ports needs
  several apps (finding 86).
- **A Windows or macOS device updated before this release** from the daemon-only build has its service but no
  command line at `orchy`; this release's updates ship the full `orchy` binary again, and one update restores it.

## Verify this release

Download `SHA256SUMS` and `SHA256SUMS.sig` next to the binaries you want, and the signing key, then:

```sh
curl -fsSLO https://orchy.p6m.onl/releases/cosign.pub
sha256sum --check --ignore-missing SHA256SUMS
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig SHA256SUMS
```

Every binary also has its own `.sig`, and `provenance.intoto.jsonl` records how the release was built (attested by `SHA256SUMS.att.sig`).

**Full changelog:** v0.1.9...v0.1.10