Add release notes to `2026.07.12`

[lczyk]

https://github.com/canonical/spread/releases/tag/2026.07.12 is currently
published with an empty body since there is no previous tag to easily diff against. ive tracked down then previously published snap sha to 52e4138 and written example release notes (below). Would be cool to add them to the release?

---

This is the first tagged release of Spread, and the first snap published to the store since 2018. There is no previous tag to diff against, so the changes below are measured from 52e4138 (2018-08-20), which is the commit the last published snap (revision 41, version 2018.08.30) was built from.

Install

snap install spread

or

go install github.com/canonical/spread/cmd/spread@2026.07.12

Breaking changes

• The residue task field is now artifacts, and the -residue command line flag is now -artifacts. Task definitions and invocations using the old names must be updated.
• The Go import path moved from github.com/snapcore/spread to github.com/canonical/spread. Anything importing the packages directly, or installing with go install, needs the new path.
• The QEMU backend now invokes qemu-system-x86_64 -enable-kvm instead of kvm, which makes it work on distributions that do not ship the kvm wrapper. Hosts that only provide kvm are no longer supported.
• Artifacts are now fetched as a gzip tarball rather than an xz one.

New backend

• OpenStack. Distributes tasks to an OpenStack environment via version 3 of the identity API on the default domain. Configured with endpoint, account, key, location (as project/region), and optional networks and groups; images are matched exactly by name first, then by the most recent partial match. See the OpenStack section of the README for a worked example. (openstack backend #170, refactor: adjust openstack name case #231)

New features

• Several settings that were previously backend-wide can now be set per system, and cascade from the backend when unset: storage, plan, networks, and groups.
• secure-boot on a Google system enables Shielded VM secure boot, vTPM, and integrity monitoring. (Adding option for systems created on google to start with secure boot enabled #104)
• bios: uefi on a QEMU system boots the guest through OVMF. The firmware is looked up in ~/.spread/qemu/bios/, then $SPREAD_QEMU_FALLBACK_BIOS_PATH, then /usr/share/OVMF/OVMF_CODE.fd, so distribution packaging can point at its own path.
• • cpu-family requests a specific CPU family for a system; on Google it maps to minCpuPlatform. (Select min cpu platform for google systems #113)
• NOMATCH script helper, the inverse of MATCH: fails and prints the input when the pattern is found. (introduce NOMATCH assertion helper #88)
• reroot on a project specifies a relative path to a new project root before repacking. (project: allow changing the project root #206)
• Server labels are now included in the Spread output.

Fixes

• Reboots are detected by comparing /proc/sys/kernel/random/boot_id rather than by watching uptime move, which removes a class of false negatives on fast-rebooting systems, and dialOnReboot no longer hangs when the remote stops replying.
• LXD: the container address is no longer read from a hardcoded eth0, the right instance is picked out of the lxc list output instead of assuming the first, SSH password authentication is re-enabled where livecd-rootfs disabled it via /etc/ssh/sshd_config.d, and the address wait timeout was raised from 30s to 60s. (backends: LXD: don't hardcode eth0 #178, lxd: select server based on name from result #181, spread(lxd): work around SSH password authentication disabled by livecd-rootfs #184)
• Google: the image cache is marked ready only after it has been populated, and string and file credentials are now parsed the same way. (google: mark cache as ready after it got populated #175, fix: parse string and file credentials in uniform way #280)
• Artifact fetching uses tar -C instead of cd, avoiding a directory reset under sudo. (Fix fetching artifacts when sudo -i changes directory #190)
• OptionalInt.String passed base 64 to strconv.FormatInt; it now passes 10. (Fix OptionalInt.String use of strconv.FormatInt #117)
• Assorted backend fixes: invalid Humbox backend location check, QEMU BIOS path check.

Packaging and build

• The snap moved to base: core24, declares license: GPL-3.0-or-later, and derives its version from the build with adopt-info, so it is now <date>-g<short-sha> rather than a hardcoded string.
• The build moved to Go modules, targeting Go 1.23. (build: move to go modules #129, fix(go.mod): fix module path #281)
• CI moved from Travis to GitHub Actions, with Spread's own test suite running against the LXD, QEMU, and Google backends, and Renovate keeping dependencies current. (chore: Configure Renovate #189)
• Unit test coverage was added for the Google, LXD, QEMU, OpenStack, and client code paths.
• Dependency updates, including golang.org/x/net to v0.38.0 for a security fix, and the removal of the deprecated io/ioutil and crypto/ssh/terminal imports. (chore: update crypto, net and oauth2 dependencies #208, chore: don't import deprecated io/ioutil package #210, chore: don't import deprecated crypto/ssh/terminal #211, fix(deps): update module golang.org/x/net to v0.38.0 [security] #220)

Contributors

Michael Vogt (@mvo5), Sergio Cazzolato (@sergiocazzolato), Zygmunt Krynicki (@zyga), Claudio Matsuoka (@cmatsuoka), Gustavo Niemeyer (@niemeyer), Maciej Borzecki (@bboozzoo), Chris Patterson (@cjp256), Brett Holman (@holmanb), Manuel de la Peña (@mdelapenya), Nicolas Bock (@nicolasbock), Stuart Warren (@stuart-warren), and @thp-canonical.

Full changelog: 52e4138...2026.07.12