This is the first release of the 1.6 line, and it replaces 1.5. The upgrade from 1.5 to 1.6 is one-way: it changes the database schema, and there is no down-migration. Back up before you upgrade.

Thank you to everyone who tested the 21 release candidates. Thank you also to everyone who reported a problem, on the forums or on GitHub, and to everyone who sent a pull request. Each report and each fix helped make 1.6.0 what it is.

Highlights

• Role-based access control is part of core. Roles and their permissions are built in. You no longer install a plugin before permissions exist.
• Sites are part of core. Multi-site scoping is built in. The upgrade moves the site plugin’s data into the core sites table.
• Groups grant snapins, printers and modules. A host that joins a group later gets the grant, and a host that leaves loses it.
• Mass edit on the host list. It replaces the group page’s one-time push. Each field has its own No change, Set on all, or Clear on all choice.
• LDAP and OIDC sign-in are built-in identity providers. Directory groups map to FOG roles, so an external user no longer gets full admin by default.
• API Bearer tokens. Create one on a user’s API tab and send it as Authorization: Bearer <token>. Each token has its own label and on/off switch, and you can rotate it without touching your other integrations. FOG stores only a hash and shows the token once. The old fog-api-token plus fog-user-token pair still works, but a Bearer token is simpler to use and to maintain. Use it for new integrations.
• An audit trail. FOG records who changed what, and shows it as an activity view.
• A retention policy. A retention daemon removes log and audit records older than the number of days you set. The default keeps everything.
• The database enforces its relationships. Real foreign keys now cover every core relationship that can carry one. The upgrade cleans up orphan rows first and logs each cleanup.
• Plugins are installable artifacts. A plugin has its own install, update and removal, and it survives a FOG upgrade.
• Secure Boot enrollment is a task type. You schedule and track it like any other task.

Plugins removed in 1.6

These 1.5 plugins are removed. Do not copy them into a 1.6 server.

• accesscontrol: removed. Core role-based access control does its job. The upgrade removes its registration.
• site: removed. Core sites do its job. The upgrade copies its data into core and drops its tables only when the row counts match.
• persistentgroups: removed, with its database trigger. Core group grants do its job. Installing it again would re-create the trigger.
• fileintegrity and hoststatus: not carried into 1.6. No replacement ships.

Every 1.5 plugin needs a 1.6 build to load. The 1.6 plugins are in https://github.com/FOGProject/fog-plugins .

FOS 1.6.0 (kernel and init)

• Linux kernel 6.18.59 (LTS), Buildroot 2026.02.1. FOS verifies TLS when it talks to the server.
• x64 and x86 boot an initramfs, not an ext2 initrd. The file names stay init.xz and init_32.xz.
  • Warning: a customized init can no longer be loop-mounted. Add your files as an overlay cpio appended to init.xz: https://docs.fogproject.org/en/latest/kb/how-tos/customize-the-fos-init/ . A post-init script needs no rebuild: https://docs.fogproject.org/en/latest/kb/how-tos/post-init-scripts/
• master installs FOS release 1.6.0. stable and dev-branch installs download the Latest FOS release.

What happens to your branch and update channel

• stable (--channel stable) now carries 1.6.0, then the monthly 1.6.0.N releases.
• dev-branch (--channel patches) now carries the 1.6 patches.
• rc-1.6.0 (--channel rc) and working-1.6 (--channel beta) are retired. Move to --channel stable.
• No branch was force-pushed. A 1.5 git checkout reaches 1.6 with an ordinary git pull.

Before you upgrade

• Known issue: the upgrade from 1.5 fails at the schema update if the database holds multicast sessions (Truncated incorrect INTEGER value: ''). Do not upgrade a 1.5 server until 1.6.0.1 is released.
• Back up your database and /opt/fog/.fogsettings.
• Read the release notes: https://github.com/FOGProject/fogproject/blob/stable/docs/release/1.6.0-release-notes.md
• 1.6 removes Display Manager, Directory Cleaner, User Cleanup, Client Updater, Green FOG and the persistentgroups plugin. Their data is dropped.
• PHP 7.4 or later is required. Plugins built for 1.5 do not load.

Install or update (as root)

• A 1.5 server installed from git: run bin/updatefog.sh --channel stable from the checkout.
• A 1.6 beta or RC server: run bin/updatefog.sh --channel stable.
• A new server, or a 1.5 server installed from a tarball:
  curl -fsSL https://raw.githubusercontent.com/FOGProject/fogproject/stable/bin/bootstrap.sh | bash -s -- --channel stable

If an upgrade fails, bin/revertfog.sh in the 1.6 checkout restores the pre-upgrade backup. Run it with --list, then --dry-run, first.

1.5 support

1.5 is end of life. The last 1.5 release is 1.5.10.2534. It gets no further fixes, security fixes included. Every 1.5 tag stays in the repository. Details: https://github.com/FOGProject/fogproject/blob/stable/docs/release/1.5-support-statement.md

Report problems

Open an issue at https://github.com/FOGProject/fogproject/issues. Include your FOG version, your OS, and the installer log from bin/error_logs/. Report a security problem through “Report a vulnerability” on the same repository, not in a public issue.