DeskOS Source

Verify

Check it yourself.

Nothing here asks you to trust a web page. Three checks, each proving one thing, and a short list of what none of them proves.

You need the file from download.deskos.org, its SHA256SUMS and stable.json beside it, and cosign for the second check.

1. The file is the one we published

sha256sum -c SHA256SUMS

Proves: the bytes on your disk are the bytes named on the download page. A mirror, a proxy or a broken connection cannot change the file without changing the hash.

If it fails: download again. A mismatch is not a slow disk or a partial copy you can fix; it is a different file, and you should not write it to a USB stick.

2. DeskOS built it

cosign verify \
  quay.io/deskos/deskos-core-centos-stream-10-iso@<artifactDigest from stable.json> \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity https://github.com/deskosproject/deskos-core/.github/workflows/iso.yml@refs/heads/main

Proves: the installer was produced by our release workflow and has not been touched since. There is no DeskOS signing key to trust or to leak: the certificate is issued to that workflow by the public infrastructure, and the signature is recorded in a public transparency log.

Why that identity: the installer is built by the workflow that signs it, iso.yml. The image inside is signed by the publishing gate, supply-chain.yml, and the check for it is the same with that name.

3. The image inside is the one that was tested

stable.json names the image digest the installer carries, and the installer itself repeats it in its org.deskos.image.digest annotation. Open Evidence for that digest: what booted, what the session check asserted, which defaults and extensions were verified, and what was not measured.

Proves: the thing you install is the thing that passed the gate, not a nearby build.

What none of this proves

  • That the software has no bugs. A signature says who built it, not that it is correct or free of vulnerabilities.
  • Your hardware. Boot, session and installer are tested in a virtual machine; a real machine is validated one model at a time, and the evidence says which.
  • The base distribution. CentOS Stream 10 packages are CentOS's to fix. The evidence lists the ones we accept, with a reason and a review date.
  • That updates apply themselves. They are staged on your machine and applied at the next reboot; that is your update policy, not this download.

If something does not match

Do not boot it. Open an issue with the digest and the output of the check that failed. A torrent, a mirror with a different hash, or a page that asks you to skip the checksum is not us.