veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
hardened Fedora KDE; primary on Forgejo
42 commits 66 branches 3 tags 1.4 MiB
Shell 96.3%
QML 3.4%
Dockerfile 0.3%
Find a file
veilor-org 2782b72ead sre: release pipeline w/ ISO split, GPG sig, MOK signing scaffold 
- build-iso.yml: on tag push (v*.*.*), split ISO into 1.9G parts, GPG-sign
  the sha256 with GPG_PRIVATE_KEY secret, and auto-create release with
  softprops/action-gh-release@v2 attaching part files + sig + reassembly
  instructions. Falls back to legacy release.published path.
- build-iso.yml: optional EFI Secure Boot signing step. If MOK_PRIVATE_KEY
  + MOK_CERT secrets are present, sbsign each .efi inside the ISO and
  repack with xorriso; otherwise warn and ship unsigned. Refresh sha256.
- release-checksums.yml: new PR-time gate. Validates source + generated
  CI kickstart, shellchecks scripts, parses every workflow YAML, and
  asserts the split size stays under GitHub'''s 2 GiB asset cap.
- scripts/gen-mok-key.sh: idempotent MOK keypair generator (RSA-4096,
  10y), outputs to gitignored build/keys/. Header documents mokutil
  enrollment and gh secret upload. exec bit set in index.
- .gitignore: add build/keys/, *.priv, *.der.

User must add GitHub secrets before the next tagged release:
  GPG_PRIVATE_KEY  — armored private key for sha256 signing
  MOK_PRIVATE_KEY  — sbsign EFI signing key (PEM)
  MOK_CERT         — public cert (DER) for sbsign + mokutil enrollment
2026-05-01 23:39:19 +01:00
.github sre: release pipeline w/ ISO split, GPG sig, MOK signing scaffold 2026-05-01 23:39:19 +01:00
assets v0.3 theme: strip onyx refs from comments (use 'reference system'); lint: filter self-referencing grep patterns 2026-04-30 17:19:12 +01:00
build ci: switch refs from veilor → veilor-org (GH org slug); domain veilor.org 2026-04-30 13:59:20 +01:00
docs veilor-os v0.1 scaffold — kickstart + hardening + 3-mode power + DuckSans-ready KDE black theme 2026-04-30 03:43:33 +01:00
kickstart ks: drop init_on_alloc/init_on_free from live cmdline (5x boot time on KVM) 2026-05-01 23:23:35 +01:00
overlay ci: switch refs from veilor → veilor-org (GH org slug); domain veilor.org 2026-04-30 13:59:20 +01:00
scripts sre: release pipeline w/ ISO split, GPG sig, MOK signing scaffold 2026-05-01 23:39:19 +01:00
test test: add VM runner — qemu+OVMF wrapper for fast iso iteration loop 2026-04-30 04:06:19 +01:00
upstream v0.3 theme: match onyx exactly — solid black wallpaper, Linux Konsole scheme, Breeze_Light cursor 2026-04-30 17:18:14 +01:00
.gitignore sre: release pipeline w/ ISO split, GPG sig, MOK signing scaffold 2026-05-01 23:39:19 +01:00
CONTRIBUTING.md ci: switch refs from veilor → veilor-org (GH org slug); domain veilor.org 2026-04-30 13:59:20 +01:00
LICENSE veilor-os v0.1 scaffold — kickstart + hardening + 3-mode power + DuckSans-ready KDE black theme 2026-04-30 03:43:33 +01:00
README.md fonts: swap DuckSans → Fira Code (Fedora fira-code-fonts, SIL OFL 1.1) 2026-04-30 03:57:17 +01:00

README.md

veilor-os

Hardened minimal Fedora KDE remix. Black-on-black. Locked down by default.

veilor-os is a Fedora 43 KDE spin built for operators who want a clean, fast, opinionated desktop with serious hardening already in place. No prompts at install beyond the LUKS passphrase. Boot, set admin password, work.

Highlights

  • Single-prompt install — only LUKS passphrase. No account wizard, no initial-setup screen. admin account is created automatically; password is set on first boot.
  • Hardened by default — SELinux enforcing, USBGuard, fail2ban, firewalld drop zone, kernel sysctl lockdown, NTS-authenticated NTP, DNS-over-TLS.
  • 3-mode power management — veilor-power save | mid | perf, with AC/battery auto-switching via udev. Backed by tuned profiles.
  • Fira Code system font — programming ligatures, monospace consistency across UI + terminal. (DuckSans planned for v0.3.)
  • Pure-black KDE color scheme — veilor-black theme system-wide.
  • LUKS2 + Secure Boot — argon2id, aes-xts, btrfs subvolumes, zram swap (no disk swap, no cold-boot leak).
  • Reproducible build — kickstart + podman + livemedia-creator. ISO output is deterministic given pinned base.

Repo layout

kickstart/   veilor-os.ks                full kickstart definition
build/       Containerfile + build-iso.sh   reproducible ISO builder
overlay/     files dropped into installed root via %post
scripts/     hardening, SELinux policy, theme apply, firstboot
assets/      fonts, KDE color scheme, branding, plymouth theme
docs/        HARDENING / POWER / BUILD / INSTALL
test/        boot-checklist + findings log

See docs/BUILD.md for build instructions, docs/INSTALL.md for install, docs/HARDENING.md for what's locked down and why.

Status

Pre-release. v0.x. Repo private until first green ISO boots clean on test hardware.

License

MIT — see LICENSE. Fira Code ships from Fedora's fira-code-fonts package under SIL OFL 1.1.