x0ne OS / Handbook / Start here
Getting x0ne OS
Planned — next. Repository signature checks already work: a rogue key, a tampered index and a tampered package are refused (measured 2026-10-09).
Download an image, then check its signature and checksum before you boot or write it.
Prerequisites
gpgandsha256sum, both in Debian.- The x0ne archive key. It is published next, with its fingerprint on this page.
What will be published
| File | Status |
|---|---|
| amd64 live ISO | Next |
x0ne-archive-keyring.deb | Next |
x0ne-os-latest-microvm-amd64.tar | Next |
x0ne-os-latest-amd64.qcow2 | Next |
Container image x0ne-os:base | Next |
SHA256SUMS, SHA256SUMS.sig, one SBOM per image | Next |
| Cloud images | Later |
| Installer and arm64 ISO images | Later |
None of these files exists yet. They are not links on purpose.
Steps
verify an image planned
$ gpg --verify SHA256SUMS.sig SHA256SUMS $ sha256sum --check --ignore-missing SHA256SUMS
Expected output
gpg reports a good signature from the x0ne archive key. sha256sum prints OK next to each file you downloaded.
How to verify
Compare the key fingerprint with the one on this page, from a second network if you can. A bad signature means: delete the file, do not boot it.
Container images
Container images arrive in Next. They will be signed too, and the verification command ships with them.
How to undo
Nothing to undo: verifying writes nothing.