Security

Signing trust chain, security updates and vulnerability reporting. The rolling-release security model: upstream patches land and are picked up immediately.

Signing & Trust

All Linxira packages and repository databases are signed with our own key and verified by pacman at install time. Keys are Ed25519, with a master Certify key kept offline and a separate Signing subkey used for day-to-day package and repo signing.

The signing public key ships with the system keyring package: installing Linxira or adding the [linxira] repository makes pacman import and trust the signing key automatically — no manual steps. Key material is only distributed through official release announcements and repository metadata; fingerprints are not published on this site.

Security Updates

Rolling updates: upstream (Arch) security patches flow into [linxira] and official repos as soon as they land — no distro release cycle in between
Dual-kernel safety net: linux + linux-lts coexist; a broken single-kernel update can be rolled back
Auto-snapshot before updates: linxira-update snapshots via Timeshift before applying changes, ready to roll back anytime
Signature enforcement: repository databases and packages are signature-verified on the pacman side against man-in-the-middle tampering

Key Management Model

Private keys are protected with two independent layers:

Layer 1: a GPG passphrase protects the private key itself (AES-256 symmetric)
Layer 2: a vault password encrypts the key files (Fernet / AES-256-CBC, PBKDF2-HMAC-SHA256 with 600,000 iterations)

The two passphrases are kept separately; leaking either alone does not expose usable private keys. Key files are archived offline as .asc.enc; plaintext private keys never enter any repository. Rotation or new-key issuance happens offline by the holder, then is re-encrypted into the vault.

Report a Vulnerability

For security issues in Linxira, please report privately via GitHub Security Advisory first:

Organization: github.com/Linxira-OS
Use Report a vulnerability in the affected repository — visible only to maintainers
Do not post exploit details in public issues or discussions