security
Let me start from an assumption nobody makes in the Linux world: I consider the concept of trust outdated. Read the continuous stream of CVEs, or look at what happened with the AUR. With the infrastructure I built for Odyssey's supply chain I want to rely on a robust model — above all a mathematically verifiable one, with public registries anyone can consult, independent even from me.
First thing: most Odyssey packages come from Void. This model is built for my repository, for my packages — and they are genuinely few, under a hundred. But that is not the important part. The infrastructure is what counts: Rome wasn't built in a day, and the long-term plan is to bring more and more packages inside our repository and our supply chain.
Here is how it starts. The upstream source is scanned with open source tools looking for certain patterns: exfiltration of SSH keys, cryptominers, intrusive actions — and above all a system that computes the difference against the previous version of the package and analyses it. That is exactly where most of the problems with Linux packages built from upstream sources are born; XZ is the clearest example. The full record is public in the scan record.
Past that stage, packages are compiled reproducibly. And, taking inspiration from the Guix challenge, I created odyssey-challenge: it lets anyone replicate the check and publish it in an immutable online registry that not even I can alter.
The verification keys are two, and they sign each other. One of them is cosign, attested through a particular piece of hardware — a YubiKey 5C NFC — which makes the private key impossible to extract or copy. The cosign manifest is handled by the Linux Foundation. Everything is published.
On top of this chain, an independent scanner runs continuously — on a different machine from the server, obviously — verifying the state of the packages. This is an enforcement system: if a key has a problem, if a package is tampered with, it cannot slip away unseen. It is visible to everyone, both on the status page and inside our package manager, in the repository status section.
the public keys
Both keys, and the attestation that links them, are published at code.odysseylinux.org/nobody/odyssey-keys. Trust a new or replacement key only if it is announced through both this page and the Forgejo repository.
verify it yourself
The attestation — confirm that each key really vouches for the other:
# get the files
git clone https://code.odysseylinux.org/nobody/odyssey-keys
cd odyssey-keys
# 1 — verify the cosign (ECDSA) signature + Rekor record
cosign verify-blob --key cosign.pub \
--bundle odyssey-key-attestation.txt.cosign.bundle \
odyssey-key-attestation.txt
# 2 — verify the ether-repo (RSA) signature
base64 -d odyssey-key-attestation.txt.xbps-sig.b64 > sig.bin
openssl dgst -sha256 -verify ether-repo.pub \
-signature sig.bin odyssey-key-attestation.txt
Any package — signature plus its record in the public Rekor log:
curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps
curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps.cosign.bundle
cosign verify-blob --key cosign.pub \
--bundle PACKAGE.xbps.cosign.bundle \
PACKAGE.xbps
# -> Verified OK
If it returns Verified OK, the package is exactly what was signed, and that signature exists permanently in the public log — it cannot be removed or altered.
found a security problem?
Report it privately — don't open a public forum thread, that would expose the issue before it can be fixed. Write to:
Include what you found, how to reproduce it, and how to reach you. Good-faith research is welcome.