security

Don't trust me.
Verify me.

Let me start from an assumption nobody makes in the Linux world: I consider the concept of trust outdated. Read the continuous stream of CVEs, or look at what happened with the AUR. With the infrastructure I built for Odyssey's supply chain I want to rely on a robust model — above all a mathematically verifiable one, with public registries anyone can consult, independent even from me.

First thing: most Odyssey packages come from Void. This model is built for my repository, for my packages — and they are genuinely few, under a hundred. But that is not the important part. The infrastructure is what counts: Rome wasn't built in a day, and the long-term plan is to bring more and more packages inside our repository and our supply chain.

Here is how it starts. The upstream source is scanned with open source tools looking for certain patterns: exfiltration of SSH keys, cryptominers, intrusive actions — and above all a system that computes the difference against the previous version of the package and analyses it. That is exactly where most of the problems with Linux packages built from upstream sources are born; XZ is the clearest example. The full record is public in the scan record.

Past that stage, packages are compiled reproducibly. And, taking inspiration from the Guix challenge, I created odyssey-challenge: it lets anyone replicate the check and publish it in an immutable online registry that not even I can alter.

The verification keys are two, and they sign each other. One of them is cosign, attested through a particular piece of hardware — a YubiKey 5C NFC — which makes the private key impossible to extract or copy. The cosign manifest is handled by the Linux Foundation. Everything is published.

On top of this chain, an independent scanner runs continuously — on a different machine from the server, obviously — verifying the state of the packages. This is an enforcement system: if a key has a problem, if a package is tampered with, it cannot slip away unseen. It is visible to everyone, both on the status page and inside our package manager, in the repository status section.

the public keys

// cosign — ECDSA P-256 (verifies .cosign.bundle)-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbmmxcFQUDNphGAjTJZqDcgPE7Jok vvjatj5Jposqos8Y276mV9U6TLoF6is44DZcR+M9T2wxMPUilJLzJvJtIw== -----END PUBLIC KEY-----
// ether-repo — RSA 4096 (verifies the xbps repository)-----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq06tNJ0pG4RX3ieRNH8K Imkk1mAcSuM+PmgaUZOwKMfwKC/KPGteCnYCtn2qT3JqUiYdeBR1X92ZDHJwb5q7 JKEgBABxPwHFNCRgOViKvp5UHi9osTIBCILc8D6yHFi4bm3j3d2ehYSH4gmWBiO/ Rx3mb54bXdlxOMHNPnc9KUmxTy8tOxn/cbL69tqaEXPdgqmLtwghzotdoODIOjnw 83ep6pag/IBcA5kzaHIZGx/7k2bW80kTNeEZjZKAx/tEaja2tQLpTlmfesKGfCi1 W7AKrP0HlE9bTZQHhPdDjmp4sLUF9elVnMZ/qC1+hT7BIfMKLHlGM3QpXDl7N8iC NPjtUYx8edHNHINK3s79z5lhTGnmUyZ8CAngr3bRLdIHbRMn30UUUi/c6hLOmr9a YbZC+TthZ+Y3Sz9iI1FBDed7uV5DtTl9i0qr5zuaURmvlqUbVTqzOYpdxGTO4aeJ bIvElQOP2kfGWGjF5r6bdOzLBr+fdsvElyh9JAbefEfY0Zq4CxOge6rHGpeIm45m dTtu2oV608+pKPsLdAoRX/nZX+id/WX1Z9ueRBQOxdEbQUIOm63CZrSOETY8mwct 5a/E+M+YUQWQDtLYrADbdtLBnvKcgvoRd19AXPdcYEoAb7i38Bl6rQXdimClCYyI fsYlk/x8O25vb2NHv2n0bzUCAwEAAQ== -----END PUBLIC KEY-----

Both keys, and the attestation that links them, are published at code.odysseylinux.org/nobody/odyssey-keys. Trust a new or replacement key only if it is announced through both this page and the Forgejo repository.

verify it yourself

The attestation — confirm that each key really vouches for the other:

# get the files
git clone https://code.odysseylinux.org/nobody/odyssey-keys
cd odyssey-keys

# 1 — verify the cosign (ECDSA) signature + Rekor record
cosign verify-blob --key cosign.pub \
    --bundle odyssey-key-attestation.txt.cosign.bundle \
    odyssey-key-attestation.txt

# 2 — verify the ether-repo (RSA) signature
base64 -d odyssey-key-attestation.txt.xbps-sig.b64 > sig.bin
openssl dgst -sha256 -verify ether-repo.pub \
    -signature sig.bin odyssey-key-attestation.txt

Any package — signature plus its record in the public Rekor log:

curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps
curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps.cosign.bundle

cosign verify-blob --key cosign.pub \
    --bundle PACKAGE.xbps.cosign.bundle \
    PACKAGE.xbps
# -> Verified OK

If it returns Verified OK, the package is exactly what was signed, and that signature exists permanently in the public log — it cannot be removed or altered.

Verify & rebuild guide. Check a package in seconds, or rebuild it from source and publish your own attestation. FULL GUIDE →
The scan record. Every package's scan result, public — what passed, what was blocked, what was cleared by hand. SCAN RECORD →
The status page. The current integrity verdict and when the last check ran. STATUS →

found a security problem?

Report it privately — don't open a public forum thread, that would expose the issue before it can be fixed. Write to:

security@odysseylinux.org

Include what you found, how to reproduce it, and how to reach you. Good-faith research is welcome.