Skip to main content

index

⚠️ Alpha — early development. Not production-ready. APIs and behaviour may change without notice.

License

XFCE Wayland OCI image built with BuildStream — a lightweight, immutable desktop OS image with the XFCE desktop environment.

Part of the TunaOS ecosystem.

Features​

  • Lightweight — XFCE desktop optimized for low-resource systems
  • Immutable — OCI-based, atomic updates via bootc
  • Wayland — modern display protocol
  • BuildStream — reproducible builds from source

Quick Start​

# Pull the image
podman pull ghcr.io/tuna-os/xfce-linux:latest

# Switch an existing bootc system
sudo bootc switch ghcr.io/tuna-os/xfce-linux:latest

Verifying Signatures​

OCI images and live ISOs are signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key to leak or rotate.

OCI images:

cosign verify ghcr.io/tuna-os/xfce-linux:latest \
  --certificate-identity-regexp 'https://github.com/tuna-os/xfce-linux/\.github/workflows/build-multirunner\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Live ISOs (.sig/.cert are published alongside each dated ISO, e.g. xfce-linux-live-<date>-<sha>.iso.sig):

cosign verify-blob xfce-linux-live-<date>-<sha>.iso \
  --certificate xfce-linux-live-<date>-<sha>.iso.cert \
  --signature xfce-linux-live-<date>-<sha>.iso.sig \
  --certificate-identity-regexp 'https://github.com/tuna-os/xfce-linux/\.github/workflows/build-iso\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Docs​

License​

Apache 2.0 — see LICENSE.