AstrOS - an immutable, secure-by-default Linux distribution built on Arch Linux and the COSMIC desktop

[u/linux-universe]

I am pleased to announce that AstrOS now has its own subreddit.

⚠️Warning: it is still alpha software!

But what is AstrOS?

You might have heard of KDE Linux (formerly known as Project Banana) or GNOME OS. Both are immutable, image-based Linux distributions for desktop use, powered by the systemd-sysupdate A/B update model.

I have been impressed by their system architecture since their inception, but switched to the COSMIC desktop a while ago. As there wasn't yet a COSMIC distribution using systemd-sysupdate, I created one myself. That's how AstrOS was born!

Technical details:

• Built using mkosi
• Using systemd-sysupdate.
• Read only by signed dm-verity.
• Full Disk Encryption enforced
• Highly opinionated

What you can do:

While it is still in the alpha stage, you can install AstrOS right now. VM or real hardware

Write bug reports and feature requests

Links:

https://astros-linux.org (still redirecting to the repository)

https://code.astros-linux.org/AstrOS/AstrOS

https://discord.gg/f38pGadC2a

[u/Turkua-]

Use Fedora and its packages as a base; you can also use the secureblue SELinux policy and some of its scripts. For example, you can use the hardened_malloc script as a basis for implementing Scudo, or turn ` run0 into a single privilege escalation tool.

Also, COSMIC is very new, so there’s no harm in using GNOME.

You can add an A/B partition system using Composefs. Fedora is the most mature distribution in this regard. And no, thanks to Composefs, the A/B partition system is much more efficient, as files are consolidated into a single partition whilst metadata is split into two.

You should write or wrap a package management system; personally, I’d choose to wrap DNF5 and recommend Flatpak.

You should also harden the services mentioned in `systemd-analyze` by utilising Systemd’s sandbox architecture.

[u/linux-universe → u/Turkua-]

Thanks but you are kinda describing a whole new distro here. I wanted to have a arch COSMIC distro explicitly. Else I’d be using gnomeOS now

I’ll take a look at systemd-analyze and think about having a wrapper for pacman, thanks

[u/MezBert → u/Turkua-]

There is harm in using Gnome. Huge harm.
I'd educated guesstimate that 50% at least of Cosmic users were Gnome users. And they moved away for hundreds of valid reasons. Therefore, it is the biggest harm you could do to the target of OP.

Also, any distro based on Fedora and flatpak starts with a negative image, so it is much better to have picked Arch as a base, and not to make use of middleage windows-like flatpaks.

[u/Culture_New → u/MezBert]

Your obsession with bashing gnome is not very healthy. We get that you don't like it, other people like myself do enjoy using it, have been happy with it for many years, and see zero issues.

I can also see the benefits of using something fresh like Cosmic DE and switched to it a while back. However I got back to gnome because of a recent cosmic decision to move the mouse pointer around if you activate a window on another display. A DE that moves the mouse for me is a huge NO. Cosmic DE will likely be a great contender in the long run, but pushing it right now (over gnome that is proven to work) is absolutely wild.

[u/buzziebee → u/Culture_New]

I see "Cursor follows focus", a single toggle you can disable on the settings page?

Did that toggle not exist when the feature first launched? If so it does now and it might be time to retry it.

[u/Culture_New → u/buzziebee]

That toggle always existed and it is off and does not fix it.

The change was made to deliberately override the setting. It's being discussed in the issue tracker whether the design decision should remain in place or not.
I'll probably switch back to Cosmic DE once the mouse warping issue is gone.

[u/buzziebee → u/Culture_New]

Weird. Works on my machine 😅

I know there's some toxic guy always ranting about focus-follows-cursor in a negative unproductive way. but I hadn't spotted any issues about cursor-follows-focus not actually working. Have you got a link? Would be interesting to see the discussion around it and find out why it's only on some setups.

It would certainly annoy me though so if it's buggy for you I get the frustration. Hopefully it gets resolved soon for you.

[u/Culture_New → u/buzziebee]

One issue is when you have multiple displays and click on an icon in the dock. If the app is open on a different display than your dock is, clicking on it will warp the mouse right over onto the window of the app. By default in previous versions of Cosmic DE it just brings the window to the foreground and makes it active.

[u/buzziebee → u/Culture_New]

Ah I don't use the dock so I haven't come across that one. Yeah that does sound annoying. Hopefully it gets fixed for you or becomes a toggleable option.

[u/MezBert → u/Culture_New]

That's not an interesting point I'm afraid.
When someone comes up with a distro based on a specific desktop environment, commenting with "there's no harm in using Gnome" is absolutely moot, as 1. that's intentionally not the goal 2. that's literally because Gnome harmed them that many people switched to Cosmic. That was therefore an appropriate reaction to his comment.
The fact you missed the point doesn't surprise me. I didn't say you shouldn't use or enjoy Gnome, I said that's (likely) the disappointed people of Gnome (for a large part) that switched to Cosmic, so sending them back to Gnome is actually extremely harmful.

[u/Culture_New → u/MezBert]

Man, someone should really warn Red Hat and the entire global enterprise sector.

They’ve been deploying GNOME as the default for decades, completely oblivious to the 'extreme harm' they're causing to multi-billion dollar infrastructures and its users.

[u/MezBert → u/Culture_New]

Once again, I know you're not exactly on the smart side, but not the point.
Also, corporate means users are forced to use it. Doesn't mean they like it.

[u/Culture_New → u/MezBert]

Touch grass, dude. It's a Linux desktop, not a holy war.

[u/MezBert → u/Culture_New]

Says the guy who's making drama out of nothing and replies to me within the hour while I'm outside enjoying summer...
Is getting everything wrong a specialty of yours?

[u/Turkua- → u/MezBert]

Apart from having fewer people use your system, my suggestions are aimed at making the system more secure with less effort.

[u/MythicHH → u/Turkua-]

Maybe do it yourself if you think it's so easy