The Ur Project

Documenting the craft of stacking things so they remain stacked. For a very long time.

Downloads

The current Sandcastle images for x86_64. Each one comes from the same packages in the Sandcastle Base and Common repositories, shaped for a different place to run. Each one's instructions say what it is for and how to start it.

If you don't know which one to download, pick the live-usb.img.

Older and other images are in the Image Archive.

Before you install, check our supported hardware documentation.

Next: Install it with the installation guide at hand, then tell us how it went.

Each image ships its SBOMs in SPDX and CycloneDX, a license report, and an image.json listing the package closure and the SHA-256 of every file in the build. image.json.sig is the signature over that image.json; checking it is in the signatures guide.

Checking a download

Check what you downloaded against the checksums on this page, not against a file from the download server. Save this block as SHA256SUMS next to your downloads:

4f95a97618fa836ec4ab8223d5bbe558d8166216f0c1524213f15e9265ecd44f  live-usb.img
51eee4ce0dfdb1a71574d20637394493c4952e3c00c95dfe4408f319836bac57  generic-iso.iso
ab565766e772eb58930dff4e46430a5dcef2dce1f8336144f0d1c96cf59591be  generic-cloud.qcow2
dab9ea730204c1199f85e3cca4246dcb52f0cd902f0885459c69b7eb8559502f  wsl-base.wsl

Then check only the files you actually have:

$ sha256sum --check --ignore-missing SHA256SUMS
live-usb.img: OK

On Windows, for the WSL image, in PowerShell:

PS> Get-FileHash .\wsl-base.wsl -Algorithm SHA256

The container image needs no separate step, because it is content-addressed. Every blob's name is its SHA-256, and podman checks each one as it reads it. You only need to check that the manifest digest is the one listed above.