The Ur Project

Documenting the craft of stacking things so they remain stacked. For a very long time.

The Ur Project is now live!

In the past day, we've posted everything you always wanted to make your own Linux Distribution:

Get it over at the downloads page!

The first "distro" that comes out of the build system is our rolling release. You can call this a "stream" or "flavor" or whatever you like. It is called Sandcastle. A Sandcastle is what you get when you graciously stack a lot of things in a very pretty way. But it's also temporary: A sandcastle needs rebuilding every day. This is fitting because Sandcastle is a rolling release model distribution. It updates as you go to "the latest stable" versions of everything.

The features worth mentioning

The Update Framework makes sure your device doesn't update against its own will into an unsafe device. It prevents and mitigates attacks like rollback and time skewing, forcing your device away from bad updates and making them refuse them. Packages are verified throughout, and keys are solidly kept under lock. Even if keys are compromised, TUF graciously handles revocation, allowing an escape from a lost root key or worse.

pkg-provenance(1) describes how anyone with an installed The Ur Project system can prove that what they have installed is exactly what you would get if you would recompile it yourself, bit-for-bit. This works right out of the box right now for all recipes in Common. If you're trying this on recipes from Base, wait a few hours until I have the bootstrap repositories synchronized out and special instructions for doing those 90 or so packages.

The Ur Project artifacts and all software used by it publish SBOM and CycloneDX records with all Downloads. You should never have to guess how anything is licensed. You should know. On any installed system, pkg-license(1) provides full SPDX for what you have installed, ready to read, inspect, or export into an SBOM record through JSON output.

This isn't a cool distro. But you could today make your own. The Ur Project is a full distribution build system that allows you to create your own compliance-first Linux OS. The build system deployment is documented in a short User Guide that shows how to start up and make your own first packages, and your own first image artifact. Secured with TUF, Reproducible, SBOMs included.

Those four are the tip of the iceberg. I've written about most of what sits underneath over the past weeks, so here is the trail of breadcrumbs, and it should tell you we mean business: malware scanned at ingest, CVE scans before acceptance, a human always decides, agents submit but never approve, no emacs until it reproduced, a bootstrap proven bit-for-bit, sources shipped in every repo, no epoch, and real rollbacks, unchanged content never downloads twice, intent instead of exploded lists, no post-install scriptlets, declarative recipes without macro languages, air-gapped updates over sneakernet, no telemetry, ever, and a debranded browser, AI disabled.

Under the hood

The Ur Project is built on Rust. Throwing out all the legacy baggage from other Linux OSs. That is by choice: The Ur Project is fast and easy to deploy, and has near zero dependencies to run. The package management requires only a single executable:

-rwxr-xr-x 1 root root 21M Oct 12 01:00 /usr/bin/pkg

On top of that - that binary now not only allows you to do basic package maintenance, it can also rebuild every package you need, or even build new packages. And it can build images and even do full system installs.

The dispatcher build system is trained to handle thousands of builds and can stage complex multi-hundred-package changes in a single transaction, so that each component is compiled to new dependencies before being accepted into production, taking the risk of large updates away entirely.

The composition layer is the same thing as the package management. The simplicity of this concept allows for all users everywhere to reproduce and make new artifacts, without a complex set up procedure. Just run pkg and you have a new image, freshly made.

By not relying on RPM as a packaging baseline, you are not ever going to be asked to accept a distro GPG key during an OS upgrade. The keys are rolled forward automatically, in a trusted way. And you can still decide to trust new repository sources if you want.

The Ur Project is rigorously tested. Right now, 4 systems are separately testing each update and change over and over. Every change gets built into a new image and put to the test. Not once, but several times. Each image is tested separately. There are currently 6 image types being published after every change when needed. 2 systems are continuously validating reproducible builds and making sure that they hold. Live USB images are installing into virtIO hard drives several times per image, and making sure the installed copies are good.

This testing-first approach means we don't just try and see if it works, we don't publish if it doesn't work. Full Stop. (Just like Clear Linux OS). Test failures are taken seriously.

Thanks for reading

We'll do a few basic wrap ups that are still needed in the next few days to deliver on our promises. But don't let that stop you from trying it out and telling me or anyone else how it went. Come chat on our Discord - link in community about what's going on and what we're going to focus on next, now that the builder and base OS (Sandcastle) are fully released.

--sofar (aka Auke)