Skip to content
Snigdha OSDecentralized

Release Distribution

Downloads & Cryptographic Verification

Snigdha OS Decentralized publishes signed ISO images, cryptographic checksums, detached OpenPGP signatures, SPDX 2.3 Software Bill of Materials, and SLSA v1.0 provenance attestations.

Public Release Published — v2026.11.13-rc1

Snigdha OS Decentralized 2026.11.13 Is Available for Download

The official ISO image was published on 2026-11-13 and is distributed from the project's GitLab release page. It ships with an OpenPGP-detached signature, signed SHA256SUMS and BLAKE2SUMS manifests, an SPDX 2.3 software bill of materials, and SLSA v1.0 build provenance. Verify the image before you boot it.

Download ISO (1.38 GB)Release PageVerification Guide
Published Release•Architecture: x86_64

Version 2026.11.13 (Release Candidate)

dm-verity Root AnchoredKernel: 6.18.62-1-lts
ISO Artifact

snigdhaos-decentralize-2026.11.13-x86_64.iso

1.38 GB (1,482,342,400 bytes)
Source Commit

cbc194bb31915289d37fa1a412c3945f3aef7835

ArchISO 92-1
Boot Mode Support
UEFISecure Boot UKILegacy BIOS
Supply Chain Security

SPDX 2.3 & SLSA v1.0

Attestations Generated
SHA-256 Checksum:
d478995adc24220c2995a78f7b0918f1c94b16d5af32e1ca141ddf9d1f65e197
Release Signing Key Fingerprint:
2BDB00AE6CABEF0E40520A8F553FD42B02A8211A

Key UID: Snigdha OS Release Signing (dev) <release-dev@snigdhaos.org>

Release Artifacts (GitLab release page)

snigdhaos-decentralize-2026.11.13-x86_64.isorelease-manifest.jsonSBOM.spdx.jsonprovenance.intoto.jsonl

Signed Verification Assets (mirrored on this site)

SHA256SUMSSHA256SUMS.sigBLAKE2SUMSBLAKE2SUMS.sigrelease-signing-key.ascrelease-key.fprsnigdha-secureboot-db.crt

Quick Verification in Terminal

Run these commands in any modern Linux terminal to verify integrity and signature:

Bash Verification Workflow
#1. Import and verify the official release key fingerprint
$curl -sO https://decentralized.snigdhaos.org/release/release-signing-key.asc
$gpg --import release-signing-key.asc
$gpg --fingerprint "$(cat release-key.fpr)"
$
#2. Confirm the fingerprint matches 2BDB 00AE 6CAB EF0E 4052  0A8F 553F D42B 02A8 211A
$
#3. Verify the signature over SHA256SUMS, then check the ISO against it
$curl -sO https://decentralized.snigdhaos.org/release/SHA256SUMS
$curl -sO https://decentralized.snigdhaos.org/release/SHA256SUMS.sig
$gpg --verify SHA256SUMS.sig SHA256SUMS
$sha256sum --check --ignore-missing SHA256SUMS
$
#Expected: snigdhaos-decentralize-2026.11.13-x86_64.iso: OK

Disclosure: metadata asset drift in this release

The ISO image, SHA256SUMS, and BLAKE2SUMS of this release are mutually consistent and correctly OpenPGP-signed. The release-manifest.json, SBOM.spdx.json, and provenance.intoto.jsonl files were re-uploaded after their detached signatures were produced, so those three detached signatures do not validate against the currently published files. For that reason this site mirrors only the correctly signed verification assets and links the metadata files to their canonical GitLab release page.

Bottom line: verify the ISO with the signed SHA256SUMS. If that check passes, the image you downloaded is byte-for-byte the image the project signed.

Release HistoryFull Verification Guide