Two ISOs

v111.0.0 · Last Light · the OS has a pulse

Two images.
One fire.

One Rust-for-Linux kernel, one Rust userspace, one GRIMOIRE engine — split into distinct images by a build-time Curtain and a runtime capability ceiling. Pick the way in that fits you.

arch x86-64kernel Linux 7.0 · Rust write to USB ≥ 8 GBboot UEFI

Choose your image ↓

Choose your image

// same codebase — the Curtain. keeps each image in its lane; the free tiers can never escalate to the licensed one.

PublicFree · Beta

GRIMOIRE

Learn to hack. For real — a shared-world hacking MMO where the exploit is the objective.

117 labs across 13 categories — pre-bundled, unlock by progression
Faction wars: Crimson Spire · Neon Collective · The Warden
Cert paths: eJPT · OSCP · OSEP · GIAC · CEH
ALFRED GameMode · sandboxed · optional AI-research unlock late-game

synos-grimoire-v111.iso · x86-64 · UEFI

Coming soon→

Enterprise◆ By contract

Enterprise Edition

Not a download. Enterprise images are scoped and built per contract for teams and regulated environments — tell us what you need.

Full ALFRED v6.0 · full AI cortex + dispatch, at organizational scale
Multi-tenant ARCANUM federation + fleet management
FedRAMP Moderate · CMMC L2 · SOC2 control mappings authored — no formal audit or ATO performed
No generic image, no self-serve download — every build is tailored to the engagement

✉ contact sales · not a current self-serve offering

⛧ Church of Malware · Beta Access

Enter through the Church.

A community edition forged with the Church of Malware. Verified members boot green-on-black into the CoM faction — a baked-in loadout, an XP head-start, and member-exclusive labs the public build never sees. This is the soft-launch door for public beta.

// code is scripture · exploitation is sermon · members only

Request CoM Beta Access→

membership is audited by the Church — access is device-bound and single-use

1Request access through the Church of Malware at churchofmalware.org
2Get verified — your role is audited to confirm membership
3Once verified, you're issued a single-use /claim code
4Redeem with synos-claim <code> and boot your token-gated beta

Every image is signed.

Reproducible from source, cosign-signed, and logged to a public transparency record. Cross-oracle verification lands once the second build oracle is provisioned. Trust the fire, verify the ash.

SHA-256 per image SLSA-3 provenance cosign + Sigstore Rekor CycloneDX SBOM

verify.sh

# confirm the ISO is the one we built
$ cosign verify-blob \
    --certificate synos-grimoire-v111.iso.cert \
    --signature   synos-grimoire-v111.iso.sig \
    synos-grimoire-v111.iso
Verified OK  — logged in Sigstore Rekor
$ sha256sum -c synos-grimoire-v111.iso.sha256
synos-grimoire-v111.iso: OK

System requirements

Component	Minimum	Recommended
CPU	x86_64 (Haswell+), 2 cores	4+ cores, AVX2
RAM	4 GB	8+ GB (16 GB for AI workloads)
Storage	32 GB	64 GB SSD
Firmware	UEFI w/ SecureBoot optional	UEFI + TPM 2.0 (for Curtain v4 attest)
GPU	Optional (Vulkan for Bevy)	Discrete GPU for local LLM inference
Network	Optional	Tailscale-capable (ARCANUM mesh)

Verification (when ISOs publish)

All public ISOs are signed and reproducible:

Cosign + Sigstore Rekor transparency log entries (v48 Forge)
SLSA-3 provenance generated by slsa-github-generator in release-publish.yml
SOURCE_DATE_EPOCH propagation, deterministic squashfs, sorted tar/mksquashfs, pacman snapshot pin — a bit-for-bit reproducible build pipeline
SHA-256 checksums + CycloneDX SBOM published alongside each ISO
GPG-signed release manifest

The synos-rebuild-verify.sh script rebuilds a release ISO from source and confirms the digest matches. Cross-oracle verification — rebuilding on genuinely independent hardware — lands once the second build oracle is provisioned; today’s pipeline runs on a single oracle.

Stay updated

Star the GitHub repository to be notified when public ISOs cut.