ZypherOS Kinetic

Kinetic is the desktop edition of ZypherOS, an agentic Linux distribution from Zypher Systems, based on Fedora Linux 44 with the COSMIC desktop.

Status: 0.6.0 is the current release: Kinetic on the COSMIC desktop, with 0.2.0 "Daily driver"'s security defaults and proven updates and rollback (test log). The ISO is attached to each release. Systems installed with Plasma move with this guide.

What it is

• Fedora 44 + COSMIC, mutable. dnf works as usual. btrfs snapshots are the safety net: every update can be rolled back (how).
• Agents are part of the OS. Claude Code, OpenCode, Grok Build, Codex, Gemini CLI, and Copilot CLI are ready to run and install from their official sources on first launch. VSCodium, Cursor, and Grok Bot come as standard. A system agent that helps manage the machine is planned after the first release.
• A developer workstation out of the box. Docker, Podman, distrobox, KVM with virt-manager, fish + starship, Ghostty, and Chromium, with Podman Desktop and DistroShelf to manage containers and distrobox boxes.
• COSMIC, set up the Kinetic way. System76's COSMIC desktop with Kinetic's dock, shortcuts, and look. Kinetic used KDE Plasma through 0.3.0; moving an installed system needs no reinstall.

See docs/roadmap.md for where Kinetic is headed and what 1.0 means, docs/decisions.md for what has been decided so far and why, docs/security.md for what Kinetic does to keep a machine safe by default, and docs/recovery.md for undoing updates and recovering a machine that won't start.

Building

On Fedora 44:

./scripts/build-rpms.sh             # no root: build Kinetic's own packages into out/repo
./scripts/check-description.sh      # no root: validate the image description and resolve packages
sudo ./scripts/build-iso.sh         # build the ISO into out/ (installs kiwi on first run; see note)
./scripts/vm.sh start               # boot it in a UEFI + Secure Boot VM, with a virtual disk to install to

Kinetic lives on codevault, Zypher Systems' Forgejo, with a read-only mirror on GitHub. Its Forgejo Actions workflows do the publishing:

• Packages, whenever packages change on main: built in a Fedora 44 container, signed with the ZypherOS key (fingerprint 098E 710A DBE3 FEE4 351B 44F4 0EE4 C89F 7AE0 182E), and uploaded to codevault's RPM registry at codevault.sh/api/packages/zypher-systems/rpm/fedora-44, which installed systems update from. To publish a change to a package, bump its Release.
• ISO, when a version tag is pushed: builds the ISO and attaches it, its SHA-256 checksum, and the checksum signed with the ZypherOS key to that tag's release (as a draft if the release doesn't exist yet).
• Upstream updates, every Monday: checks the apps Kinetic repackages (Podman Desktop, DistroShelf, forgejo-cli) for new releases, and for each one pushes a patch branch from dev with the spec updated, once it builds, and opens an issue to review it.

Packages and ISO need the repository secret RPM_SIGNING_KEY (the ZypherOS private key). The Packages workflow also needs PACKAGES_TOKEN, a codevault token with package write access, because codevault doesn't let a workflow's own token publish packages; the ISO workflow uploads with its own token.

SELinux note: kiwi's SELinux policy (kiwi-selinux) blocks rpm 6 from running package user/group scriptlets during the build. build-iso.sh makes only kiwi's kiwi_t domain permissive while it runs and restores it afterwards, even if the build fails. The rest of the system stays enforcing.

Repository layout

Path	Purpose
kiwi/Kinetic.kiwi, kiwi/kinetic/	Kinetic's kiwi image description
kiwi/fedora/	Fedora's kiwi descriptions, vendored unmodified (GPL-3.0; see its SNAPSHOT)
kiwi/config.sh	Runs inside the image during the build: Fedora's config, then Kinetic's
packages/	Kinetic's own RPMs: identity, logos, wallpaper, defaults, and apps upstream doesn't package as RPMs
branding/	Source artwork (all rights reserved; see branding/COPYING)
scripts/	Build, check, signing-key, and VM test scripts
containers/builder/	Rootless container used by check-description.sh
docs/roadmap.md	Releases, and what 1.0 means
docs/decisions.md	Decisions made so far, alternatives considered, open questions
docs/security.md, docs/recovery.md	Security defaults; undoing updates and recovery
docs/moving-to-cosmic.md	Moving a system installed with Plasma to COSMIC
import/devbox/	Raw configs and wallpaper from the reference dev machine, source material for Kinetic's defaults

License

The code in this repository is released under the MIT License, except kiwi/fedora/, which is Fedora's work under GPL-3.0-or-later.

The Zypher Systems and ZypherOS names, logos, and wallpapers are trademarks of Zypher Systems and are not covered by the MIT License.

Kinetic is based on Fedora Linux. Fedora is a trademark of Red Hat, Inc. This project is not affiliated with or endorsed by the Fedora Project or Red Hat.