Skip to main content
Ryoku’s security model is boring on purpose: everything you install is signed and verifiable, every update is reversible, and nothing on the machine talks to the network unless you tell it to. This page collects the guarantees and the exact commands to check them.

​
Signed releases

Every Ryoku ISO and every package in the [ryoku] repo is signed by the release identity Ryoku Releases <[email protected]>. The canonical public key lives in the repo at keys/ryoku-release-key.pub.asc, bound to git history, and ships alongside each ISO. The key fingerprint to verify against is:
Always compare the imported key’s fingerprint against the value above before you trust it. A signature only means something once you have confirmed the key that made it is the real release key.

​
Verify your download

Import the key, confirm its fingerprint, then verify the ISO against its detached signature and its checksum:
gpg --verify must report a good signature from the release identity, and sha256sum -c must print OK. If either fails, do not boot the image. The full walkthrough of what good output looks like is in Install.

​
Repo trust

The installer adds the [ryoku] repo and imports the release key from the ryoku-keyring package, which ships the key material into pacman’s keyring. From then on pacman verifies the signature on every [ryoku] package it installs or upgrades, so ryoku update only ever applies signed packages. You never have to re-import the key by hand. See Updates for where the packages come from.

​
Snapshots as a safety net

On a standard install (a btrfs root with snapper configured, which the ISO sets up) every ryoku update is wrapped in a pre/post snapshot pair. A bad update is never a dead end: roll back with ryoku rollback, and if the desktop will not come up, the same snapshots are selectable straight from the Limine boot menu. The full model — prerequisites, self-healing, and recovery — is in Updates.

​
Disk encryption

The installer offers optional LUKS full-disk encryption. Choose it on the disk step during the guided install and the backend sets up an encrypted root; the rest of the install proceeds normally. It is opt-in, so decide when you install. See Install.

​
Local-only Rashin

Ryoku’s agent OS, Rashin, is off by default and never leaves your machine when you do enable it: its daemon binds 127.0.0.1 only, rejects non-localhost WebSocket origins, and bundles no model of its own — you supply the provider. The knowledge vault it builds is plain markdown on your disk. See Rashin for the full picture.
Security-sensitive issues follow the project’s SECURITY.md, not the public issue tracker.

​
See also

Install

Verify and boot a signed ISO, and choose disk encryption.

Updates

Signed packages, snapshots, and rollback.
Last modified on July 4, 2026