Security, stated plainly.

How releases are signed, how to report a problem, and — the part most pages leave out — what we have not yet proved. If you are evaluating Dagric for a machine that matters, read the last section first.

Reporting a vulnerability

Send it through the contact form and choose Security as the topic. It reaches a person, not a queue. Please include what you found, how to reproduce it, and the edition and version you were running (cat /etc/os-release on the machine).

We will confirm we have it, tell you whether we can reproduce it, and tell you what we intend to do and roughly when. If a fix ships, it goes out through the update channel and is described in the release notes on News. If you would like credit, say so and you will get it; if you would rather not be named, that is fine too.

Please give us a reasonable chance to fix an issue before publishing it. We will not threaten anyone for reporting a problem in good faith, and we will not ask you to sign anything to tell us about one.

Verifying a release

Every release is signed with the same OpenPGP key. Its fingerprint is:

3A07 9F85 DE74 375D D655  5709 6CE3 7402 BA0A 0EF8

Check that fingerprint against this page before you trust an imported key — a signature is only worth as much as your confidence that the key is ours. The same key signs the checksums for the disc images and the update channel.

gpg --import dagric-signing-key.asc
gpg --fingerprint 3A079F85DE74375DD65557096CE37402BA0A0EF8
gpg --verify SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS

Files: SHA256SUMS · SHA256SUMS.sig · signing key. The full instructions, including the Windows path, are on the download page.

How security updates reach your machine

Debian's security updates are downloaded and installed automatically, in the background, on a daily timer. Nothing restarts your computer to do it. If an update needs a restart to take effect — in practice that means a kernel update — you get one quiet message the next time you sign in, and nothing more.

Dagric's own security baseline updates itself the same way. Everything else we publish — the tools, the wallpapers, the desktop defaults — waits for you to click Update in Discover, because those change how your machine looks and behaves and you should be the one to decide when that happens.

The update channel is served over HTTPS and every package in it is signed with the key above. Your machine is configured to trust that key for that one repository only, not for anything else it might download.

What we have not proved

This is a young product. The list below is what we know is unproven or imperfect today. We would rather you read it here than discover it yourself.

Not yet tested on real hardware

These ship and are expected to work; they have been exercised in virtual machines, not on physical machines with enforcing firmware:

• Secure Boot with enforcing firmware. The signed shim chain is on the media and boots correctly in UEFI virtual machines. It has not been booted on a retail machine with Secure Boot enforced.
• Full-disk encryption. The installer offers it and the components are present. The install-and-reboot path has not been walked end to end, including with a non-US keyboard layout at the passphrase prompt.
• The screen reader. Orca is installed and reachable from the live session, and our accessibility report is a self-assessment. No pass has been made with the mouse unplugged against a live accessibility bus.
• Wi-Fi and graphics breadth. There is no published hardware compatibility matrix. Check This PC, on the live USB, is the honest answer for your particular machine — run it before you install.

Known weaknesses

• The application firewall's control socket (Pro). OpenSnitch, on the Pro edition, uses its upstream default socket location in /tmp. On a computer with more than one ordinary user account, a second local user could occupy that socket before the real interface does, and would then see connection events and answer the prompts the firewall acts on. On a single-owner machine there is no second unprivileged user and this does not arise. We have not changed it yet because both real fixes need per-machine key material or a per-user path, and an unverified change here fails silently in the direction that leaves you with no firewall at all — which is worse. It is on the list, and it needs a test on a booted machine before it moves.
• Some AppArmor profiles only log. Dagric installs Debian's apparmor-profiles sets. Most of those profiles enforce; around forty ship from Debian in complain mode, which records a violation rather than blocking it. Most of them cover software this image does not install, so they are inert either way. This is Debian's own packaging default, not a Dagric setting, but "AppArmor is enabled" is worth this footnote.
• No third-party audit. Nothing here has been reviewed by an outside security firm. The accessibility report is a self-assessment and says so, and this page is the same kind of document.

“No telemetry” does not mean “no network”

Dagric adds no operating-system telemetry, analytics or crash reporting to us. That commitment is narrower than "this machine never talks to anyone": it checks for updates, fetches firmware metadata, your browser contacts its own services, and phone pairing announces the computer on your local network so your phone can find it. Website visits, checkout, downloads and support messages are separate from installed-system telemetry and are disclosed on the privacy page. That page also lists every outbound connection the system makes on its own, what each is for, and how to switch it off.

What an antivirus scan of the disc image proves

Less than people expect, and it is worth saying so. A Windows antivirus scan of an ISO will read the archive and find no Windows malware, which is a true result and a narrow one: it is not an audit of several thousand Linux packages, and a clean scan is not evidence that every script and binary inside behaves. What actually protects you here is that the contents come from Debian's signed archive, that the image you download is the one we built (verify it, above), and that you can inspect the running system yourself.

If you are evaluating Dagric

Test it in a virtual machine or from the live USB first, on a machine you can afford to reinstall. That is not modesty about this product in particular — it is what anyone should do with any operating system they have not run before, and it is what we would do. The reviewer's guide sets out how to test it properly and what to look at.

Download Dagric OS Report something