Hardened LFS factory
A Linux distribution built from source, hardened and tested.
Linux From Scratch 13.1 (systemd), built by a GitLab factory: every package from a pinned, verified source, every image booted and tested before it is published.
What it delivers today
- Every source pinned by its checksum, verified, and kept in the factory's own repository: a build never depends on the internet.
- A hardened Linux 6.18 kernel: lockdown in confidentiality mode, no loadable modules, a reduced attack surface.
- The kernel checked on every pipeline against the KSPP, CLIP OS and GrapheneOS recommendations; every gap is a written exception with its reason.
- Every image booted and tested: the kernel's own selftests, and LKDTM, which crashes the kernel on purpose to prove its protections.
- One package changed, one package rebuilt: a change reaches a tested image in minutes.
Where it stands
Built, booted and tested today. The next phases harden the system around the kernel.
- SELinux enforcing, a firewall that drops by default, and a read-only, verified root.
- Signed images, Secure Boot and a software bill of materials.
- Deployment from the internal developer platform, on Incus first.