Secure Boot
OnStarts with Microsoft-trusted boot files on any PC that requires Secure Boot. A guard stops a boot loader update that your PC's firmware would refuse, so an update can never leave the PC unable to start.
Security
Protected from the first boot, without asking you to configure anything.
Metricito OS is built on Debian 13, whose security team patches thousands of packages within days. We add Secure Boot that keeps working, a signed channel for our own software, and defaults that stay safe. Here is what is in place and what comes next.
In place today
On by default, every install.
Firewall
OnIncoming connections are blocked unless you allow them.
AppArmor
OnApps that have a profile are confined to the files and actions they need.
Automatic security updates
DailyDebian security fixes install by themselves every day, at low priority, with a snapshot of the system taken first.
Signed updates for our own software
LiveThe desktop and our own packages update from a channel signed with a key kept offline; Metricito Office joins it next. Signatures expire after 60 days, so an old copy of the channel cannot hold back fixes.
Safe documents
OnOffice macros run only from documents signed by someone you trust.
No telemetry
OnNothing reports home. Apps that collect usage data by default ship with it turned off.
Hardware protections kept
OnCPU vulnerability mitigations stay on. No security feature is switched off for speed.
Next
What we are adding before the first release.
| Disk encryption | An encrypt-this-disk option in the new installer |
|---|---|
| Updates for every app | Metricito Office, Discord, Heroic and Wave Terminal updated through the signed channel |
| Vulnerability checks | Every image checked against known vulnerabilities before release |
| Security advisories | A published advisory for every fix to our own software |
| Verified downloads | ISO checksums signed with the update channel's key |
| Memory-safe tools | sudo-rs and ntpd-rs, Rust replacements for sudo and time sync |
Metricito OS is in development and has not been independently audited.
Signing key
Check what you install.
Updates from updates.metricito.com are signed by this key. Its primary part never touches a networked computer.
| Fingerprint | 592E 8F89 865C 2520 C670 7DE3 4B31 99DA 2181 C793 |
|---|---|
| Valid until | 10 October 2031 |
| Public key | metricito-archive-key.asc |
Download images only from this site. From the first release, each ISO comes with a SHA256SUMS file signed by this key: check it with gpg --verify SHA256SUMS.asc, then sha256sum -c SHA256SUMS.