FAQ

Why does AstrOS require a TPM2?

Because the security model doesn’t work without one. /usr is signed and read-only, booted by signed, measured UKIs. The TPM is what checks that chain. Your disk key is sealed to the boot measurements (PCR11), so the system unlocks only if it booted exactly the images we signed.

How do I dual boot?

You can’t officially. It may or may not be added in the future.

I have an nvidia gpu. Can I use AstrOS

You can install nvidia drivers as a system extension.

Make sure your nvidia gpu supports the open kernel modules.

How do I enable a firewall?

You can install firewalld as a system extension.

Is AstrOS the right distro for me?

AstrOS is a strongly opinionated project. Due to its image-based nature, it isn’t really for tinkerers. It is for those who want a secure, encrypted, and signed operating system that just works with minimal effort.

How to enable secure-boot?

To ensure real security, we don’t ship Microsoft’s secure boot keys. Therefore, to enable Secure Boot, the device must be in Setup Mode. Once it is, you can enroll our own keys in the Systemd-Boot menu.

Caution

Some hardware requires its own/Microsoft’s key to work with Secure Boot enabled. Firmware may not be able to load which can soft-brick your machine or disable display output, leaving you unable to see the UEFI settings menus and revert these changes. In that case you will need to reset your computer’s UEFI or re-flash it from a bricked state. If you have such hardware, we recommend not using Secure Boot at all, which is fine because AstrOS is pretty much tamper-proof anyway due to its verified and signed nature.

What is Safe Mode?

Safe mode starts your system with all system extensions disabled. In the worst-case scenario, where a system extension prevents your system from booting at all, safe mode lets you boot up and so you can disable the extension. In such cases, please report the extension responsible.