AstrOS | Blog

Breaking Change: Secure Boot - now with optional Microsoft key enrollment

Sun, 30 Aug 2026 00:00:00 GMT

From the beginning, AstrOS has shipped its own custom Secure Boot keys.

Until now, every device that wanted Secure Boot was required to enroll only our custom keys in the firmware. This prevented the use of Secure Boot on devices whose option ROMs were signed by Microsoft. As a result, many devices were unable to use Secure Boot with AstrOS at all. This has changed.

We now ship two prepared key sets under /boot/loader/keys/.

astros: just as before, containing only our certificates and nothing else.

astros+microsoft: containing our certificate plus Microsoft’s certificates added to KEK and db alongside ours.

Note that this doesn’t mean our boot chain is now signed by Microsoft. It only allows the firmware to boot Microsoft-signed software / option ROMs.

The user can choose which to enroll when booting from Setup Mode.

Learn more on our Secure Boot page.

Breaking change for steam-gaming extension users

Wed, 26 Aug 2026 00:00:00 GMT

Read me

Manual intervention required, your system won’t update if you don’t do this and have steam-gaming enabled!

you can ignore this if you don’t use steam-gaming

We now have a blog site

Fri, 07 Aug 2026 00:00:00 GMT

We now have a blog site! To make sure you don’t miss the latest AstrOS news, subscribe to our RSS feed.

Note: I’ve ported over the most important blogs from Reddit.

We now have a Waydroid extension

Mon, 03 Aug 2026 00:00:00 GMT

Docs: Waydroid

We are now in beta 🎉

Fri, 31 Jul 2026 00:00:00 GMT

Beta announcement video

What is AstrOS?

It is an immutable, secure-by-default Linux distribution based on Arch Linux and the COSMIC desktop environment. It uses similar tooling as GNOME OS and KDE Linux.

What makes AstrOS special is its immutable base, which is shipped as a hashed and signed /usr image that is booted by signed uki images. This combination protects your system from outside modification.

AstrOS base can be extended with currently four extensions (or your own). Including a steam gaming extension with the steamos gamescope session.

Technical details

Built using mkosi
Uses systemd-sysupdate (rollbacks too!)
Read-only /usr with signed dm-verity
Full disk encryption is enforced (tpm required)
Systemd-sysexts and confexts (system extensions)
Highly opinionated

Who is AstrOS for?

Anyone who wants a secure system out of the box without having to configure anything. It’s a system that just works, and you don’t have to worry about it.

What has happened since our first announcement

Restructured the codebase into mkosi subimages.
Four new system extensions (NVIDIA, gaming mode, virtualization, and Firewalld).
Migration to systemd-confext for /etc
Installer improvements (TPM2 check etc).
Display keymap list during first boot instead of entering it manually
Our own theme: Orbital
Many bug fixes
Safe mode uki profile
Package additions
Compressed images and a new download infrastructure
We moved from GitHub to Forgejo.
Our docs/homepage: https://astros-linux.org
And way more!

Goodbye Github! Welcome Forgejo

Thu, 30 Jul 2026 00:00:00 GMT

Our github repo now is a mirror

We believe that Forgejo aligns much more closely with our values of independence, and we are happy to announce that we have moved to it. To keep the barrier to contribution low, you can log in using your existing GitHub account, which makes account creation much faster and easier.

You can still make issues on GitHub, though we would prefer you to use Forgejo. Pull requests are forgejo only

Thanks!

Forgejo

Introducing System Extensions & Nvidia support

Fri, 17 Jul 2026 00:00:00 GMT

I‘m happy to announce that we got our first four system extensions.

Steam: this was our first extension introducing system-wide installed Steam and the gamescope session from the Steam Deck we all know and love.
Firewall: while this may get baked into the base image in the future, it is now possible to enable firewalld including a gui to configure it.
Virtualization: libvirtd & virt-manager. We don’t want to be another immutable distro not supporting a proper vm tool allowing gpu / USB passthrough, etc.
Nvidia: we now offer Nvidia drivers as a system extension. While I couldn’t test it myself due to me not owning any Nvidia GPU, this was reported as working.

But what are system extensions and why do they exist? System Extensions are our answer for programs that can’t easily be installed using flatpak or distrobox. While we want to keep our base unbloated and minimal, this allows us to deliver packages needing deeper system access to the users who need it.

How do I install them?

Take a look at our docs