| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| v1.0 | 2026-10-11 | ||
| README.md | 2026-10-11 | 1.5 kB | |
| gh0ul-signing-key.asc | 2026-10-11 | 4.0 kB | |
| Totals: 3 Items | 5.5 kB | 64 |
gh0ulOS
Arch-based offensive security. The OS installs with no network.
Download
Latest release: v1.0 (2026-10-11). Open the v1.0 folder.
- KDE Plasma: the only edition in 1.0. Bare metal or VM.
Verify before you boot
Every ISO is signed. Signing key fingerprint:
9CD7 FA21 BD2D 9A41 26A6 610E D1B7 8851 91B0 331D
Compare this fingerprint with the one shown at https://gh0ulos.com before you trust the key. A mirror can be tampered with. Two independent channels are much harder to tamper with together.
gpg --import gh0ul-signing-key.asc
gpg --verify gh0ulOS-1.0.iso.asc gh0ulOS-1.0.iso
sha256sum -c gh0ulOS-1.0.iso.sha256
What's inside
- The base system installs offline with Calamares. No network is needed for the OS itself.
- No security tools are baked in beyond the network basics (nmap, wireshark, tcpdump, netcat, socat, arp-scan).
- An on-demand tool catalog of 844 entries (763 installable), grouped into 30 menu categories. Tools install over the network when you pick them, so the menu fills as you install.
- The Necromancer Suite: 20 first-party tools, installed on demand.
- EndeavourOS / Arch base.
Updates
Arch and EndeavourOS packages update with pacman -Syu. gh0ulOS's own packages (theme, installer, keyring) come from the signed [gh0ul] repository, and the tool catalog refreshes with gh0ul-catalog sync. Both need the network.
Security report
Each release ships a CVE report for its package set as of build time. See the v1.0 folder.
