gh0ulOS 1.0 (2026-10-11)

Edition

• KDE Plasma: the only edition in 1.0. Bare metal or VM.

File: gh0ulOS-1.0.iso (5435801600 bytes, 5.1 GB).

Verify before you boot

Signing key fingerprint:

9CD7 FA21 BD2D 9A41 26A6  610E D1B7 8851 91B0 331D

Compare it with the fingerprint shown at https://gh0ulos.com before trusting the key.

gpg --import gh0ul-signing-key.asc
gpg --verify gh0ulOS-1.0.iso.asc gh0ulOS-1.0.iso
sha256sum -c gh0ulOS-1.0.iso.sha256

SHA-256:

922038f1e29fc5f061637c0f056ea5a78082f835e871a0cc0d481736f0451dae

What's inside

• The base system installs offline with Calamares. No network is needed for the OS itself.
• No security tools are baked in beyond the network basics (nmap, wireshark, tcpdump, netcat, socat, arp-scan).
• An on-demand tool catalog of 844 entries (763 installable), grouped into 30 menu categories. The menu fills as you install tools, and installs need the network.
• The Necromancer Suite: 20 first-party tools, installed on demand.
• 1355 packages in the image. The full list is gh0ulOS-1.0.iso.pkgs.txt in this folder.
• EndeavourOS / Arch base.

Security report (CVE)

The CVE report covers all 1355 packages in the image, checked against the Arch Security Tracker on 2026-10-11. No package is behind a released fix. 17 packages have no upstream fix yet: 4 High (djvulibre, grub, libxml2, pam) and 13 Medium. It lists no Critical or Low findings. The full report is cve-report-v1.0.txt in this folder. It is a build-time snapshot and does not track later fixes. It does not cover gh0ul first-party or AUR-sourced packages.

Known issues

• Not yet tested on real hardware. The install has been run in a VM harness only; the ThinkPad X230 install and boot check is still open.
• Secure Boot is not supported.
• Installing tools and updating gh0ul packages needs the network. The [gh0ul] repo and tool catalog are hosted on GitHub Releases.
• Some catalog tools are incomplete or fail to install: crosslinked fails to build, and the Necromancer tool oracle fails on Python 3.14. wraith, doppelganger and reaper are scaffolds, and ouija is pre-v0.1.
• Tools that exist only in BlackArch install per user into ~/.local. They need the network and are not tracked by pacman.
• The installer icon is still the EndeavourOS logo.

Updates

Arch and EndeavourOS packages update with pacman -Syu. gh0ulOS's own packages come from the signed [gh0ul] repository, and the tool catalog refreshes with gh0ul-catalog sync. Both need the network.