A Linux that explains its lines.
Debian Linux, unchanged underneath. On top, a system assembled from a written specification where every package, file, service and firewall rule cites the requirement that put it there, is checked by a "doctor" after every install, and can be rebuilt byte for byte from one commit.
The anatomy of Zethro OSWhat you get
Six questions
Language, keyboard, disk, encryption, user, an optional SSH key. Nothing else. LUKS2 without a disk wipe; the install never touches the network; the image carries its own pool of packages.
Lynis 82 out of the box
AppArmor enforced, nftables with a denied default, no LLMNR, sysctl and mount hardening, fail2ban on the server, a locked screen on the desktop. Every setting is a rule with a reason; Debian's own files are never edited, only extended.
Checked after every change
zethro-doctor runs after install and after every update, thirty-odd checks mapped one to one to requirements, including memory and disk limits on the smallest supported machine.
With undo
zethro-update verifies the repository key before anything installs, refuses an update that would remove a package, records the versions it replaces, and reverses on --undo.
Same commit, same bytes
Two images built from one commit are identical, server and desktop. The package pool is pinned to Debian's signed index; the base image is fetched by signed checksum.
zethro why
Any file, package or port answers with the chapter, the rule, the commit and the increment. The specification ships on the machine.
A Debian that can account for itself
There are many good distributions built on Debian. We use them and we respect them. What none of them can do is tell you why a line is there. On Zethro, every package, file, service and firewall rule carries the requirement that put it in. Ask why, for any file, package or port, and you get the rule, the commit and the release.
And it keeps the record
A signed record says who changed what and when, a person or an agent, and you can ask the same question of anything an agent did on the machine. Updates can be undone, and two builds of one commit give the same bytes, so the record can be checked, not trusted. That is the one thing we add, and nobody else has it today. An auditor's dream; a user's right.
Two editions
Server
Base system, SSH, nftables, fail2ban, unattended security updates, sysstat, zsh with a plain prompt. 384 MiB of memory at idle on the smallest supported machine; 2.2 GB on disk. For hosts, build machines and anything that runs Zethro Core.
Desktop
Xfce with the Zethro layout and theme, Inter and JetBrains Mono, Lite XL, Zig, Starship, light-locker, NetworkManager with netplan migration of static addresses. 800 MiB at idle; 4 GB on disk. For engineers who want a quiet machine that explains itself.
Both editions share one specification, one package pool and one doctor. Zethro OS runs without Zethro Core; Core installs on the server edition as one package.
How it is tested
Every candidate image is installed and verified automatically before it can become a release, on both editions, UEFI and BIOS, small and large memory, encrypted and plain, DHCP and static, fresh installs and updates from the previous release, with screenshots of the graphical installer. A run is red if one machine is. A quick set runs on every change.
Specification
Eleven chapters, each rule numbered. A change starts here.
Tests first
The test is committed before the code and must fail first.
Lint
A line without a rule to cite does not pass. No tool, budget or host name in the tree.
Evidence
Every increment leaves a file of commands, outputs, measurements and deviations.
Download
Images are published per version and never replaced. Verify the checksum file's signature with the Zethro release key before writing a stick. Run sqv --keyring zethro-release.asc SHA256SUMS.sign SHA256SUMS, then sha256sum -c SHA256SUMS. Write with dd or any raw image tool. UEFI with Secure Boot and legacy BIOS are both supported.
Server 1.0, amd64
Hybrid ISO, about 970 MB. Text installer, six questions.
zethro-os-1.0-server-amd64.isoSHA256SUMS · SHA256SUMS.signDesktop 1.0, amd64
Hybrid ISO, about 1.4 GB. Graphical installer, six questions.
zethro-os-1.0-desktop-amd64.isoSHA256SUMS · SHA256SUMS.signRelease key
Ed25519 OpenPGP. Fingerprint printed in the release notes and on the installed system in /usr/share/keyrings/zethro.gpg.
Mirrors
| Region | Host | Protocol | Carries |
|---|---|---|---|
| Primary | repo.zethro.pro | https | images, packages, keys |
| Europe | mirror announced at launch | https, rsync | images, packages |
Images, checksums and the repository open on 1 December 2026. Release 1.0 is in its final verification on physical hardware.
Repository
An installed system updates from the Zethro repository through zethro-update. To add it to a plain Debian machine, run the following.
curl -fsSLO https://repo.zethro.pro/zethro-keyring_1.0_all.deb
sha256sum -c zethro-keyring.sha256 # from the release notes
sudo dpkg -i zethro-keyring_1.0_all.deb
sudo apt update && sudo apt install zethro-setup zethro-doctor zethro-update