Transparency

Where Cyclop OS packages come from

Two sources feed your computer: the Ubuntu archive for the base system, and our own repository for what we build. Here is exactly which server, who signs what, and how to check it yourself in a terminal.

Ubuntu packages: a university mirror, not Canonical

The base system comes from Ubuntu. Cyclop OS fetches it from the official Ubuntu mirror of RWTH Aachen University in Germany (ftp.halifax.rwth-aachen.de), a Tier-1 mirror that Canonical pushes to directly.

We do it so that your machine follows Ubuntu, security updates included, without asking Canonical's servers for packages. Canonical does not see your IP address or your package list.

Ubuntu's own signature still protects every package. Only the address changes, the key does not.

The package cyclop-os-default-settings rewrites Ubuntu's default addresses once, and keeps a copy of the original file in /var/lib/cyclop/apt-sources-backup/. If you prefer the original servers, create the file /etc/cyclop/keep-ubuntu-sources before the update, or put the addresses back by hand: any other choice you made is left alone.

Cyclop packages: our own repository

What we build ourselves comes from packages.cyclop-tech.com. Every repository is signed with the Cyclop OS package signing key, and your machine refuses packages that do not match it.

Signing key fingerprint

1721 69A9 2BB4 6E2E 0970 C29A CA7F F388 5ECB 073B

RSA 4096, valid until 21 September 2027. Public key: packages.cyclop-tech.com/cyclop-archive-key.gpg

Community is public, paid editions add repositories

The Community repository is open: anyone can read its index and download from it, without an account.

Each paid edition (Education, Pro, Gaming) unlocks one more repository, tied to your licence and to the device. Without a valid licence, the server answers "unauthorised". Every edition also keeps the Community base.

The source code

We publish the source of the packages we build, in the same repository as the binaries, so that you can rebuild them. That is what the licences ask for, and we prefer that you do not have to ask.

To fetch a source package, add a source line once, then use apt source. Example with the package alacarte:

Fetch a source package

sudo sh -c 'printf "Types: deb-src\nURIs: https://packages.cyclop-tech.com/noble/community\nSuites: noble\nComponents: main\nSigned-By: /usr/share/keyrings/cyclop-os-keyring.gpg\n" > /etc/apt/sources.list.d/cyclop-src.sources' && sudo apt update && apt source alacarte

The source packages are those of the Community repository. For anything you cannot find, write to opensource@cyclop-tech.com and we send the source that matches the version you received. The full list of components and licences is on the open source page. Open source components

Check it yourself

Four commands, no trust required.

Which server a package really comes from

apt-cache policy bash

The Ubuntu address in use

grep URIs /etc/apt/sources.list.d/ubuntu.sources

The Cyclop repository and its key file

cat /etc/apt/sources.list.d/cyclop.sources

The key fingerprint, to compare with the one above

gpg --show-keys --with-fingerprint /usr/share/keyrings/cyclop-os-keyring.gpg

On a paid edition, /etc/apt/sources.list.d/cyclop-edition.sources lists the extra repository.

Found a vulnerability, or want to verify the install image? Security and vulnerability reporting