// docs

Building the ISO

The whole ISO comes from a single script, build.sh, which produces a hybrid image (BIOS + UEFI) ready to write to a USB stick.

Requirements

A Linux system with root: Ubuntu 24.04 or Debian 12. On Windows, use WSL2 or a virtual machine.
An internet connection to download the packages.
Several GB free for the working system (work/).

sudo apt install debootstrap squashfs-tools xorriso grub-pc-bin grub-efi-amd64-bin mtools

Building

From the OS folder:

sudo ./build.sh                 # Debian bookworm base (default)
sudo BASE=ubuntu ./build.sh     # Ubuntu noble base (the tested one)

Output in out/:

redderos-<base>-amd64.iso: the image.
redderos-<base>-amd64.iso.sha256: its SHA-256.

What the script does

Base system. debootstrap creates a minimal system (--variant=minbase) in work/rootfs. If it already exists, it is reused.
Overlay. Copies overlay/ over the root: firewall, Tor, sysctl, systemd and RedderOS's own scripts.
Chroot. hooks/chroot.sh installs the kernel, the live system and the packages in config/packages.list; configures language and keyboard (Spanish), the desktop, users and services, and regenerates the initramfs.
squashfs. Compresses the root with xz.
GRUB. Fills in config/grub.cfg with the hardening parameters and generates the md5sum.txt and sha256sum.txt checksums for every file.
ISO. grub-mkrescue creates the image (label REDDEROS) and its SHA-256.

Variables

Variable	Default	Purpose
`BASE`	`debian`	`debian` or `ubuntu`.
`SUITE`	`bookworm` / `noble`	Release of the base distribution.
`MIRROR`	`deb.debian.org` / `archive.ubuntu.com`	Package mirror.
`KERNEL_PKG`	`linux-image-amd64` / `linux-image-virtual`	Kernel package. On Ubuntu, `linux-image-generic` for real hardware.
`WORK`	`./work`	Working folder.
`ISO_NAME`	`redderos-<base>-amd64`	ISO name, without extension.
`GRUB_DEFAULT`	`0`	Default GRUB entry (`3` = self-test).
`ISO_ONLY`	—	With `1`, reuses the already configured root and only regenerates the image.

Examples:

# Ubuntu with drivers for real hardware
sudo BASE=ubuntu KERNEL_PKG=linux-image-generic ./build.sh

# Regenerate only the image after changing grub.cfg
sudo BASE=ubuntu ISO_ONLY=1 ./build.sh

Customising

Packages: add or remove lines in config/packages.list (lines starting with # are ignored).
System files: anything you put in overlay/ is copied as is over /.
Boot menu: config/grub.cfg. @LIVE@, @BOOT@ and @HARDEN@ are substituted by the script.
Profiles: the number of slots and the Argon2id cost are in overlay/etc/redderos/profiles.conf.

Writing and testing

sudo dd if=out/redderos-ubuntu-amd64.iso of=/dev/sdX bs=4M status=progress conv=fsync
qemu-system-x86_64 -m 3G -enable-kvm -cdrom out/redderos-ubuntu-amd64.iso

Before publishing an ISO, run the self-test: see Self-test.