Install

Two ways in: a USB ISO of Unwoke (empty disk, no stock secureblue first), or a rebase if you already run Fedora Atomic / secureblue. After either path, their post-install still applies.

Empty-disk USB encrypts by default (stock Anaconda leaves the box unchecked). You can still untick Encrypt. LUKS uses a 2 GiB Argon2id memory cost so a stolen disk is harder to crack than stock’s installer default. The live installer talks NTS time (not fedora NTP in the clear).

Checking last green…

Pick an image

Three questions. Same twelve images as before — you do not have to name them.

Desktop
GPU
House browser

Image: unwoke-silverblue-trivalent

You are installing from
All twelve names

Empty disk: Unwoke USB ISO

This wraps the GHCR image you picked. You do not install stock secureblue first. GitHub will not host a ~4 GB file as a normal release, so the ISO lives as a GHCR package plus a 90-day Actions download. The live Anaconda installer is dark Unwoke navy. Search or the dash: Install Unwoke SecureBlue (stock hides that icon). The OS rebase path below has no Anaconda. How the baker sits on a clock: Factory.

Checking whether a USB ISO was published…

  1. Get an ISO:
    • When a wrap is green: pull ghcr.io/sergi270710267/<name>-iso:latest (box above) or download the Actions artifact (GitHub login, 90 days).
    • Any flavor, on demand: GitHub → Actions → iso → Run workflow → pick the same image as above.
    • Recommended Trivalent sticks (GNOME + KDE, no NVIDIA): wrapped after each green overlay bake. Same cosign verify of our :latest.
    • All twelve flavors, weekly (Sunday 10:00 UTC): Trivalent, Origin, and browserless × GNOME/KDE × NVIDIA/not. Origin and the other ten stay weekly on purpose. Clock and alarms: Factory.
  2. Pull with oras (Linux/macOS) when the package exists:
oras pull ghcr.io/sergi270710267/unwoke-silverblue-trivalent-iso:latest
cosign verify --key cosign.pub --insecure-ignore-tlog ghcr.io/sergi270710267/unwoke-silverblue-trivalent-iso:latest
cosign verify-blob --key cosign.pub --insecure-ignore-tlog --signature SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS
  1. Flash with Rufus. Not Ventoy.
  2. Boot, install, encrypt the disk, join wheel. Enroll the secureblue Secure Boot key when prompted — the kernel is still theirs.
  3. After the first boot, wait for the signed deployment (rpm-ostree status) and reboot once more. Same as the rebase path.

Enable Secure Boot, update the BIOS, and set a BIOS password if you care about that threat model — same advice as their install page. The live USB session is for install; the installed system is the signed Unwoke image.

Already on Atomic: rebase

This switch cannot check our stamp yet (your PC does not have our key):

rpm-ostree rebase ostree-unverified-registry:ghcr.io/sergi270710267/unwoke-silverblue-trivalent:latest
systemctl reboot

Signed deployment

After that reboot, a first-boot service queues the signed image. Reboot one more time when rpm-ostree status shows a staged signed deployment (or after a few minutes on the network). From then on, updates must match our cosign.pub.

If it did not auto-stage (no network on first boot):

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/sergi270710267/unwoke-silverblue-trivalent:latest
systemctl reboot

Empty disk via stock ISO

Still valid: flash a secureblue ISO, encrypt, enroll their key, then rebase. Use this if you want their installer and do not want to wait for an Unwoke ISO build.

After install

You logged in. Do not open GNOME Settings looking for a store. Walk After you log in once — Unwoke setup, signed reboot, daily user, leftover stock. Command dump: Post-install. Their page only (mirrored daily): secureblue/post-install.

After you log in

Same later: app grid → Unwoke setup, or ujust setup. If Bluetooth, Flathub, brew, webcam, WebGL, or the greeter is “broken,” it is a default lock — ujust why.

ujust setup
ujust why
ujust unwoke-status
ujust audit-unwoke
ujust set-flathub verified      # Flatpak remote (off by default)
ujust set-bluetooth on          # Wi-Fi is not touched
ujust set-toolbox on            # toolbox + distrobox
ujust set-extra-daemons on      # Avahi + ModemManager
ujust set-brew on
ujust set-camera-mic on
ujust set-brave-bubblejail off  # if Origin has no GPU
ujust set-trivalent-network-sandbox off  # if Trivalent clears cookies
ujust set-allow-browsers on ALLOW   # browserless only

Verify an image

cosign verify --key cosign.pub ghcr.io/sergi270710267/unwoke-silverblue-trivalent