lintel

In active development

A modern Linux distribution
built for the next decade — not the last.

Lintel is a Linux distribution focused on modern hardware, thoughtful engineering, and maintainable architecture. Built from scratch for x86-64-v3, with Rust-first tooling, clean boot paths, and sane defaults baked in. We embrace what's actually possible today instead of carrying legacy complexity forever.

We build in the open — carefully. Repositories are live, the toolchain works, and a public release is coming when it meets our standards.

Join #lintel on Libera.Chat

Origin

Lintel's creator has been building custom distributions since the early 2000s — starting with Gentoo, moving to Linux From Scratch, learning how operating systems actually fit together in the process. The result: a deep conviction that systems should be built from exactly what's needed and nothing else.

This is that project, finally done the way it was always meant to be.

Inspired by

Lintel doesn't invent from nothing. It draws deliberately from three operating systems that got foundational things right — two Linux distributions and one BSD — and combines their best ideas into one coherent system of its own.

  • Arch Linux

    A rolling-release model, pragmatic minimalism, and a package build system in the same spirit as pacman and PKGBUILDs — plus the Arch Wiki's ethos that documentation should be precise enough to trust.

  • Gentoo

    A source-first ports tree, tiered package builds, and aggressive CPU-targeted optimization — Lintel builds exclusively for x86-64-v3 rather than the lowest common denominator.

  • FreeBSD

    A strict, disciplined separation between base system and ports, careful release engineering, and a filesystem layout that takes subvolumes and snapshots seriously by default.

Engineering principles

These aren't vague values — they're specific, opinionated calls we've already made about the platform. Lintel picks one good way to do each thing instead of supporting every way.

  • x86-64-v3, no compromise

    The flagship build targets x86-64-v3 exclusively — AVX2, FMA and BMI2 everywhere, AVX-512 only where code picks it at runtime. No -march=native guesswork, no quietly downgrading the whole distribution to satisfy hardware from a decade ago. Other architectures may come later, but the baseline they'd join is a modern one, not the reverse.

  • Wild linker by default

    Lintel is targeting the Wild linker as the system default wherever the package set is ready for it — faster, more parallel links and a more modern toolchain experience out of the box, not as an opt-in developer trick.

  • One boot path

    UEFI, GPT, systemd-boot, and signed Unified Kernel Images. No GRUB, no legacy BIOS, no CSM fallback path to maintain. Committing to one boot chain means Secure Boot and TPM2 unlock are treated as first-class, not bolted on.

  • Btrfs with real defaults

    A subvolume layout (@, @home, @var, @log, @cache, @snapshots) and a snapshot/rollback workflow ship on day one — you shouldn't have to design your own filesystem topology just to get safe upgrades.

  • Rust-first, deliberately

    Every Lintel-owned tool — build orchestration, the package index, release management, the installer, inky and quill — is Rust by default. Shell stays limited to tiny, obvious glue; nothing state-bearing or security-sensitive gets written as a script.

  • Modern crypto and compression only

    Network-facing services ship modern-algorithm defaults, not legacy fallbacks kept "just in case." Package and image compression is benchmarked and centrally set, not left to whatever a given PKGBUILD felt like using in 2015.

  • Reproducible, provenanced builds

    Every package and image carries an SBOM, a signature, and a recorded builder digest. Reproducibility is a release gate, not an aspiration.

  • Fully self-hosted

    Lintel builds Lintel. Every package and image is produced by Lintel's own toolchain, running on Lintel's own build image — no outside distribution's binary repositories in the loop.

  • Long-term maintainability

    Decisions are weighed against years of upkeep, not short-term convenience — LTS governance, explicit package ownership, and no unsupported package silently riding along in a stable release.

Containers & VM images

The same Minimal package manifest that boots bare metal also produces a small, purpose-built OCI container image and virtual machine images — built from an empty root, not carved down from a general-purpose install.

  • Lean by design

    Built from a precise package manifest against an empty root filesystem — no docs, no stray locale data, no package cache, no unrelated configuration. Nothing deleted after the fact to fake a small image. Only what the workload actually needs.

  • Built for real workloads

    Aimed squarely at CI workers, Kubernetes, Podman, and other OCI-compatible runtimes — including as the eventual build worker for Lintel's own CI/CD, once it self-hosts.

  • Signed and attested

    Every image ships an SBOM, a provenance attestation, and a signature, tied to an immutable digest. Tag promotion never triggers a rebuild — the tested digest is the promoted digest.

  • VM images, same foundation

    The Minimal profile is also the root for QEMU/UEFI virtual machine images — the same manifest, the same Btrfs and systemd-boot defaults, so what you test in a VM matches what ships on bare metal.

Verify a download

Lintel ISO releases are signed with the Lintel ISO release key, starting with 1.28. The signature covers the release manifest published next to each image. That manifest names the version, architecture, media type and frozen package generation, and records the image's SHA-256. So one check tells you both who produced an image and that you have exactly that image.

Key
Lintel ISO release key, Ed25519
Key id
iso-v1-2026-08-27
Fingerprint
66337ffdad3cd23ff014becbfc95c39ef1e395712f073481ddbf2d88f4844485 SHA-256 of the DER-encoded public key
Public key
lintel-iso-signing.pem
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAL5CZYBxB3jg78Uw3Ct/a0hKY0m5q2AZAPjtpYmUn2dg=
-----END PUBLIC KEY-----

Check an image

Download the ISO, its .manifest.toml and its .manifest.toml.ed25519 into one directory with the public key, then run the commands below. They need OpenSSL 3.0 or newer and were tested with OpenSSL 3.6.5 against the 1.28 release. 

ISO=lintel-standard-netinstall-1.28-x86_64-v3.iso

# 1. The key's fingerprint must match the one above, character for character.
openssl pkey -pubin -in lintel-iso-signing.pem -outform DER | openssl dgst -sha256

# 2. The manifest must carry a valid signature from that key.
openssl pkeyutl -verify -pubin -inkey lintel-iso-signing.pem -rawin \
    -in "$ISO.manifest.toml" -sigfile "$ISO.manifest.toml.ed25519"

# 3. The image must be the one the signed manifest describes.
echo "$(sed -n 's/^payload_sha256 = "\(.*\)"$/\1/p' "$ISO.manifest.toml")  $ISO" | sha256sum -c

# 4. The signed manifest must name the release you meant to download.
grep -E '^(version|media_kind|delivery_mode|generation) ' "$ISO.manifest.toml"

Expect SHA2-256(stdin)= 66337ffd…4485, then Signature Verified Successfully, then image name: OK. Anything else means the image, its manifest or the key is not the one Lintel published. Don't use it. The SHA256SUMS file next to each image is not signed: it can catch a damaged download, not a substituted one.

Where to check the fingerprint

A key taken from this page only proves that this page and the image agree with each other. Before you trust the key, compare its fingerprint through a channel that doesn't depend on this website. On any installed Lintel system, the same key is compiled into the package manager and shipped by the lintel-keyring package: 

openssl pkey -pubin -in /usr/share/lintel/keys/lintel-iso-signing.pem -outform DER | openssl dgst -sha256

You can also ask for the fingerprint in #lintel on Libera.Chat. Releases before 1.28 were published with checksums only and carry no signature.

Join the conversation

Lintel's real-time discussion happens on IRC. It's the best place to follow development and talk with the maintainer during early development.

libera.chat / #lintel

Open #lintel in webchat