OS Distribution Mirror Gateway

It is: a high-trust metadata and verification gateway for major Linux distributions — official download URLs, published digests, verify commands, lane-organized hub, public JSON API, and the osdl CLI (Linux + Windows), including air-gap push helpers.

It is not: an official project mirror, a CDN, a proxy, or a host of ISO binaries. It does not claim affiliation with Ubuntu, Debian, Fedora, Arch, SUSE, Mint, Rocky, Alma, Kali, Parrot, Tails, Qubes, Talos, Flatcar, Kairos, or any other distribution project.

No. The gateway publishes metadata, official download URLs, and checksums only. Binary transfers always go from your client (or jumphost) directly to the distribution’s official infrastructure or designated mirrors. Air-gap osdl push only SCPs files you already hold — it does not pull ISOs through this site.

No. os.webservice.digital is an independent operational gateway. It does not claim official mirror status for any Linux distribution project. Treat each project’s own download and signing infrastructure as the root of trust for authenticity.

Channels are split into three lanes for operational clarity:

• General Purpose — desktop, server, and enterprise baselines (Ubuntu, Debian, Fedora, Arch, openSUSE, Mint, Rocky, AlmaLinux, Alpine, NixOS, Manjaro, …).
• IT-Security & Privacy — Kali, Parrot Security, Tails, Qubes OS (authorized assessment and privacy workflows only).
• Kubernetes & Immutable Node OS — Talos (talosctl), Flatcar Container Linux, Fedora CoreOS, Kairos.

Use the lane jump links under the hub title, the primary nav (Security / Kubernetes), or the filter chips.

Type free text or activate chips. Queries use multi-token AND matching with synonym expansion and whole-token boundaries (so enterprise does not false-match enterprise-aligned).

Useful queries: debian-based, redhat-based / rhel, security / pentest, privacy, kubernetes / k8s, immutable, talosctl, lts, minimal.

Deep-link with ?q=kubernetes on the hub URL. Empty lanes hide while a filter is active; the result counter shows visible vs total channels.

Primary focus is x86_64 / amd64. Some projects also publish arm64 or other arches on their official pages; this hub curates the mainstream 64-bit PC images most operators need. Always confirm arch on the project download page before deployment.

OPERATIONAL — metadata channels are considered healthy and current. DEGRADED — partial issues (stale entries or known upstream problems); double-check digests at the source. MAINTENANCE — planned update window; treat published hashes as possibly in flux. The banner also shows the last metadata sync time (UTC) and the channel id os.webservice.digital.

Kali Linux — industry-standard pentest/forensics media (Debian-based). Parrot Security — security suite with home/security editions. Tails — amnesic live system, Tor-oriented privacy. Qubes OS — security-by-compartmentalization desktop (Xen isolation).

These tools are for authorized testing, training, and defensive research. Misuse may be illegal. Always re-verify official checksums and signatures before use.

Talos Linux — OS built only for Kubernetes; day-2 ops via talosctl (no SSH/package manager on the node). Flatcar Container Linux — CoreOS successor, container host (CNCF incubator). Fedora CoreOS — auto-updating atomic host with Ignition. Kairos — immutable cloud-native OS; standard images may bundle K3s.

These are node/host operating systems, not Kubernetes distributions like kubeadm charts. Filter chips: Kubernetes, Immutable.

Talos is a Kubernetes-only immutable OS. There is no SSH shell or traditional package manager on the node. Lifecycle and machine configuration are driven by the Talos API and the talosctl client (same release train as the metal ISO). Obtain the metal ISO from official Sidero releases (linked on this hub), install per Talos docs, then manage the cluster with talosctl. Custom boot assets can be built via the Talos Image Factory when required.

One-liner (installs osdl and the air-gap helper osdl-push into ~/.local/bin by default):

curl -fsSL https://os.webservice.digital/cli/ | bash

Override install location with OSDL_INSTALL_DIR. Prefer inspecting the installer first: curl -fsSL https://os.webservice.digital/cli/ (and /cli/osdl, /cli/osdl-push) before piping to bash in high-security environments.

Core commands: osdl list, info <distro>, get <distro> [--verify] [--print], verify <file> <distro>, push …, status, version.

Windows PowerShell tooling is not offered publicly at this time. Use the Linux/macOS installer: curl -fsSL https://os.webservice.digital/cli/ | bash.

• list — curated distro ids, names, versions, codenames.
• info <distro> — official page, primary ISO URL, digests, verify command, checksum/GPG URLs, lane.
• get <distro> — download from the official URL only; --verify / -Verify checks SHA; --print / -Print shows commands without executing.
• verify <file> <distro> — compare a local file to gateway-published digests (supports variants).
• push — SCP an ISO + verification bundle to an air-gapped host (see Air-gap corridor).
• status — channel status and last metadata sync from the public API.

Metadata is cached locally (TTL default 300s); use --refresh / -Refresh to force a live fetch. Override API URL with OSDL_API or --api.

Pattern: connected jumphost/bastion obtains and verifies media → controlled SCP into the isolated segment.

1. On the jumphost (online): osdl get <distro> --verify -o /path/file.iso (or Windows -Verify -Output).
2. Optionally fetch official checksum + GPG material (or pass --distro so push can attach published listings while online).
3. Push: osdl push --host user@airgap-ip --iso /path/file.iso --distro <id>.
4. Via bastion: add --jump user@bastion (SSH ProxyJump).
5. On the air-gapped host: follow MANIFEST.txt — typically sha256sum -c … / sha512sum -c …, then GPG-verify when keys/signatures were included.

Windows: osdl push -Iso .\file.iso -TargetHost user@host -Distro <id> -Jump bastion@edge. Rehearse with --print / -Print before first production transfer.

The transfer bundle may include: ISO, checksum/digest file, optional detached signature, optional public keys under keys/, and MANIFEST.txt.

Minimum: the ISO plus a digest file (official SHA256SUMS / CHECKSUM / *.sha256, or a generated HASH *filename line). Strongly recommended: detached GPG signature of the checksum file and the project’s public signing key. Use --checksum, --sig, and repeatable --key (PowerShell: -Checksum, -Sig, -Key). With --distro, push can auto-attach official checksum/signature URLs while the jumphost still has network access.

No. Automatic SHA256/SHA512 verification only proves bit-identity with the digest published by this gateway (or a local digest file you supply). It does not by itself prove that the digest originated from the distribution project. You remain responsible for GPG-verifying official checksum files with the project’s signing keys when your threat model requires authenticity, not just integrity.

1. Download only from the official URL shown on this hub (or the project site).
2. Check digest: sha256sum -c / sha512sum -c, osdl verify, or PowerShell Get-FileHash.
3. Obtain the official checksum listing and its GPG signature from the project.
4. Import the project key from a trusted channel; gpg --verify the signature.
5. Air-gap: push the verified bundle; re-check digests on the isolated host before imaging media.
6. Only then write USB/hybrid media or boot the image.

Read-only GET endpoints (CORS allowed for GET):

• /api/v1/latest.json — full payload: status, disclaimer, CLI hints, all distributions (including lane, digests, verify commands).
• /api/v1/distros.json — distributions only.
• /api/v1/status.json — banner fields (channel, status, last sync).

The CLI always consumes live metadata from these endpoints (with a short local cache). Stable fields include id, aliases, name, version, lane, primary_iso.{filename,url,sha256,sha512,verify_command}, checksums.*.

Gateway operators refresh the configuration-driven catalog after validating digests against each project’s official checksum files (and signatures where practical). The banner field LAST MIRROR METADATA SYNC is the UTC timestamp of that refresh. Consumers should still treat the distribution project as the root of trust for authenticity. Public release notes for the gateway and tooling are on the Changelog page.

Public operator scripts are served as plain text for audit:

• Linux: /cli/, /cli/osdl, /cli/osdl-push
• Windows scripts are currently blended out (not public).
• Changelog: /changelog/

Current public tooling train: v1.3.2 (Linux CLI + air-gap push + presentation layer).

No. No analytics, advertising, or non-essential third-party scripts or fonts. Content Security Policy is restricted to same-origin assets. External download links use rel="noopener noreferrer".

You are. This gateway is provided without warranty. Upstream mirrors can fail; digests can lag a project point-release by a short window; network paths can corrupt transfers. On mismatch: re-download from the official URL, re-check the project’s own checksum file and GPG signature, and only then escalate. Never boot untrusted media into production.