Repository navigation
Releases
beast-boot 0.4.1
beast-boot 0.4.1
Release v0.4.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.4.1-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.4.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-boot-0.4.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 415 medium, 43 low, 19 negligible
- Open findings in build/test tooling (not shipped): 61 medium, 19 low
- Closed by VEX statements: 379
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-boot-0.4.1-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-boot-0.4.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-boot-0.4.1-linux-x86_64.tar.gz |
141.8 MiB | 45dde82bfa774856... |
beast-boot-0.4.1-windows-x86_64.zip |
109.9 MiB | 6ff990914b497b98... |
beast-boot-0.4.1-macos-x86_64.zip |
91.7 MiB | 0f13eb82cc84e38b... |
beast-boot-0.4.1-macos-arm64.zip |
91.5 MiB | bf80d05ce63f3be0... |
beast-boot-0.4.1-dist.zip |
63.6 MiB | 4b9adf147a77bacc... |
beast-boot-0.4.1-sbom.cdx.json |
806.5 KiB | e907d684bbfed0a2... |
beast-boot-0.4.1-sbom.spdx.json |
733.5 KiB | 1dc57645e9e0781f... |
beast-boot-0.4.1-vulnerabilities.json |
2.1 MiB | 757e16c867c31364... |
beast-boot-0.4.1-VULNERABILITIES.md |
203.6 KiB | 469904af0e621667... |
beast-boot-0.4.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-boot-0.4.1-CERTIFICATE.txt |
1.0 KiB | 50b6778dd961271c... |
SHA256SUMS |
1.1 KiB | 23d8c5ed5fa27fc3... |
beast-boot 0.4.0
beast-boot 0.4.0
Release v0.4.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.4.0-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.4.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-boot-0.4.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 220 medium, 42 low, 19 negligible
- Open findings in build/test tooling (not shipped): 52 medium, 19 low
- Closed by VEX statements: 381
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-boot-0.4.0-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-boot-0.4.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-boot-0.4.0-linux-x86_64.tar.gz |
141.8 MiB | c3fc6ee8f89f837a... |
beast-boot-0.4.0-windows-x86_64.zip |
109.9 MiB | 2cad2fa870c14579... |
beast-boot-0.4.0-macos-x86_64.zip |
91.7 MiB | f07475074d25289f... |
beast-boot-0.4.0-macos-arm64.zip |
91.4 MiB | c6577747c09f4f43... |
beast-boot-0.4.0-dist.zip |
63.6 MiB | 07d579581b770c38... |
beast-boot-0.4.0-sbom.cdx.json |
806.5 KiB | 587e58a32c13bfee... |
beast-boot-0.4.0-sbom.spdx.json |
733.5 KiB | 9bb88a8c1a425922... |
beast-boot-0.4.0-vulnerabilities.json |
1.6 MiB | ba98af497f7d1d43... |
beast-boot-0.4.0-VULNERABILITIES.md |
204.1 KiB | 93937fc0a75c947a... |
beast-boot-0.4.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-boot-0.4.0-CERTIFICATE.txt |
1.0 KiB | 017f390953f8f509... |
SHA256SUMS |
1.1 KiB | 0ece2da1b603da9b... |
beast-boot 0.3.1
beast-boot 0.3.1
Release v0.3.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.3.1-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.3.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-boot-0.3.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 248 medium, 42 low, 19 negligible
- Open findings in build/test tooling (not shipped): 51 medium, 19 low
- Closed by VEX statements: 511
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-boot-0.3.1-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-boot-0.3.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-boot-0.3.1-linux-x86_64.tar.gz |
141.8 MiB | 8e7f138601e2ff8c... |
beast-boot-0.3.1-windows-x86_64.zip |
109.9 MiB | a38746d201a7c36a... |
beast-boot-0.3.1-macos-x86_64.zip |
91.7 MiB | 425f25729e5550a1... |
beast-boot-0.3.1-macos-arm64.zip |
91.4 MiB | d3b8ad81f7e7426c... |
beast-boot-0.3.1-dist.zip |
63.6 MiB | be2dbd04a68a1eb9... |
beast-boot-0.3.1-sbom.cdx.json |
802.2 KiB | 1e4ff8c407bb8bcc... |
beast-boot-0.3.1-sbom.spdx.json |
731.2 KiB | b57a5f98340ac202... |
beast-boot-0.3.1-vulnerabilities.json |
2.0 MiB | 898ded154f41538d... |
beast-boot-0.3.1-VULNERABILITIES.md |
266.0 KiB | f3653c4abaccde4e... |
beast-boot-0.3.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-boot-0.3.1-CERTIFICATE.txt |
1.0 KiB | f388eed551d4b175... |
SHA256SUMS |
1.1 KiB | a0b0e1b8d37b062b... |
beast-boot 0.3.0
What's new in 0.3.0
Disk tools: recovery and cloning, RAID-aware. A new boot menu entry, "Disk tools: recovery and cloning" (under Tools), shows every disk and every RAID or volume set on the computer. You can check disk health, rescue a failing disk with ddrescue, clone a disk, a partition or a RAID volume to another disk, save it as an image file, and restore an image. A stopped copy resumes where it stopped, and every copy is checked with SHA-256.
| Storage | What BeastBoot does |
|---|---|
| Linux md RAID 0, 1, 5, 6, 10, linear (also degraded, also with a bitmap) | starts it read-only on in-memory overlays |
| Intel RST/VROC (IMSM), DDF firmware RAID | starts it read-only (Intel: not while it rebuilds or with RWH/PPL on) |
| LVM with plain (linear/striped) volumes | starts it read-only on in-memory overlays |
| LUKS2, BitLocker, Btrfs on several disks | opens it read-only |
| LVM with RAID/mirror/cache/thin/snapshot volumes, Windows dynamic disks | detected; image each disk |
| Hardware RAID controllers (MegaRAID/PERC, Smart Array, Adaptec, LSI) | drivers included; each array shows as one disk |
| AMD RAID, Storage Spaces, sets whose RAID information is lost | works out the layout from the data on in-memory overlays; manual RAID builder as fallback |
Safe by design. When Disk tools start, every disk and partition is set read-only, and RAID sets and LVM start on in-memory copy-on-write overlays, so even a write the kernel makes on its own (such as a RAID bitmap update) lands in memory. Guessing a RAID layout happens on copy-on-write overlays in memory. A disk becomes writable only after a plan screen and after you type the last 6 characters of its serial number; it is checked again right before writing. The BeastBoot drive, the source, the source set and smaller disks are refused as targets. Images go to the BeastBoot drive (exFAT or NTFS) or to another disk opened for image files after typing its serial (exFAT, NTFS, ext4 or XFS).
Tested. 37 end-to-end tests pass in QEMU with NVMe and SATA disks: md RAID 0/1/5/6/10 including degraded, linear, with write-intent bitmaps (also a stale one), Intel IMSM RAID5, DDF RAID1, LVM (also two groups with the same name, and a RAID1 volume that is correctly refused), LUKS2, Btrfs RAID1, GPT with NTFS and ext4, and wiped RAID0/RAID5 arrays rebuilt from the data, also with one member missing. Every source disk was hashed before and after and stayed unchanged; clone, image and restore round trips were byte-identical; the refusals (stick, source, wrong confirmation, smaller target) were checked.
Good to know.
- Not tested yet: real Intel RST/VMD hardware, real AMD RAID arrays, hardware RAID controllers, ZFS, BitLocker, Windows dynamic disks and real failing disks. For data you cannot lose, image the disk first and work from the image.
- AMD RAID support is generic reconstruction. On an AMD board with SATA in RAID mode, Linux sees each disk on its own; AMD NVMe RAID is not verified.
- ZFS needs an optional pack that is not shipped yet; the menu says "Needs the ZFS pack".
- A copy of one disk of a RAID set is a copy of that disk, not of the set.
- The helper grew by about 10 MB compressed and still runs in 1 GiB of RAM.
- Updating from 0.2.x: use "Update boot files" in the app; your ISOs and files stay.
- The downloads and the command are now named
beast-boot(beast-boot-0.3.0-linux-x86_64.tar.gz,./beast-boot) instead ofbeast-booter. Drives made with 0.2.0 are recognised and updated as before. - Still no critical or high vulnerability findings (see the attached VULNERABILITIES.md).
If BeastBoot is useful to you, you can support it at https://buymeacoffee.com/cynak.
beast-boot 0.3.0
Release v0.3.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.3.0-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.3.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-boot-0.3.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 564 medium, 45 low, 19 negligible
- Open findings in build/test tooling (not shipped): 51 medium, 19 low
- Closed by VEX statements: 195
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-boot-0.3.0-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-boot-0.3.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-boot-0.3.0-linux-x86_64.tar.gz |
136.1 MiB | 0d6b614f58f57257... |
beast-boot-0.3.0-windows-x86_64.zip |
106.2 MiB | 62924d156318c6d8... |
beast-boot-0.3.0-macos-x86_64.zip |
88.9 MiB | 05a4cff9ef879ec4... |
beast-boot-0.3.0-macos-arm64.zip |
89.0 MiB | 99176c414afd176f... |
beast-boot-0.3.0-dist.zip |
63.6 MiB | ad7875d49e07584d... |
beast-boot-0.3.0-sbom.cdx.json |
801.3 KiB | b47dfd0d049611b0... |
beast-boot-0.3.0-sbom.spdx.json |
730.9 KiB | 0a509ac10d4bc502... |
beast-boot-0.3.0-vulnerabilities.json |
1.8 MiB | f2ffd72b5429178d... |
beast-boot-0.3.0-VULNERABILITIES.md |
109.7 KiB | 9f02507af0e9f41d... |
beast-boot-0.3.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-boot-0.3.0-CERTIFICATE.txt |
1.0 KiB | f439f6d8ea5fbaef... |
SHA256SUMS |
1.1 KiB | 627a2053a6c468bf... |
beast-booter 0.2.0
What's new in 0.2.0
Real ISOs, verified to boot. Every distribution below was booted from a BeastBoot drive as the real, checksum-verified official ISO, on both UEFI and legacy BIOS (Secure Boot off), until its own system or installer was running: 100 of 100 test cases pass. The full table is in the README ("ISO compatibility").
| Family | ISOs tested |
|---|---|
| Fedora / RHEL family (dracut, Anaconda) | Fedora Workstation 44 Live, Fedora 44 netinst, AlmaLinux 10.2, Rocky Linux 10.2 |
| openSUSE (KIWI, linuxrc, Agama) | Tumbleweed Live, Tumbleweed NET, Leap 15.6 NET, Leap 16.0 |
| Ubuntu family | Ubuntu 26.04.1 Desktop and Server, Linux Mint 22.3 |
| Debian | Debian 13.7 live and netinst |
| Others | Arch Linux, Alpine, SystemRescue, GParted Live, Clonezilla |
| Windows | Windows 11 installation ISO: Windows Setup straight from the ISO on the stick, or a Windows PE prompt |
Windows installs from the stick. Pick a Windows 11 ISO and BeastBoot starts Windows Setup from it (through wimboot and a small helper that mounts the ISO), or choose the Windows PE prompt for repair tools. With Secure Boot on, the menu asks you to turn it off for that boot (wimboot is not signed).
All three filesystems. exFAT (default), FAT32 (ISOs up to 4 GiB) and NTFS all work. Fedora/RHEL and openSUSE live ISOs cannot read NTFS themselves; on NTFS the menu now says so instead of dropping into an emergency shell.
New boot recipes and fixes. Debian netinst and Alpine boot from an ISO file; Fedora Workstation and openSUSE KIWI live images are detected correctly; Ubuntu Server boots from exFAT; Debian live boots from NTFS; SystemRescue and Linux Mint boot on UEFI and from FAT32/NTFS. Clear messages for ISOs too big to load into memory (iso-too-large).
Good to know.
- Windows 11 Setup checks for TPM 2.0 and Secure Boot capability itself; PCs that meet the requirements pass. Windows 10 and Windows Server are expected to work but not tested yet.
- Debian netinst and Alpine are loaded into memory: use the netinst/standard ISOs, not the 4 GB DVD images. In the Debian installer, don't choose the BeastBoot stick itself as the installation disk.
- Updating from 0.1.x: use "Update boot files" in the app; your ISOs and files stay.
- Still no critical or high vulnerability findings (see the attached VULNERABILITIES.md).
If BeastBoot is useful to you, you can support it at https://buymeacoffee.com/cynak.
beast-booter 0.2.0
Release v0.2.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.2.0-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.2.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-booter-0.2.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 78 medium, 44 low, 19 negligible
- Open findings in build/test tooling (not shipped): 58 medium, 19 low
- Closed by VEX statements: 195
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-booter-0.2.0-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-booter-0.2.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-booter-0.2.0-linux-x86_64.tar.gz |
126.6 MiB | 0c5ad176ae33555d... |
beast-booter-0.2.0-windows-x86_64.zip |
96.6 MiB | 8440098ef16ddd68... |
beast-booter-0.2.0-macos-x86_64.zip |
79.3 MiB | 62885db4ce2d1e45... |
beast-booter-0.2.0-macos-arm64.zip |
79.5 MiB | a3088642eab86ac3... |
beast-booter-0.2.0-dist.zip |
54.1 MiB | a74fe41f5ffe8640... |
beast-booter-0.2.0-sbom.cdx.json |
744.9 KiB | 7c6179874a157ac9... |
beast-booter-0.2.0-sbom.spdx.json |
655.3 KiB | 0fd5949f6ef7b789... |
beast-booter-0.2.0-vulnerabilities.json |
953.4 KiB | 38572be1439407ce... |
beast-booter-0.2.0-VULNERABILITIES.md |
109.7 KiB | baa2930ecb6fac04... |
beast-booter-0.2.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-booter-0.2.0-CERTIFICATE.txt |
1.0 KiB | 1842895fe1e6731b... |
SHA256SUMS |
1.1 KiB | 15a29e23c5f38cb1... |
beast-booter 0.1.2
What's new in 0.1.2
A security release: no critical or high vulnerability findings remain open, in the boot chain, on the drive or in the portable app (see the attached VULNERABILITIES.md and OpenVEX files).
Boots on new PCs with Secure Boot on. The drive now starts through Debian's shim 16.1, which is signed by both Microsoft UEFI CA 2011 and Microsoft UEFI CA 2023. PCs that trust only the 2023 certificate can boot BeastBoot with Secure Boot on. MokManager is Debian's. Enrolling the BeastBoot key works as before.
GRUB built from source, SBAT grub,6. grubx64.efi is built from Ubuntu's grub2 2.14-2ubuntu3 source plus three patches (CVE-2026-97876; upstream 089d0567; Debian 8719ef8a). The build proves every fix is present before it claims grub,6, so the drive keeps booting on PCs that apply shim's newest revocation level. It also closes the GRUB CVEs from the 2025 security pushes.
Ubuntu ISOs with Secure Boot on: one opt-in step. Debian's shim does not trust Canonical's key. To start Ubuntu and Ubuntu-based ISOs with Secure Boot on, choose Tools > Trust Ubuntu's Secure Boot key once per PC. It first enrolls Ubuntu's revoked keys, then Canonical's key, and you confirm each in MokManager. Or turn Secure Boot off. Debian-signed ISOs now start without any extra step. See docs/USER_GUIDE.md ("Booting Ubuntu ISOs with Secure Boot on") for the fingerprints to compare.
Network helper on Linux 7.3. The beast-net helper uses Ubuntu 26.10's kernel 7.3.0-9.9, signed with the BeastBoot key. This closes over 100 kernel CVEs. After you update a drive, firmware packs installed for the old 7.0 kernel are flagged; reinstall them from the Firmware packs page.
Upgrading from 0.1.1: use "Update boot files" in the app. Your ISOs and files stay. Then reinstall any flagged firmware packs. If you use Ubuntu ISOs with Secure Boot on, run the trust step once.
beast-booter 0.1.2
Release v0.1.2. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.2-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.2-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-booter-0.1.2-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 79 medium, 44 low, 19 negligible
- Open findings in build/test tooling (not shipped): 50 medium, 9 low
- Closed by VEX statements: 197
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)
Boot-chain findings and their VEX status:
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: none
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-booter-0.1.2-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-booter-0.1.2-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-booter-0.1.2-linux-x86_64.tar.gz |
126.5 MiB | 9470bbf9a306701e... |
beast-booter-0.1.2-windows-x86_64.zip |
96.6 MiB | 80054037823c13be... |
beast-booter-0.1.2-macos-x86_64.zip |
79.2 MiB | ce8746fcb0b84bd7... |
beast-booter-0.1.2-macos-arm64.zip |
79.4 MiB | 7f021f0070cf4082... |
beast-booter-0.1.2-dist.zip |
54.0 MiB | a986a99c591d6610... |
beast-booter-0.1.2-sbom.cdx.json |
726.5 KiB | 1cab070183f3ac36... |
beast-booter-0.1.2-sbom.spdx.json |
643.0 KiB | 0aa403e062956756... |
beast-booter-0.1.2-vulnerabilities.json |
928.5 KiB | 4672aed6df8c0378... |
beast-booter-0.1.2-VULNERABILITIES.md |
110.7 KiB | 5ab1948297edae89... |
beast-booter-0.1.2-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-booter-0.1.2-CERTIFICATE.txt |
1.0 KiB | 6ff9408bf00fe97f... |
SHA256SUMS |
1.1 KiB | 157f499074ce9c88... |
beast-booter 0.1.1
beast-booter 0.1.1
Release v0.1.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.1-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-booter-0.1.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 critical, 1 high, 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 2 critical, 212 high, 1568 medium, 371 low, 22 negligible
- Open findings in build/test tooling (not shipped): 82 medium, 9 low
- Closed by VEX statements: 4330
- Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 2 known)
Boot-chain findings and their VEX status:
- CRITICAL BB-SBAT-REVOKED-grub: esp/EFI/BOOT/grubx64.efi: SBAT grub,5 is below the revocation level grub,6 (SbatLevel 2025112400) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a grub2 build whose SBAT carries grub,6, then rebuild (make build), re-scan (make vulns) and re-test (make e2e). The grub generation is never raised by hand. Until then Secure Boot boots fail on PCs that applied SbatLevel 2025112400; documented in docs/SECURE_BOOT.md.
- HIGH BB-SHIM-UEFI-CA-2011-ONLY: esp/EFI/BOOT/BOOTX64.EFI is signed only through Microsoft Corporation UEFI CA 2011 (notAfter 2026-06-27T21:32:45Z, expired 119 days ago) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a shim-signed build signed by the Microsoft UEFI CA 2023, then rebuild, re-scan and re-test. Until then Secure Boot boots fail on PCs whose db trusts only the 2023 CA; documented in docs/SECURE_BOOT.md.
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: CVE-2015-7837, CVE-2022-50240, CVE-2025-1272, CVE-2025-40190, CVE-2025-61662, CVE-2026-100074, CVE-2026-72198, CVE-2026-74677, CVE-2026-74700, CVE-2026-74714, CVE-2026-74752, CVE-2026-80693, CVE-2026-80718, CVE-2026-80841, CVE-2026-80937 and 93 more
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-booter-0.1.1-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-booter-0.1.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-booter-0.1.1-linux-x86_64.tar.gz |
126.4 MiB | 311fcccd1b79b100... |
beast-booter-0.1.1-windows-x86_64.zip |
96.5 MiB | acd667a1309735ba... |
beast-booter-0.1.1-macos-x86_64.zip |
79.1 MiB | 59b8bed059c9e103... |
beast-booter-0.1.1-macos-arm64.zip |
79.3 MiB | 11b84390b8820ae7... |
beast-booter-0.1.1-dist.zip |
52.8 MiB | 3baa4e84a88bd7f5... |
beast-booter-0.1.1-sbom.cdx.json |
691.2 KiB | cbd2780b49739ec0... |
beast-booter-0.1.1-sbom.spdx.json |
611.8 KiB | c422907e52b7b8bb... |
beast-booter-0.1.1-vulnerabilities.json |
15.0 MiB | c7fbeb992a68037d... |
beast-booter-0.1.1-VULNERABILITIES.md |
2.4 MiB | 11641983e8047bed... |
beast-booter-0.1.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-booter-0.1.1-CERTIFICATE.txt |
1.0 KiB | c9e7c8a7d702502a... |
SHA256SUMS |
1.1 KiB | 94d9f270eb7594b5... |
beast-booter 0.1.0
beast-booter 0.1.0
Release v0.1.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.0-dist.zip.
Secure Boot certificate
On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:
86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
- Subject:
CN=beast-booter Secure Boot release key(valid until 2036-10-21T04:21:14Z) - SHA-1:
86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B - SHA-256:
29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A
The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".
Vulnerabilities
From beast-booter-0.1.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):
- Open boot-chain findings: 1 critical, 1 high, 1 medium
- Open findings in shipped software (drive, beast-net, portable runtimes): 24 critical, 582 high, 4747 medium, 1116 low, 41 negligible
- Open findings in build/test tooling (not shipped): 82 medium, 9 low
- Closed by VEX statements: 0
- Release gate: passed: no new critical finding without a VEX statement
Boot-chain findings and their VEX status:
- CRITICAL BB-SBAT-REVOKED-grub: esp/EFI/BOOT/grubx64.efi: SBAT grub,5 is below the revocation level grub,6 (SbatLevel 2025112400) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a grub2 build whose SBAT carries grub,6, then rebuild (make build), re-scan (make vulns) and re-test (make e2e). The grub generation is never raised by hand. Until then Secure Boot boots fail on PCs that applied SbatLevel 2025112400; documented in docs/SECURE_BOOT.md.
- HIGH BB-SHIM-UEFI-CA-2011-ONLY: esp/EFI/BOOT/BOOTX64.EFI is signed only through Microsoft Corporation UEFI CA 2011 (notAfter 2026-06-27T21:32:45Z, expired 118 days ago) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a shim-signed build signed by the Microsoft UEFI CA 2023, then rebuild, re-scan and re-test. Until then Secure Boot boots fail on PCs whose db trusts only the 2023 CA; documented in docs/SECURE_BOOT.md.
- MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet
Critical/high findings in shipped software: CVE-2015-7837, CVE-2022-50240, CVE-2024-45774, CVE-2024-45776, CVE-2024-45777, CVE-2024-45780, CVE-2024-45781, CVE-2024-45782, CVE-2025-0622, CVE-2025-0690, CVE-2025-1272, CVE-2025-40190, CVE-2025-61662, CVE-2026-100074, CVE-2026-68103 and 294 more
Verify the download
sha256sum -c SHA256SUMS --ignore-missing # Windows: Get-FileHash <file> -Algorithm SHA256
gh attestation verify beast-booter-0.1.0-dist.zip -R cynak/BeastBoot # build provenance, any file
The SBOM (beast-booter-0.1.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.
Files
| File | Size | SHA-256 |
|---|---|---|
beast-booter-0.1.0-linux-x86_64.tar.gz |
126.2 MiB | cab8a0ea69203037... |
beast-booter-0.1.0-windows-x86_64.zip |
96.3 MiB | 0a6386c8a751a97d... |
beast-booter-0.1.0-macos-x86_64.zip |
79.0 MiB | 9b91fa2a33359b0e... |
beast-booter-0.1.0-macos-arm64.zip |
79.1 MiB | 1d88f843f3415f42... |
beast-booter-0.1.0-dist.zip |
53.0 MiB | b730f41dc3407154... |
beast-booter-0.1.0-sbom.cdx.json |
703.7 KiB | fa8e95003895077f... |
beast-booter-0.1.0-sbom.spdx.json |
628.4 KiB | a016a06b6bd4cbd0... |
beast-booter-0.1.0-vulnerabilities.json |
12.3 MiB | da5d1e9c2662f21d... |
beast-booter-0.1.0-VULNERABILITIES.md |
124.6 KiB | 6f32364b55e34876... |
beast-booter-0.1.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer |
869 B | 294bd966257bff2a... |
beast-booter-0.1.0-CERTIFICATE.txt |
1.0 KiB | 26aa696165ff7073... |
SHA256SUMS |
1.1 KiB | bb6d662d76c7298f... |