beast-booter 0.2.0

What's new in 0.2.0

Real ISOs, verified to boot. Every distribution below was booted from a BeastBoot drive as the real, checksum-verified official ISO, on both UEFI and legacy BIOS (Secure Boot off), until its own system or installer was running: 100 of 100 test cases pass. The full table is in the README ("ISO compatibility").

Family	ISOs tested
Fedora / RHEL family (dracut, Anaconda)	Fedora Workstation 44 Live, Fedora 44 netinst, AlmaLinux 10.2, Rocky Linux 10.2
openSUSE (KIWI, linuxrc, Agama)	Tumbleweed Live, Tumbleweed NET, Leap 15.6 NET, Leap 16.0
Ubuntu family	Ubuntu 26.04.1 Desktop and Server, Linux Mint 22.3
Debian	Debian 13.7 live and netinst
Others	Arch Linux, Alpine, SystemRescue, GParted Live, Clonezilla
Windows	Windows 11 installation ISO: Windows Setup straight from the ISO on the stick, or a Windows PE prompt

Windows installs from the stick. Pick a Windows 11 ISO and BeastBoot starts Windows Setup from it (through wimboot and a small helper that mounts the ISO), or choose the Windows PE prompt for repair tools. With Secure Boot on, the menu asks you to turn it off for that boot (wimboot is not signed).

All three filesystems. exFAT (default), FAT32 (ISOs up to 4 GiB) and NTFS all work. Fedora/RHEL and openSUSE live ISOs cannot read NTFS themselves; on NTFS the menu now says so instead of dropping into an emergency shell.

New boot recipes and fixes. Debian netinst and Alpine boot from an ISO file; Fedora Workstation and openSUSE KIWI live images are detected correctly; Ubuntu Server boots from exFAT; Debian live boots from NTFS; SystemRescue and Linux Mint boot on UEFI and from FAT32/NTFS. Clear messages for ISOs too big to load into memory (iso-too-large).

Good to know.

• Windows 11 Setup checks for TPM 2.0 and Secure Boot capability itself; PCs that meet the requirements pass. Windows 10 and Windows Server are expected to work but not tested yet.
• Debian netinst and Alpine are loaded into memory: use the netinst/standard ISOs, not the 4 GB DVD images. In the Debian installer, don't choose the BeastBoot stick itself as the installation disk.
• Updating from 0.1.x: use "Update boot files" in the app; your ISOs and files stay.
• Still no critical or high vulnerability findings (see the attached VULNERABILITIES.md).

If BeastBoot is useful to you, you can support it at https://buymeacoffee.com/cynak.

---

beast-booter 0.2.0

Release v0.2.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.2.0-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.2.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B

• Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
• SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
• SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-booter-0.2.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

• Open boot-chain findings: 1 medium
• Open findings in shipped software (drive, beast-net, portable runtimes): 78 medium, 44 low, 19 negligible
• Open findings in build/test tooling (not shipped): 58 medium, 19 low
• Closed by VEX statements: 195
• Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

• MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-booter-0.2.0-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-booter-0.2.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File	Size	SHA-256
beast-booter-0.2.0-linux-x86_64.tar.gz	126.6 MiB	0c5ad176ae33555d...
beast-booter-0.2.0-windows-x86_64.zip	96.6 MiB	8440098ef16ddd68...
beast-booter-0.2.0-macos-x86_64.zip	79.3 MiB	62885db4ce2d1e45...
beast-booter-0.2.0-macos-arm64.zip	79.5 MiB	a3088642eab86ac3...
beast-booter-0.2.0-dist.zip	54.1 MiB	a74fe41f5ffe8640...
beast-booter-0.2.0-sbom.cdx.json	744.9 KiB	7c6179874a157ac9...
beast-booter-0.2.0-sbom.spdx.json	655.3 KiB	0fd5949f6ef7b789...
beast-booter-0.2.0-vulnerabilities.json	953.4 KiB	38572be1439407ce...
beast-booter-0.2.0-VULNERABILITIES.md	109.7 KiB	baa2930ecb6fac04...
beast-booter-0.2.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer	869 B	294bd966257bff2a...
beast-booter-0.2.0-CERTIFICATE.txt	1.0 KiB	1842895fe1e6731b...
SHA256SUMS	1.1 KiB	15a29e23c5f38cb1...