Known vulnerabilities
A critical or high-severity flaw that already has a fix blocks the install until you update. Serious flaws with no fix yet are shown as warnings.
Debian Security Tracker · NVD
Woodlark 0.1 · Halo
Small by default.
Careful by design.
Debian 13 underneath, Hyprland on Wayland on top, and nothing you did not ask for.
Every package goes through woodlark, which checks it against public
vulnerability data before it touches your disk.
- Debian 13 trixie
- Vulnerability-checked installs
- Hyprland · Wayland
- Signed apt repo
- amd64 + arm64
The woodlark command
Checked before it's installed.
woodlark install works out the whole apt transaction, dependencies included,
and checks every package in it before anything is written. If one has a serious known
flaw, you see which, why, and what to do, and nothing is installed.
Plain apt install gets the same checks, so nothing slips past by
using the other command.
Four checks
Open data, checked on every install.
Each check can block, warn or be switched off in /etc/woodlark/policy.toml. Out of the box, all four block.
Exploited in the wild
Anything on CISA's list of flaws attackers are actively using is blocked, fix or no fix. EPSS scores show how likely the rest are to be exploited.
CISA KEV · FIRST EPSS
Security support
Packages Debian no longer patches are blocked. Packages it only supports for trusted input, like binutils, come with a warning that says so.
Debian security-support lists
Trusted origins
Only Debian, Debian security, the pinned backports and Woodlark's signed repository. Stray .deb files and unknown repositories are blocked.
apt's own records
How it stays honest
Careful, not in your way.
- Offline checks. Nothing is looked up while you install. Woodlark reads a local database, rebuilt daily from the public sources.
- Signed data. Every refresh is verified against Woodlark's archive key, and older data than you already have is refused.
- Fails safe. With no data, or data over two weeks old, new installs wait until the next refresh.
- Updates always go through. Holding back a fix is worse than the flaw it fixes, so upgrades are never blocked, and
renewsays what they fixed. - Overrides on the record. An admin can accept one finding, with a reason and an expiry date. Every override is logged.
# check, then install woodlark install nginx # the same report, nothing installed woodlark info nginx # check what is already on the system woodlark audit # lists, security data, upgrades, cleanup (or: renew) sudo woodlark update # the rules in force, and how fresh the data is woodlark policy
Minimal
Small on purpose.
Woodlark ships what a desktop needs and stops there: no compilers, no media player, no office suite, and no VM guest agents on real hardware. Less installed means less to patch.
What you do want is one command away, and goes through the same checks. VSCodium and AnythingLLM
come from their own publishers, and woodlark says so every time.
# compilers, headers, Python packaging woodlark install woodlark-dev # ripgrep, jq, tree, micro, dig, zip woodlark install woodlark-tools # VSCodium, from its pinned apt repository woodlark install vscodium # AnythingLLM, checked against its published sha256 woodlark install anythingllm
Inside
Everything you need, nothing that nags.
Hyprland on Wayland
Tiling that animates, rounded corners, blur and a floating glass bar. Same keys as a classic i3 setup.
One word to update
renew refreshes package lists and security data, upgrades everything and cleans up. Woodlark's packages come from its own signed repository.
Encrypted install
A calm text installer: pick a disk, optionally encrypt it with LUKS2, set a user. UEFI and legacy BIOS.
A browser that behaves
Firefox with uBlock Origin and Dark Reader bundled and working offline, first-run clutter turned off.
Your models, your keys
AnythingLLM is one command away: woodlark install anythingllm. Paste your own API keys or point it at a local Ollama. No account, no telemetry.
A server image too
The same base without a GUI: SSH, tmux, neovim, the guest agents and a serial console for headless boxes.
Sharp on any screen
woodlark-scale sets 100–250% in one step: bar, launcher, terminal and apps all follow.
Light on its feet
zram swap, a zstd-compressed image, no background services you did not ask for. Fast on old hardware and VMs.
Tour
Have a look around.
Download
Woodlark 0.1 Halo
Every image is a live system that can install itself.
Write an image to a USB stick with dd, balenaEtcher or Rufus (DD mode), or attach it to a VM.
Turn Secure Boot off for now. Check a download with sha256sum -c and the .sha256 file next to it.
Install
Four steps, about ten minutes.
-
Write the image
On a Mac, find the stick with
diskutil list, then:sudo dd if=woodlark-linux-0.1.0-desktop-amd64.iso of=/dev/rdiskN bs=4m
-
Boot it
Pick the stick in your firmware's boot menu. The live desktop signs in as
woodlark/woodlark. -
Install to disk
Open the launcher with Super D and choose Install Woodlark, or run:
sudo woodlark-install
-
Keep it current
Whenever you like:
renew
Already on Debian 13?
Add Woodlark to what you have.
One package brings Woodlark's signing key and apt source, so there is no sources file to write by hand. Then install the server set, or the whole desktop.
Signing key
About Woodlark
Made with care.
Grounded in Debian.
Woodlark is a calm, keyboard-first desktop and a quiet server, built on Debian 13, kept small, and careful about what it lets in.
Everything it adds, from the installer to the theme and the small tools in between, ships as signed Debian packages. It updates with the rest of the system, and your own settings stay yours.
Software goes in through woodlark install, which checks every package against Debian's security tracker, the NVD, CISA's list of exploited flaws and EPSS before anything is installed. Plain apt gets the same checks.
Let’s talk Linux
What are you building?
Questions about Woodlark, running it on your hardware, or working together?