Alpha · version 160.0-0.3 · Fedora, x86_64

Download Nulavio

This is the first public version. It passes the project's automated tests, but it can still have defects: keep another browser installed.

Version: 160.0-0.3
System: Fedora 44 or later, x86_64
Ubuntu: Not yet: there is no APT repository
Updates: Through dnf, like the rest of the system

Install

Add the Nulavio repository and install the package:

sudo dnf config-manager addrepo --from-repofile=https://nulavio.net/rpm/nulavio.repo
sudo dnf install nulavio

On the first install, dnf shows the repository key and asks whether to import it. Accept only if the fingerprint is this one:

298A 9093 BAAB B26F 79BB 29F4 BF47 E5FA 9EDB 8DB1

The same public key is at https://nulavio.net/keys/nulavio-packages.asc. The repository has signature checks on for both the packages and the metadata.

Limit: The fingerprint only protects you if you check it through a different path from the download, for example this page opened on another device.

Updates

New versions arrive through sudo dnf upgrade or the system's software centre. When Mozilla publishes a Firefox security fix, the project's goal is to publish the matching Nulavio within 72 hours.

Limit: In that window, the installed Nulavio does not have the fix yet.

Check a manual download

The same packages, with a SHA256SUMS list signed by the key above, the SBOM and the build manifest, are on the release page on GitHub: github.com/nulavio/nulavio/releases. The key that comes with them counts only if its fingerprint is the one shown above: check it before importing.

gpg --show-keys --with-fingerprint nulavio-packages.asc
gpg --import nulavio-packages.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

What this alpha does not do yet

Limit: It does not check download reputation with Google: Google keeps that check for partners. Instead, downloaded installers and scripts open a warning, are never run directly, and are saved without execute permission.
Limit: Unlocking profiles with your phone or a FIDO2 security key is not available yet. Protected profiles open with a password, a recovery code or the system keyring.
Limit: Fedora only for now.

Remove

sudo dnf remove nulavio
sudo rm /etc/yum.repos.d/nulavio.repo

Your profiles live in your home folder and are not deleted when you remove the program.

Report a problem

Defects: open an issue in the project's repository. Security flaws: write to security@nulavio.net, not to the public tracker.