Every FinLinux OS package is built in the open, from traceable sources, using Forge — our public build and release pipeline.
Forge takes upstream sources, applies only the patches required for rebranding and legal compliance, and produces signed RPM packages, ISO images, and container images in a fully automated, auditable pipeline. Every build is reproducible from its logged inputs.
Pulls publicly available upstream sources and verifies provenance before anything is built.
Applies a minimal, publicly logged patch set (branding, trademark compliance) and compiles in isolated build roots.
Signs packages and composes them into repositories, ISOs, and cloud/container images, then publishes to mirrors.
A fully public build pipeline means anyone can audit exactly what changed between an upstream package and its FinLinux OS equivalent — there is no private patch set and no undisclosed modification. This is also what makes our certification program credible: compatibility claims are checkable, not asserted.
finlinux-os/patches repository with a rationale.Forge's pipeline definitions, patch sets, and build logs are all public. Packagers can propose changes via pull request; see the Community Hub for how SIGs review and merge them.
Given the same upstream source SHA and patch set, Forge produces bit-identical packages across independent build workers — a property the Security SIG verifies on an ongoing basis as part of supply-chain integrity work.