What it is

Debian 13 (trixie) underneath, KDE Plasma on top, Yaya branding, and a curated set of preinstalled software. If you have used Windows or macOS, the desktop will feel familiar: a menu, a taskbar, a settings app, a software centre.

Free, as in rights

Every component is free and open source software. You can read it, change it, copy it onto as many machines as you like, and give it to anyone. Nothing is licensed per seat and nothing expires.

Quiet by default

There is no telemetry, no advertising identifier, and no Yaya account. The system does not need to reach us to work. The only servers it contacts on its own are Debian's, for security updates.

Built for real hardware

Aimed at the machines people actually have, including refurbished ones. A lean Plasma install rather than the full desktop task, so an older laptop stays usable instead of merely booting.

Yours to inspect

The build tree, the packages, and the installer configuration are all public. When we say the disk is encrypted by default, you can go and read the module that does it.

Debian stays upstream

This is the design rule the whole system is built around, and it is the one that decides whether your machine still gets security fixes in three years.

YayaOS does not fork, patch, or rebuild a single Debian source package. The installed system points apt straight at deb.debian.org for trixie, trixie-security and trixie-updates. Security updates arrive from Debian directly, on Debian's schedule, with Debian's signatures — never merged, rebased or re-signed by us.

Everything Yaya-specific lives in a small number of our own packages layered on top. That is the whole surface we are responsible for:

Package	What it is
yaya-branding	os-release, Plymouth boot theme, GRUB, Plasma logo and wallpaper
yaya-desktop	Metapackage pulling in the desktop, apps and hardware support
yaya-firefox-config	Firefox ESR enterprise policy — extensions and privacy defaults
yayaos-archive-keyring	OpenPGP key for our own apt archive, so it verifies from first boot

This is the same shape Linux Mint, Pop!_OS and elementary OS use. It is deliberately boring, and being boring here is the point: a distribution that forks its base is a distribution that eventually stops keeping up with it.

Encrypted by default

On the erase-disk install path, LUKS2 full-disk encryption is on by default. You do not have to find the option. Lose the laptop and the data on it stays yours.

`/boot` is a separate, unencrypted partition

This is a real trade-off and we would rather explain it than hide it. Keeping /boot outside the container is what lets us use LUKS2 with its modern Argon2id key derivation, which resists brute-force far better than the older scheme.

GRUB cannot open an Argon2id container, so encrypting /boot would force the weaker LUKS1/PBKDF2 format on all your data. The cost is that the kernel and initrd sit unauthenticated on disk. Signed kernels with Secure Boot are the answer to that — an encrypted /boot is not.

No key is hidden in the initramfs

Some installers embed a keyfile to avoid asking for your passphrase twice. With /boot in plaintext that would write your volume key onto an unencrypted partition, so we leave that module out of the sequence entirely.

There is no double prompt to work around: GRUB never opens the container, and the initramfs asks you once.

Autologin is off

Installed systems show a normal login prompt. Encryption protects the machine at rest; the login prompt is what makes your screen lock mean anything once it is running. The checkbox is still there if you want it.

Firewall on, updates automatic

ufw is enabled at first boot — deny inbound, allow outbound. unattended-upgrades installs Debian security updates on its own, with no forced reboot; you are told when one is needed.

Our own archive is deliberately excluded from unattended upgrades. Our packages are not security-critical, and auto-installing from an archive we control would mean our mistake reaching every machine unattended.

Download

The honest status, rather than a button that does not work yet.

The first image has not been released.

In development

The build tree, packages and installer configuration are complete and statically validated. What has not happened yet is the part that matters most: installing the encrypted system on real hardware and rebooting into it. Until we have done that, there is no image here to download — publishing an untested full-disk-encryption path is how people lose data.

Configuration validated — package names resolve against trixie, every config parses
First-party packages built — branding, desktop, Firefox policy, archive keyring
Archive host and signing key live — repo.yaya.sh, key published at a stable URL
Publish the signed package archive — dists/ and pool/ under /debian
Build the ISO — hybrid UEFI + BIOS, amd64, live KDE session with the installer on the desktop
Install and boot it — LUKS2 + separate /boot + crypttab + initramfs + GRUB, verified on hardware
Publish signed — ISO, SHA256SUMS, and a detached signature over the checksum file

When it ships it will carry a checksum file signed with the same key that signs the package archive, so you can tell our image apart from a modified one. An ISO published without that is not worth trusting, and we are not going to publish one.

Apps

Yaya's own packages are distributed from our apt archive at repo.yaya.sh. Released images will ship with it preconfigured; on any Debian 13 machine you can add it by hand today.

# 1. Fetch the archive key and check it against the fingerprint below.
curl -fsSL https://repo.yaya.sh/yayaos-archive-2026.asc \
  | sudo gpg --dearmor -o /usr/share/keyrings/yayaos-archive-keyring.gpg

gpg --show-keys /usr/share/keyrings/yayaos-archive-keyring.gpg

# 2. Add the archive, bound to that key and nothing else.
echo "deb [signed-by=/usr/share/keyrings/yayaos-archive-keyring.gpg] \
https://repo.yaya.sh/debian trixie main" \
  | sudo tee /etc/apt/sources.list.d/yayaos.list

sudo apt update

Check the fingerprint. It is published here so you can verify the key you fetched against a second source. Never substitute [trusted=yes] — that disables verification entirely and turns anyone on the network into root on your machine.

F22F 7158 D60A 813D D14F 174B 863B 0B13 3BFC FECF

YayaOS Archive Signing Key (repo.yaya.sh) <andre@yaya.sh> · ed25519 · created 2026-07-23 · expires 2028-07-22

This archive carries only packages we build. It has no authority over anything from Debian, which continues to be verified by Debian's own keys.

Getting help

Talk to people

The Yaya community runs on its own servers — chat, classes, calls and livestreams. chat.yaya.sh is the fastest way to reach someone.

Report a security issue

Email andre@yaya.sh. If you are reporting something sensitive, encrypt it to the archive key above.

Technology that is easy to use and respects your rights.