{"slug": "stagex", "name": "stagex", "category": "os", "category_name": "Operating systems and desktop", "description": "", "recommenders": 3, "commenters": 6, "warners": 0, "score": 3.571, "rising": 0.35, "first": "2025-11-17", "latest": "2026-10-14", "why": "For even smaller images that are always deterministic/reproducible with a multi-party signed supply chain, check out https://stagex.tools", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "For even smaller images that are always deterministic/reproducible with a multi-party signed supply chain, check out https://stagex.tools", "kind": "", "icon": true, "domain": "stagex.tools", "github_repo": null, "official_url": "https://stagex.tools/", "pricing": "", "aliases": ["stagex", "StageX", "Stagex"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 802785233, "item_id": 50174077, "url": "https://news.ycombinator.com/item?id=50174077", "by": "lrvick", "date": "2026-10-20", "stance": "recommend", "quote": "See https://stagex.tools for contrast.", "excerpt": "Just remember that NixOS is only for personal and hobby use cases, as it is maintained by a large community of people that can ship any code they want without review, anchored on the honor system. Think wikipedia anons managing your browser and password manager. If you want high supply chain security appropriate for production use, it is a lot more work that a lot fewer people are willing to do, which means far fewer", "context": "", "use_case": "", "switched_from": "", "story": "NixOS is making me less afraid"}, {"id": 801551921, "item_id": 50096995, "url": "https://news.ycombinator.com/item?id=50096995", "by": "rcxdude", "date": "2026-10-14", "stance": "recommend", "quote": "there are multiple projects which provide ways for you to run a full source bootstrap", "excerpt": "Indeed, and there are multiple projects which provide ways for you to run a full source bootstrap of not just rust but the entire C and C++ toolchain: https://guix.gnu.org/manual/1.5.0/en/html_node/Full_002dSource-Bootstrap.html https://stagex.tools/ (I think nixOS also has some work in this area, but I'm not sure how complete it is)", "context": "", "use_case": "Full source bootstrapping", "switched_from": "", "story": "Problems with the Rust Language"}, {"id": 792075362, "item_id": 49504710, "url": "https://news.ycombinator.com/item?id=49504710", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "Stay tuned for stagex for workstations.", "excerpt": "Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage. Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise. Stay tuned", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 787496064, "item_id": 49218504, "url": "https://news.ycombinator.com/item?id=49218504", "by": "lrvick", "date": "2026-08-07", "stance": "recommend", "quote": "https://stagex.tools", "excerpt": "https://stagex.tools", "context": "", "use_case": "", "switched_from": "", "story": "The Nixpkgs core team has disbanded"}, {"id": 787495952, "item_id": 49218497, "url": "https://news.ycombinator.com/item?id=49218497", "by": "lrvick", "date": "2026-08-07", "stance": "recommend", "quote": "full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix", "excerpt": "Anyone looking for a full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix, check out https://stagex.tools https://codeberg.org/stagex/stagex", "context": "", "use_case": "reproducible builds", "switched_from": "", "story": "The Nixpkgs core team has disbanded"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["full source bootstrapping", "building caution", "reproducible builds", "reproducible builds toolchain", "building toolchain from source", "reproducible linux distro"], "compared": [{"slug": "gnu-guix", "name": "GNU Guix", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "qubes-os", "name": "Qubes OS", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "debian", "name": "Debian", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "nixos", "name": "NixOS", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "nix", "name": "Nix", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "docker-hardened-images", "name": "Docker Hardened Images", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "musl", "name": "musl", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 803597217, "item_id": 50224826, "url": "https://news.ycombinator.com/item?id=50224826", "by": "lrvick", "date": "2026-10-24", "stance": "recommend", "quote": "Any software I absolutely need to -trust- is built with stagex and run in dedicated enclaves", "excerpt": "I do not carry or use a cell phone at all, and most people are probably better off with a dumb phone or no phone either over the current options, IMO. I rarely leave home with any electronics at all. Sometimes a portable music player. My only portable computers are sub 10 inch laptops running QubesOS, but will be replacing that with an OS of my own design soon based on stagex, which I founded. Any software I absolute", "context": "Carries no cell phone; founded stagex", "use_case": "Trusted software builds", "switched_from": "", "story": "Apple Security Research Device"}, {"id": 799531088, "item_id": 49970693, "url": "https://news.ycombinator.com/item?id=49970693", "by": "lrvick", "date": "2026-10-05", "stance": "neutral", "quote": "the entire distro is always built in one-shot at any given commit", "excerpt": "https://stagex.tools In short, the entire distro is always built in one-shot at any given commit, and we can only rely on cached binaries from a past release if they or nothing in their supply chains changed. Given rustc depends on almost everything, mold3 would be built far too late to be useful for the most expensive build in the whole tree, which is rust. Recursive dependencies would break our threat model, so we ", "context": "", "use_case": "", "switched_from": "", "story": "Mold Linker Version 3.0.0 Release \u2013 Rewritten in Rust"}, {"id": 795330288, "item_id": 49708143, "url": "https://news.ycombinator.com/item?id=49708143", "by": "lrvick", "date": "2026-09-15", "stance": "recommend", "quote": "We did that, but in containers.", "excerpt": "We did that, but in containers. https://stagex.tools/", "context": "", "use_case": "Containerized Linux bootstrapping", "switched_from": "", "story": "Linux from Scratch"}, {"id": 792112304, "item_id": 49507019, "url": "https://news.ycombinator.com/item?id=49507019", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "protecting hundreds of billions of dollars in fintech infrastructure right now", "excerpt": "I am not convinced you processed what I wrote, but I will attempt to answer your questions anyway because they will aid me in writing docs later. > 1) How does the data in that root partition get rebuilt? If it's on another computer, how does one control access to the root-partition-rebuild computer? If they use an official one published by their distro, then it is likely sufficient that it is signed by a key in a mu", "context": "", "use_case": "Deterministic bootstrapped Linux build", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 792015681, "item_id": 49500980, "url": "https://news.ycombinator.com/item?id=49500980", "by": "lrvick", "date": "2026-08-30", "stance": "neutral", "quote": "I use QubesOS and my own distro, stagex.", "excerpt": "No popular Linux desktop, I would grant you. I use QubesOS and my own distro, stagex.", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 791856608, "item_id": 49491038, "url": "https://news.ycombinator.com/item?id=49491038", "by": "lrvick", "date": "2026-08-29", "stance": "recommend", "quote": "Always happy to train up new packagers and maintainers.", "excerpt": "https://stagex.tools Always happy to train up new packagers and maintainers.", "context": "", "use_case": "", "switched_from": "", "story": "Debian votes to allow \"responsible use of generative AI\""}], "threads": [{"url": "https://news.ycombinator.com/item?id=49499854", "title": "Omarchy: Any User Process Can Escalate to Root", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=49217993", "title": "The Nixpkgs core team has disbanded", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47745284", "title": "Taking on CUDA with ROCm: 'One Step After Another'", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47699181", "title": "Open Source Security at Astral", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49473868", "title": "Bootstrappable Builds: How and Why", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49133889", "title": "RipGrep musl binaries occasionally segfault during very-large searches", "mentions": 2}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"neutral": 2, "recommend": 2}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 802785233, "item_id": 50174077, "url": "https://news.ycombinator.com/item?id=50174077", "by": "lrvick", "date": "2026-10-20", "stance": "recommend", "quote": "See https://stagex.tools for contrast.", "excerpt": "Just remember that NixOS is only for personal and hobby use cases, as it is maintained by a large community of people that can ship any code they want without review, anchored on the honor system. Think wikipedia anons managing your browser and password manager. If you want high supply chain security appropriate for production use, it is a lot more work that a lot fewer people are willing to do, which means far fewer", "context": "", "use_case": "", "switched_from": "", "story": "NixOS is making me less afraid"}, {"id": 801551921, "item_id": 50096995, "url": "https://news.ycombinator.com/item?id=50096995", "by": "rcxdude", "date": "2026-10-14", "stance": "recommend", "quote": "there are multiple projects which provide ways for you to run a full source bootstrap", "excerpt": "Indeed, and there are multiple projects which provide ways for you to run a full source bootstrap of not just rust but the entire C and C++ toolchain: https://guix.gnu.org/manual/1.5.0/en/html_node/Full_002dSource-Bootstrap.html https://stagex.tools/ (I think nixOS also has some work in this area, but I'm not sure how complete it is)", "context": "", "use_case": "Full source bootstrapping", "switched_from": "", "story": "Problems with the Rust Language"}, {"id": 792118883, "item_id": 49507430, "url": "https://news.ycombinator.com/item?id=49507430", "by": "lrvick", "date": "2026-08-31", "stance": "neutral", "quote": "built with https://stagex.tools", "excerpt": "> It's an aftermarket mod Unfortunately one I have never seen a MacOS production engineering guide that does not say \"install brew\" as like step one, exactly because Apple failed to provide a software suite sufficient to meet developer needs on par with that of major linux distributions. Macports is at least maintained by current/former apple employees and signs their packages, but in practice no one knows macports e", "context": "", "use_case": "Building Caution", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 792075362, "item_id": 49504710, "url": "https://news.ycombinator.com/item?id=49504710", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "Stay tuned for stagex for workstations.", "excerpt": "Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage. Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise. Stay tuned", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 787496064, "item_id": 49218504, "url": "https://news.ycombinator.com/item?id=49218504", "by": "lrvick", "date": "2026-08-07", "stance": "recommend", "quote": "https://stagex.tools", "excerpt": "https://stagex.tools", "context": "", "use_case": "", "switched_from": "", "story": "The Nixpkgs core team has disbanded"}, {"id": 787495952, "item_id": 49218497, "url": "https://news.ycombinator.com/item?id=49218497", "by": "lrvick", "date": "2026-08-07", "stance": "recommend", "quote": "full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix", "excerpt": "Anyone looking for a full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix, check out https://stagex.tools https://codeberg.org/stagex/stagex", "context": "", "use_case": "reproducible builds", "switched_from": "", "story": "The Nixpkgs core team has disbanded"}, {"id": 786238898, "item_id": 49139931, "url": "https://news.ycombinator.com/item?id=49139931", "by": "NewJazz", "date": "2026-08-01", "stance": "neutral", "quote": "", "excerpt": "Interesting. Not sure if you are aware, but your toolchain looks nearly identical to another linux distribution.. You might have luck looking for patches there if you ever need them. https://chimera-linux.org/about/#alternative-userland", "context": "", "use_case": "", "switched_from": "", "story": "RipGrep musl binaries occasionally segfault during very-large searches"}, {"id": 766003424, "item_id": 47875214, "url": "https://news.ycombinator.com/item?id=47875214", "by": "evanjrowley", "date": "2026-04-23", "stance": "recommend", "quote": "one exotic approach to this problem is stagex", "excerpt": "adding to the list, one exotic approach to this problem is stagex https://codeberg.org/stagex/stagex", "context": "", "use_case": "Reproducible builds toolchain", "switched_from": "", "story": "Arch Linux Now Has a Bit-for-Bit Reproducible Docker Image"}, {"id": 765166513, "item_id": 47822907, "url": "https://news.ycombinator.com/item?id=47822907", "by": "pabs3", "date": "2026-04-19", "stance": "recommend", "quote": "Its possible to avoid all of those binaries", "excerpt": "Its possible to avoid all of those binaries (including the Linux kernel) and build from source instead. https://bootstrappable.org/ https://lwn.net/Articles/983340/ https://github.com/fosslinux/live-bootstrap https://stagex.tools/", "context": "", "use_case": "building toolchain from source", "switched_from": "", "story": "Binary Dependencies: Identifying the Hidden Packages We All Depend On"}, {"id": 764122736, "item_id": 47757671, "url": "https://news.ycombinator.com/item?id=47757671", "by": "lrvick", "date": "2026-04-13", "stance": "recommend", "quote": "signed commits, signed reviews, container-native design, full source bootstrapping, 100% deterministic builds, and multi-party-signed artifacts check out https://stagex.tools", "excerpt": "For those that like the LLVM/musl/mimalloc choices of chimera, but also want signed commits, signed reviews, container-native design, full source bootstrapping, 100% deterministic builds, and multi-party-signed artifacts check out https://stagex.tools", "context": "", "use_case": "reproducible Linux distro", "switched_from": "", "story": "Just Enough Chimera Linux"}, {"id": 764012914, "item_id": 47750807, "url": "https://news.ycombinator.com/item?id=47750807", "by": "zby", "date": "2026-04-13", "stance": "neutral", "quote": "", "excerpt": "It is sad to observe this time and time again. Last year I had the idea to run a shareholder campaign to change this, I suspended it after last years AMD promises - but maybe this really needs to be done: https://unlockgpu.com/action-plan/", "context": "", "use_case": "Reproducible build toolchain", "switched_from": "", "story": "Taking on CUDA with ROCm: 'One Step After Another'"}, {"id": 763938002, "item_id": 47746125, "url": "https://news.ycombinator.com/item?id=47746125", "by": "jauntywundrkind", "date": "2026-04-12", "stance": "neutral", "quote": "", "excerpt": "https://github.com/ROCm/TheRock/issues/3477 makes me quite sad for a variety of reasons. It shouldn't be like this. This work should be usable.", "context": "", "use_case": "", "switched_from": "", "story": "Taking on CUDA with ROCm: 'One Step After Another'"}, {"id": 740030224, "item_id": 46251889, "url": "https://news.ycombinator.com/item?id=46251889", "by": "lrvick", "date": "2025-12-12", "stance": "recommend", "quote": "For even smaller images that are always deterministic/reproducible with a multi-party signed supply chain, check out https://stagex.tools", "excerpt": "For even smaller images that are always deterministic/reproducible with a multi-party signed supply chain, check out https://stagex.tools", "context": "", "use_case": "small reproducible container images", "switched_from": "", "story": "Building small Docker images faster"}, {"id": 735369730, "item_id": 45960608, "url": "https://news.ycombinator.com/item?id=45960608", "by": "pabs3", "date": "2025-11-17", "stance": "recommend", "quote": "so far only GNU Guix and StageX have worked out how to start from the BB work to get a full distro", "excerpt": "Debian manages to build Chromium, Firefox, and LLVM on servers of multiple architectures, including quite slow riscv64 machines, without any network access to the builds for any architecture. https://buildd.debian.org/status/package.php?p=firefox-esr See Bootstrappable Builds for starting from almost nothing, so far only GNU Guix and StageX have worked out how to start from the BB work to get a full distro. Should be", "context": "", "use_case": "", "switched_from": "", "story": "Azure hit by 15 Tbps DDoS attack using 500k IP addresses"}, {"id": 732645616, "item_id": 45790351, "url": "https://news.ycombinator.com/item?id=45790351", "by": "lrvick", "date": "2025-11-02", "stance": "neutral", "quote": "https://codeberg.org/stagex/stagex/src/branch/main/packages/bootstrap/stage0/Containerfile", "excerpt": "From 180 bytes of human readable machine code all the way up. https://codeberg.org/stagex/stagex/src/branch/main/packages/bootstrap/stage0/Containerfile", "context": "", "use_case": "", "switched_from": "", "story": "GHC now runs in the browser"}]}