Specification draft
QuantumUnix is an Omarchy/Arch-based desktop profile with security and privacy overlays, release verification, and post-quantum crypto policy.
Platform stack
| Area | Preferred choice | Reason |
|---|---|---|
| Base | Arch Linux + Omarchy | Lightweight, rolling, modern package base with an opinionated Hyprland desktop workflow. |
| Window system | Hyprland / Wayland | Keyboard-first tiling workflow, modern graphics stack, cleaner isolation than legacy X11 patterns. |
| Shell workflow | zsh/bash + tmux + neovim | Unix-style composability and reproducible text configuration. |
| Security | AppArmor/Landlock/seccomp profiles where practical | Defense-in-depth without hiding how the system works. |
| Privacy | No telemetry, DNS privacy, hardened browser | Data minimization and explicit consent. |
| Release trust | Checksums, signatures, SBOMs, build logs | Users can verify what they install. |
Layer model
Arch Linux repositories and official package tooling.
Omarchy: Hyprland workflow, hotkeys, theme propagation, developer packages.
Privacy/security defaults, post-quantum crypto profiles, verification docs, release images.
Optional certificates, identity provider, VPN/proxy, software catalog, compliance policy.
Dotfiles, local tools and personal workspace customizations.
Functional requirements
- Full-disk encryption guidance and secure backup workflow.
- Browser hardening profile and extension policy.
- Documented software catalog and optional self-service package layer.
- Rollback-friendly update and recovery procedure.
- Fleet bootstrap script for pilot devices.
- Public SBOM and vulnerability response process.
Crypto policy
CLASSIC
Maximum compatibility: conventional TLS/SSH algorithms with modern safe defaults.
HYBRID
Default pilot mode: classical + post-quantum key exchange where peers support it.
PQ-STRICT
Research/pilot mode: reject non-PQ-capable endpoints where operationally possible.
Disk encryption remains conventional LUKS2 for now. The PQ layer focuses first on network transport and software supply-chain signatures.