Open source tools for verifiable security
Most systems still rely on single individuals or computers, unverifiable software, and opaque processes. We’re redesigning security for transparency from the ground up.
Ready to use
Production-ready, verifiable open source tools.
Security-first Linux distribution for reducing supply chain risks. Minimal, bootstrapped, hermetic, deterministic, reproducible, and multi-party signed.
View git repository →Immutable Linux distribution for offline secret management. Diskless, reproducible, and hardened for air-gapped environments.
View git repository →Toolchain for generating and managing a wide range of cryptographic keys offline and on smartcards from a shared BIP39 mnemonic phrase.
View git repository →Framework for rapidly developing applications to perform transfer and staking cryptocurrency operations.
View git repository →Building blocks
for provable security
Modern software systems still rely on trust: maintainers, IT admins, third-party providers. But what happens when they are compromised? How do you verify that your systems haven't been tampered with?
We’ve identified critical gaps and built tools to remove single points of failure across all levels of the software lifecycle, from toolchains and dependencies to how code is built, signed, verified and deployed.
By combining multi-party trust, remote attestation, and bit-for-bit reproducibility, we are eliminating trust assumptions and ensuring security isn't just a claim, it's provable. And as with everything we do, all our software is open source.
See what we're building →Our roadmap
We're actively building some tools and raising support to build others. Here's what's in-progress and what's coming next.
Backlog (fundraising)
Backlog
SigRev
Crowdsource and discover signed manual code reviews.
In-progress
EnclaveOS
Immutable operating system for powering secure enclaves.
ReprOS
Create ephemeral build environments to eliminate persistent risks.
Bootproof
Prove what software booted on a system via remote attestation technologies.
SourceId
Verify source code inegrity with hash-based fingerprints.
Done
StageX
Hermetic, deterministic, reproducible, multi-signed OCI-based build toolchain.
AirgapOS
Minimal, immutable, offline-first swiss-army knife for secret management.
Keyfork
Derive keys from a single entropy source to simplify their management.
Icepick
Framework for offline cryptographic signing operations.
Trove
Documentation for managing secrets that you can't afford to lose.
Powered by Distrust
Turnkey secures billions of dollars in digital assets and relies on Distrust tools to address fundamental risks in their technology stack.
Turnkey secures billions of dollars in digital assets and relies on Distrust tools to systematically address fundamental risks in their technology stack.
Learn more →
The creators of the SUI blockchain, Mysten Labs, eliminate single points of failure in their systems with the help of Distrust tooling and advice.
Learn more →
Sidero Labs' Talos Linux, a widely used Kubernetes distribution, uses Distrust's StageX and services, to bolster their supply chain security.
Learn more →❝We want to use our knowledge to improve security, privacy, and freedom for as many people as possible. We believe that verifiable foundations for building technology are essential to human wellbeing and solving the coordination problem.❝ Distrust team
Build on open source security
Talk to our team about integrating these tools into your stack or building custom security tooling for your environment.
Talk to our team about integrating these tools or building custom security tooling for your environment.