Utahraptor

LUKS ISO test passed for commit c840e304dbbe. CI run; screenshots and provenance.

†Utahraptor ostrommaysi

Bluefin built on Fedora Hummingbird. The more ... civilized murder machine.

Your day keeps getting worse. Why are there more.

Experimental pre-alpha — the image builds, boots, and installs end to end in local QEMU validation: the live ISO's bootc-installer creates a LUKS2-encrypted disk from the ISO's embedded container store with no network, and the installed system boots on its own to GDM and a GNOME session (verified record: docs/verification). Testing container images and live ISOs are available for hardware testing, but nothing here is ready to run on a machine you care about yet. Filing issues is the whole point.

What it is

Bluefin built on Fedora Hummingbird — a minimal, hardened bootable container base that ships without a desktop. Utah adds the Bluefin experience and a GNOME 51 desktop compiled from upstream source.

Utah is built across two repositories:

Repository	What it does
projectbluefin/utah	Assembles the bootable OS image and live ISO.
projectbluefin/utah-packages	Compiles GNOME 51 and desktop packages from source into an OCI repository.

Download and image streams

• Testing ISO (AMD / Intel): utah-live-latest.iso (SHA-256 checksum)
• Live versions & downloads: docs.projectbluefin.io/utah

The testing ISO is hosted on projectbluefin.dev, not published by this repository's workflows (CI here only uploads utah-live.iso as a short-lived workflow artifact). Verify the download against its checksum before use.

Like Bluefin, Utah builds four hardware flavors (utah, utah-nvidia, utah-gaming, utah-nvidia-gaming) from config/flavors.json:

Tag	Stream	Status
:testing	Testing	Published at ghcr.io/projectbluefin/utah:testing after end-to-end ISO validation passes.
:stable	Stable	Planned; promoted from :testing once ready.

Package parity with Bluefin

packages/bluefin.toml is a byte-for-byte copy of Bluefin's base.toml, checked in CI on every run so the package list never drifts silently.

	count
Bluefin contract installed	61
Utah additions (GNOME 51, base-image parity, device firmware, desktop services)	141
Genuinely unavailable	7

Known gaps

Why this is still pre-alpha:

• Disable Secure Boot. The live ISO (systemd-boot-unsigned), custom OGC kernel, NVIDIA driver, and v4l2loopback module are not signed yet. Boot via UEFI with Secure Boot off, and flash the ISO directly with Fedora Media Writer or dd (Ventoy and legacy BIOS are unsupported). The live session runs SELinux permissive; installed systems run Enforcing.
• Switching from another bootc image. Ostree's 3-way /etc merge can carry over bootc-fetch-apply-updates.timer from another image. Utah masks bootc-fetch-apply-updates so background updates go through uupd instead of silently undoing a bootc rollback. After switching, check systemctl is-enabled bootc-fetch-apply-updates.timer.
• Bootloader updates. Systems on systemd-boot update their EFI partition via bootctl (systemd-boot-update.service), so bootupctl status intentionally shows no components. Check bootctl status instead.
• Hardware, codecs, and drivers need real-world testing. Intel/Linux Wi-Fi firmware and Intel media drivers are included, and the OGC kernel (sched_ext, binderfs) and open NVIDIA module compile, but hardware video decoding, Wi-Fi, and gaming flavors still need testing on physical machines (#383).
• CUDA is excluded to save 7.68 GB in the base image. Use the included NVIDIA Container Toolkit to run CUDA inside containers.

See the open issues to track progress or report bugs.

Contributing

See docs/building.md to build locally, docs/skills/ for architecture docs, and AGENTS.md for agent rules.