Everything needed to build CyberMyth OS, a Debian-based ARM64 operating
system for the Microsoft Surface Pro 12 (1st Edition, Snapdragon X1P42100).
CyberMyth OS is an independent derivative of Debian. It is not Debian, is not produced or endorsed by the Debian Project, and is not affiliated with Microsoft, Qualcomm, Canonical or the Linux kernel project.
This repository is the build system. You do not need it to run CyberMyth OS.
| Website | https://cybermyth.dev |
| Downloads | https://images.cybermyth.dev |
| Base | Debian 13 (trixie), arm64 |
| Hardware | Microsoft Surface Pro 12, 1st Edition — Snapdragon X1P42100 |
| Kernel | 7.2.3-cybermyth-sp12 |
| Desktop | GNOME 48 on Wayland |
| Installer | Calamares |
| Focus | anonymity and security tooling — Tor and Tor Browser, an anonymity/killswitch CLI, and a network and Active Directory toolset |
CyberMyth OS targets one device. It is not a general-purpose distribution: the kernel carries an out-of-tree patch series for Surface Pro 12 hardware, and the image ships firmware and a device tree for that machine only. It will not boot on other hardware.
Secure Boot must be disabled — the kernel is signed by no key in any firmware database.
The rest of this file is for building the image. Documentation for using the OS lives on the website.
Copyright © 2026 Toshith Yadav.
The build scripts, installer, packaging and documentation in this directory are
released under the GNU General Public License, version 3 or later
(SPDX: GPL-3.0-or-later). See https://www.gnu.org/licenses/gpl-3.0.html.
Two files carry a different licence because of what they derive from:
| File | Licence | Why |
|---|---|---|
kernel/sp12-v7.2-rc7.patch |
GPL-2.0-only |
a diff against Linux kernel source |
kernel/0001-remoteproc-qcom-q6v5-Make-handover-IRQ-one-shot.patch |
GPL-2.0-only |
mainline commit bb7c5d6f5b41, backported |
kernel/config-cybermyth-sp12 |
GPL-2.0-only |
a Linux kernel configuration |
This section is a good-faith summary of licensing, not legal advice. If you redistribute builds commercially, review the terms of every component yourself.
| Path | Purpose |
|---|---|
build-cybermyth-desktop.sh |
builds the complete OS image |
calamares/ |
the installer: Calamares configuration, branding and its two helper scripts |
kernel/ |
kernel patches, config and the kernel build script |
firmware/ |
ath12k firmware + a fetch script for the Surface blobs |
branding/ |
logos, wallpaper, Plymouth theme, ALSA UCM configs |
keyring/ |
public key of the CyberMyth APT repository, installed into the image |
write-usb.sh |
writes a built image to a USB drive |
test-grub-loader.sh |
rewrites only the bootloader on a flashed USB, to test a GRUB change without rebuilding |
installer/ |
the terminal installer used up to CyberMyth 1.0. Kept for reference; not shipped in the image |
It is self-contained: with the inputs below it can produce the entire OS.
Redistributed here, with their licences:
| Component | Origin | Licence |
|---|---|---|
| ath12k WCN7850 firmware | upstream linux-firmware |
redistributable, unmodified, Qualcomm-chipset only — see firmware/ath12k/LICENSE.QualcommAtheros |
| ALSA UCM configs | alsa-project/alsa-ucm-conf |
BSD-3-Clause |
| AudioReach topology (built) | linux-msm/audioreach-topology v1.0.4 |
BSD-3-Clause |
| ARM64 GRUB modules | Debian grub-efi-arm64-bin |
GPL-3.0-or-later |
| Hardware kernel patch | Mias van Klei (Gentoo overlay) | GPL-2.0-only |
| ADSP handover fix | Abel Vesa, mainline bb7c5d6f5b41 |
GPL-2.0-only |
Installed from Debian at build time and not redistributed here: GNOME, the
Linux kernel source, and every package pulled by apt.
The Qualcomm/Microsoft Surface Pro 12 firmware — ADSP, CDSP, GPU, sensor DSP
blobs — is not included. Those are proprietary binaries extracted from the
device and carry no licence granting redistribution. firmware/fetch-surface-firmware.sh
downloads them from a pinned upstream commit so each builder obtains them
directly. Do not commit them to this repository or ship them in a public image.
CyberMyth OS is a thin layer over other people's work:
- The Linux kernel — Linus Torvalds and contributors.
- The Debian Project — the entire base system. CyberMyth is a derivative; Debian neither endorses nor is affiliated with it.
- Mias van Klei — the Surface Pro 12 kernel patch series that makes this hardware work at all: device tree, Surface Aggregator (the Type Cover), the eDP panel, the RTC driver, GPIO/regulator fixes and the camera series.
- Harrison van der Byl — Surface Pro 12 hardware research and firmware layout.
- The ALSA project, GNOME, GNU, Qualcomm's linux-msm and linux-firmware maintainers, and the Debian Security Tools team.
Full detail, with licences, is in COPYRIGHT.
- Debian is a registered trademark of Software in the Public Interest, Inc. CyberMyth OS is a derivative and is not endorsed by the Debian Project.
- Microsoft and Surface are trademarks of Microsoft Corporation. Device names are used only to identify the hardware this OS targets.
- Qualcomm and Snapdragon are trademarks of Qualcomm Incorporated.
- GNOME is a trademark of the GNOME Foundation.
- Linux is a registered trademark of Linus Torvalds.
- Ubuntu and Canonical are trademarks of Canonical Ltd.
No trademark holder endorses this project.
# 1. kernel source (see ../kernel.md)
cd .. && curl -O https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
tar xf linux-7.2.3.tar.xz
# 2. build it -- applies both patches and the config, then compiles
work/kernel/build-kernel.sh
# 3. Surface firmware (not redistributable, fetched per-builder)
./firmware/fetch-surface-firmware.sh
# 4. the image
sudo ./build-cybermyth-desktop.sh --fresh
# 5. write it
sudo ./write-usb.sh ./cybermyth-sp12-desktop.img /dev/sdXProduces cybermyth-sp12-desktop.img (~12 GB) and a .img.zst (~2.7 GB) for
distribution, each with a SHA-256 sidecar.
--fresh starts over. Without it the build resumes: the IMAGE, DEBOOTSTRAP,
APT, CMPKGS, KERNEL and SHRINK stages are skipped if already recorded in
cybermyth-sp12-desktop.img.state, while branding, the installer, the chroot
configuration and the bootloader are rebuilt every run. Use --fresh whenever a
package list or the kernel changes.
Everything the build reads lives in this directory, apart from the kernel tree
and one host file, /usr/share/grub/unicode.pf2 from grub-common. Building on
an x86_64 host also needs qemu-user-static with binfmt_misc registered, so
the arm64 chroot runs transparently.
Reproducibility: every external input is pinned and checksum-verified — kernel base commit, kernel patch, kernel config, ath12k firmware, the AudioReach topology, the ALSA UCM files and the GRUB modules. The build fails rather than silently substituting a different version.
This software is provided "as is", without warranty of any kind, express or implied. Installing an operating system can erase data, including a Windows installation on the same disk.
Calamares offers "Erase disk" alongside manual partitioning, and that option
cannot be removed by configuration. CyberMyth pre-selects manual
partitioning and sets prompt-install, so a confirmation is required before
any change is written, but nothing stops you choosing to erase the disk. Read
the summary page before confirming.
What CyberMyth's own installer steps guarantee is narrower, and only concerns
the EFI System Partition: the existing ESP is reused and never formatted, one
file is added to it (/EFI/cybermyth/BOOTAA64.EFI), /EFI/Microsoft and
/EFI/BOOT are never read or written, and existing EFI boot entries are listed
but never deleted.
You remain responsible for backups and for verifying the target partition before confirming.