DECRYPT LABSDECRYPT OS · BETA
DECRYPT OS · BETA 4 RC8
Public beta · Mac and PC

Decrypt OS

Decrypt OS is a free, open-source Linux desktop for running trading strategies and bots. It runs in a virtual machine on your own computer, so your trading setup stays separate from your everyday system. Your TradingView strategy alerts run on your own Tradovate account; start on a Simulation account.

Want the full picture first? How Decrypt OS works explains the workspaces, the trade path, strategy access and what is coming next.

Apple Silicon Mac UTM · QEMU Windows / Intel / AMD PC VirtualBox · VMware · QEMU How it works

The disk images are 3 to 7 GB. Verify them before you import. Getting started guide · Release notes

What you need

COMPUTER
An Apple Silicon Mac (M1 or later) with UTM, or a 64-bit Windows, Intel or AMD PC with VirtualBox 7, VMware Workstation 17 or QEMU/KVM on Linux. On a PC, hardware virtualization (Intel VT-x or AMD-V) must be on in the firmware settings.
VIRTUAL MACHINE
4 CPU cores, 8 GB of memory and about 45 GB of free disk space. The computer itself needs more memory than the 8 GB the VM uses.
YOUR ACCOUNTS
Your own TradingView and Tradovate accounts, used only when you choose to connect them. The assistants use your own Claude subscription or Anthropic API key.
FOR TESTING
Start with a Tradovate Simulation or demo account. The engines are not qualified for funded or live accounts in this beta.

Intel Macs and physical installs (without a VM) have not been tested.

Download

One release, two builds: pick the one for your processor. Sizes are approximate; MANIFEST.json in each folder has the exact byte count.

Apple Silicon Mac arm64

Runs in UTM, or in QEMU

decrypt-os-beta4-rc8-arm64.utm.tar UTM bundle. Extract it and open it in UTM. ~3.1 GB · for most Mac users decrypt-os-beta4-rc8-arm64.qcow2 Disk image for QEMU on an arm64 host. ~3.1 GB · QEMU users
Checksums, signature and import notes (arm64)

Folder: downloads.decryptlabs.io/decrypt-os/beta4-rc8/arm64/

Windows, Intel or AMD PC x86_64

Runs in VirtualBox or VMware, or in QEMU/KVM

decrypt-os-beta4-rc8-x86_64.vmdk Disk image for VirtualBox and VMware. ~7.1 GB · most Windows users decrypt-os-beta4-rc8-x86_64.qcow2 Disk image for QEMU/KVM, usually on Linux. ~3.4 GB · QEMU/KVM users

The .vmdk has not been boot-tested in VirtualBox or VMware yet. If it does not start, use the .qcow2 with QEMU/KVM and tell us.

Checksums, signature and import notes (x86_64)

Folder: downloads.decryptlabs.io/decrypt-os/beta4-rc8/x86_64/

Verify before you import

Put the disk image, SHA256SUMS, MANIFEST.json, MANIFEST.json.sshsig and allowed_signers from your build's folder in one place, open a terminal there and run the two checks. If either fails, do not use the files: download again and tell us if it still fails.

The release key's OpenSSH fingerprint is SHA256:fTPlBq3LRYwNA8swEKYocZx/culH9OS2SV+MIWr2QHc. Do not trust a key only because it came with the download; SECURITY.md shows how to check allowed_signers against it.

1. Check the release signature

Same command on every system. On Windows, run it in Command Prompt (cmd.exe), not PowerShell.

ssh-keygen -Y verify -f allowed_signers -I release@decryptlabs.io -n decrypt-os-release -s MANIFEST.json.sshsig < MANIFEST.json

Must print: Good "decrypt-os-release" signature for release@decryptlabs.io

2. Check the file checksums

MAC

shasum -a 256 -c SHA256SUMS

LINUX

sha256sum -c SHA256SUMS

Must print OK after each file you downloaded. A file you did not download is reported as missing or failed to open; that is fine.

WINDOWS (POWERSHELL)

Get-FileHash -Algorithm SHA256 <file>

Replace <file> with the disk image's file name. The hash must match that file's line in SHA256SUMS. The guide's Windows section has a PowerShell script that compares them for you.

What the checks prove

MANIFEST.json lists each file with its size and SHA-256 and names the source commit the build came from. The signature is over the manifest. A good signature plus matching checksums means the image on your disk is the one we built. MANIFEST.json.sig and release-public.pem are the same signature and key in OpenSSL format, for tools that prefer it.

Import and first start

Import a copy of the disk and keep the downloaded files unchanged, so you can start over from a clean copy. The getting started guide has the full import settings for each hypervisor; IMPORT.md in each download folder has the short version.

UTM on a Mac
  1. Extract decrypt-os-beta4-rc8-arm64.utm.tar. It unpacks to Decrypt-OS.utm.
  2. Open Decrypt-OS.utm in UTM and press Play.
VirtualBox 7 or VMware Workstation 17 on a PC
  1. Create a new 64-bit Linux virtual machine with 4 CPU cores and 8 GB of memory.
  2. Turn EFI on and Secure Boot off.
  3. Attach decrypt-os-beta4-rc8-x86_64.vmdk as the existing disk, then start the VM.
QEMU or KVM

Use the .qcow2 for your processor type with UEFI firmware, a VirtIO disk, VirtIO GPU and networking. On a Mac that is an aarch64 virt machine. Give it at least 4 CPU cores and 8 GB of memory.

First start
  • Choose a user name and password, then pick your time zone. The machine gets its own identity, SSH host keys and package keyring at that point.
  • Sign in, read the notice and accept it.
  • Nothing is logged in, and no trading or broker connection is active until you set it up in the Decrypt app. The Home page shows your next step.

Guide, release notes and feedback

GETTING STARTED
GETTING-STARTED.md ↗
Requirements, download, verification, import, first start, the desktop and the setup order. One guide for both builds.
RELEASE NOTES
RELEASE-NOTES.md ↗
What beta 4 includes, the 7 engines and their status, and the known issues and limits. Read the known issues before you trade.
FEEDBACK
Report a problem or send feedback ↗
GitHub Issues, with templates for a bug report, feedback and a strategy access problem. Never post account numbers, tokens or passwords.
HOW IT WORKS
How Decrypt OS works
The workspaces, the trade path, strategy access, safety and what is coming next.

Strategies and your privacy

Decrypt's strategies are invite-only TradingView scripts and are not included in the image. Decrypt Labs grants them to your TradingView username by hand, so allow some time. Send the request from the app's Strategy access page, or with your TradingView username on the holder dashboard. Lumi RTH Gap and Order Blocks Decoded have no public TradingView page yet.

Request strategy access ↗

A request stores your TradingView username, an optional contact method, a salted hash of the request's IP address (used only for rate limits), the strategies you picked, the time, and whether it was sent. Nothing else in Decrypt OS sends data anywhere by itself. Full note: PRIVACY.md.

What each stored item is for, and how to have it removed

The username and status are how access is added and tracked. The IP hash is used only for rate limits, so the form cannot be used to flood the queue; the raw address is not stored, and the hash is not used to identify or track you and is not shared. The contact method is used only to follow up on that request.

To have your request data removed, open a GitHub issue with the Strategy access problem template or contact Decrypt Labs through decryptlabs.io, and include the TradingView username the request used.

Source code

Decrypt OS is free software under the GNU AGPL-3.0 at github.com/Dropkingeth/decrypt-os. Each release manifest names the commit the images were built from. Security reports go through the repository's private vulnerability reporting.