Debian: Enterprise Linux Ledger 2026 Scorecard

Part of the Enterprise Linux Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project
Owner: Debian Project (volunteer-run under the Debian Constitution; a Debian Project Leader is elected yearly, Sruthi Chandran from 2026-04-21)
Licence: Free software under the Debian Free Software Guidelines; no subscription; Freexian sells Extended LTS by quote
Latest release: 13.7 (2026-09-12); 12.15 (2026-07-11)
Support lifecycle: 13: full security support to 2028-08-09, LTS to 2030-06-30; 12: LTS to 2028-06-30; Extended LTS (Freexian) to 2033-06-30 for 12 and 2035-06-30 for 13
Next milestone: Debian 14 (forky) in testing, no release date set
Support window: About 3 years of full security support plus LTS to 5 years per release; paid Extended LTS to 10 years; source: debian.org/releases and wiki.debian.org/LTS
Tier: Community distribution
Archetype: Volunteer upstream base
Evidence grade: A. Release announcements for Debian 8 to 13, the releases page, the LTS and Cloud wiki pages, the vote pages and the Freexian Extended LTS page were read directly. The first packaged release of Podman and Cockpit and the start of NVIDIA's Debian CUDA repository were not re-read and are marked in the steps.

Scorecard

Dimension	Score	Direction
Capability today	66.0 / 100	higher is better
Momentum since end of 2022	+4.5 points (2015 to 2022: +6.5)	higher is better
Credibility	19.0 / 25	higher is better
Sustainability risk	5.0 / 25	lower is better
Technical lock-in	2.0 / 25	lower is better
Integrator fit	7.5 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	61.4 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Lifecycle and upgrades (15)	3.5	3.5	3.5	3.5
Security and compliance (15)	2.5	3	3	3.5
Hardware and architectures (10)	3.5	3.5	3.5	4.5
Virtualization and cloud images (10)	3.5	3.5	3.5	3.5
Containers and Kubernetes host (10)	2	2	3.5	3.5
Software currency and packaging (10)	4	4	4	4
Fleet management and automation (10)	1.5	1.5	2	2
Storage and filesystems (5)	3.5	3.5	3.5	3.5
Enterprise integration and certifications (5)	2.5	2.5	2.5	2.5
AI and GPU readiness (10)	1	1.5	1.5	2
Total / 100	55.0	57.5	61.5	66.0

Year by year: 2015: 55.0 · 2016: 55.0 · 2017: 55.0 · 2018: 55.0 · 2019: 57.5 · 2020: 57.5 · 2021: 61.5 · 2022: 61.5 · 2023: 62.5 · 2024: 62.5 · 2025: 66.0 · 2026: 66.0

What moved the score

Year	Domain	Change	Points	Trigger
2019	AI and GPU readiness	1 → 1.5	+1.0	NVIDIA publishes a CUDA repository for Debian 10 (repository start date not read)
2019	Security and compliance	2.5 → 3	+1.5	10: AppArmor enabled by default; Secure Boot on amd64, i386 and arm64
2021	Containers and Kubernetes host	2 → 3.5	+3.0	11: kernel 5.10 base with Podman, containerd and CRI-O in the archive (first packaged release not re-read)
2021	Fleet management and automation	1.5 → 2	+1.0	11: Cockpit web console in the stable archive (first packaged release not re-read)
2023	Hardware and architectures	3.5 → 4	+1.0	12: installer enables non-free firmware where hardware needs it
2025	AI and GPU readiness	1.5 → 2	+1.0	13: ROCm libraries in the Debian repositories; NVIDIA CUDA repository for Debian 13
2025	Hardware and architectures	4 → 4.5	+1.0	13: riscv64 official; seven architectures (amd64, arm64, armel, armhf, ppc64el, riscv64, s390x)
2025	Security and compliance	3 → 3.5	+1.5	13: Secure Boot with systemd-boot; reproducible builds status tool (9 already built over 90% of sources reproducibly)

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-06	12 (2023-06-10): installer enables non-free firmware where needed	Hardware	C
2023-06	12: kernel 6.1 LTS; 64,419 packages	Packaging	U
2024-08	11 handed to the LTS team (2024-08-15) for i386, amd64, armhf and arm64	Lifecycle	C
2025-01	Codename duke for Debian 15 announced, no dates	Lifecycle	V
2025-08	13 (2025-08-09): riscv64 official, seven architectures; i386 no longer a regular architecture	Hardware	C
2025-08	13: kernel 6.12 LTS; 69,830 packages; 64-bit time_t	Packaging	U
2025-08	13: Secure Boot with systemd-boot; reproducible builds status tool	Security	C
2025-08	13: ROCm libraries available in the repositories	AI	C
2026-04	New Debian Project Leader Sruthi Chandran (sole candidate, 289 to 50 against none of the above)	Governance	C
2026-06	12 handed to the LTS team (2026-06-11), LTS to 2028-06-30	Lifecycle	C
2026-08	General resolution 'Responsible Use of Generative AI' adopted (vote to 2026-08-28), after a 2025 resolution on AI models was withdrawn	Governance	V
2026-08	11 LTS ends 2026-08-31; Freexian Extended LTS to 2031-06-30	Lifecycle	M
2026-09	13.3 to 13.7 point releases every two months (13.7 on 2026-09-12)	Lifecycle	C

Centre of gravity: Lifecycle (5), Hardware (2), Packaging (2)
Blind spots (no items): Virtualization and cloud, Containers, Fleet management, Storage, Enterprise integration, Licensing
Driver mix: Vision 15%, Customer need 62%, Market window 8%, Upstream 15%, Portfolio 0%
Idea-to-need index: 0.18 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 19.0 / 25

Criterion	Score	Basis
Cadence	3	A stable release about every two years (2023-06-10, 2025-08-09) with no dates announced in advance; point releases every two months
Roadmap transparency	4.5	Everything is public: bug tracker, release team pages, votes, security tracker; there is no dated roadmap
Say-do	4	Debian announces little and ships what it freezes; the 2025 AI resolution was withdrawn and replaced in 2026
Velocity	3	Each release refreshes the base and adds one or two platform changes (firmware in 12, riscv64 and systemd-boot in 13)
Lifecycle stability	4.5	Five-year windows kept since 8; in-place apt upgrades; Extended LTS to ten years

Sustainability risk: 5.0 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	1.5	Over a thousand developers with no single employer; LTS work is done by a smaller paid group
Backer health	1.5	No owner company; LTS depends on sponsor funding (the wiki asks companies that benefit to contribute)
Licence-change risk	0	Debian Free Software Guidelines and the Social Contract; thousands of copyright holders
Abandonment signs	0.5	Releases since 1993; 13.7 on 2026-09-12; the 2026 leader election had a single candidate
Security response	1.5	Security team advisories with CVE references; LTS years rely on volunteers and sponsors; no published response-time targets

Technical lock-in: 2.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	deb, qcow2 and OCI; plain-text configuration
Export path	0.5	Ubuntu and other derivatives take the same packages; nothing to convert
Stack coupling	0	Any storage, any network, any tooling
Hardware / cloud coupling	0.5	Any hardware; no official Google Cloud or Oracle Cloud images
Skills and tooling coupling	0.5	The most common package tooling

Integrator fit: 7.5 / 20

Criterion	Score	Basis
Partner programme openness	2	No vendor; support is sold by third parties such as Freexian
Multi-tenancy and self-service	0.5	No management product
API and infrastructure-as-code	3	cloud-init, Ansible, Terraform and FAI-built images work unchanged
Skills and certification	2	Large skills pool; no vendor certification (LPIC covers it generically)

AI leverage: 2.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	1.5	1.5	2	2025: 13: ROCm libraries in the repositories; CUDA repository for Debian 13
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	0	0	0	2015: None

Year by year: 2015: 1 · 2016: 1 · 2017: 1 · 2018: 1 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 2 · 2026: 2

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. Debian announced no AI features; two general resolutions (2025 withdrawn, 2026 adopted) set policy for how contributors may use generative AI.

Debian packages the GPU drivers and, since 13, ROCm, and leaves everything above that to the user. It has no AI platform, no assistant and no agent interface, and in 2026 it voted rules for contributors rather than features for users.

Reading

Debian is the base layer of this group: Ubuntu, Proxmox VE and most cloud images start from it, and it carries more architectures than any vendor. The scores are held back by what a volunteer project does not do: no live patching, no certifications, no management product, no release dates and five years of free updates against ten to fifteen from the commercial lines. What it has instead is a lock-in score near zero and a lifecycle that has kept its promises since 2015. The thing to check is the LTS years: the last two of the five are handled by a smaller sponsored team with fewer architectures, and anything past five years is a quote from Freexian.

Open questions and items to re-score

Who funds and coordinates Debian LTS: the wiki names volunteers and companies and asks for contributions; Freexian's coordinating role comes from background knowledge and is not on the wiki page.
The releases page gives bookworm's full support end as 2026-07-11 while the LTS wiki starts LTS on 2026-06-11; one page may be out of date.
First packaged releases of Podman, containerd, CRI-O and Cockpit (grade C); the 2021 steps in containers and fleet are dated to Debian 11 on that basis.
Start date of NVIDIA's Debian CUDA repository (listed for Debian 10 to 13 as of 2026-10-15) and the ROCm packaging team's first release.
Whether a CIS Benchmark for Debian 13 has been published; the security score assumes the Debian 12 benchmark only.
Debian 14 (forky) freeze and release dates: none published.

	’19	’21	’23	’25
Lifecycle and upgrades
Security and compliance	1			1
Hardware and architectures			1	2
Virtualization and cloud images
Containers and Kubernetes host		1
Software currency and packaging
Fleet management and automation		2
Storage and filesystems
Enterprise integration and certifications
AI and GPU readiness	2			3