Skip to content

codium

VSCodium — Microsoft's VS Code source, built without their telemetry or branding

  • Version recorded: 1.126
  • Categories: workstation
  • Upstream: https://vscodium.com/
  • Not a recommended default — installed only when asked for.

What it does

A source build of Microsoft's Visual Studio Code with the telemetry, tracking and Microsoft branding removed, and pointed at the Open VSX extension registry instead of Microsoft's marketplace.

Why you would want it

It is the editor Parrot already ships, which is the reason it is here rather than an argument about editors. A project that installs software on other people's machines should default to what the distribution chose, and only offer alternatives explicitly — that principle is D-022 and this manifest is the case it was written around.

Before it will work

On Parrot, nothing. On every other target, the vscodium apt repository above must be added first, which is shown to you before it happens.

How it installs

  • apt: codium — on parrot
  • Measured 2026-08-26 in parrotsec/core: codium 1.126.04524 is available from Parrot's own archive. Adding VSCodium's repository here would be pointless and would widen the trust surface for no benefit.
  • apt: codium
  • Needs the vscodium apt repository declared above. Measured 2026-08-26: absent from Debian 13 and Kali rolling.

What it changes on your machine

  • apt_pin — Adds VSCodium's apt repository and pins its signing key. Does NOT happen on Parrot, which ships codium in its own archive.
  • Writes /etc/apt/sources.list.d/vscodium.sources and installs the signing key to /etc/apt/keyrings/vscodium.gpg, with Signed-By pointing at that keyring so the key is trusted for this repository only and not archive-wide. On Parrot neither file is written and no repository is added, because the package is already in the distribution's archive.
  • undo: sudo rm /etc/apt/sources.list.d/vscodium.sources /etc/apt/keyrings/vscodium.gpg && sudo apt update

Third-party apt repositories

Added only when the target's own archive has no candidate, and only after you affirm the key fingerprint (D-040); --yes does not answer it.

Known problems

Extensions come from Open VSX rather than Microsoft's marketplace, and a few Microsoft-published extensions are not there — the C++ and remote-development ones most notably, which are licensed for use only with Microsoft's own build. That is the concrete trade-off against code, and it runs the other way too: code sends telemetry to Microsoft by default and requires their repository. Both are installable, neither displaces the other, and the catalog does not pick for you.

Keeping it current

  • probe: apt policy
  • strategy: apt_upgrade

Source: catalog/packages/codium.yaml