Shadowfetch Linux

Security model

Shadowfetch Linux is a Debian-testing derivative with a small Shadowfetch layer: branding, defaults, curated packages, local-AI setup, installer polish, and a signed APT repository. We do not claim Debian endorsement, magic anonymity, or enterprise hardening.

Verify the current release →

What is inherited

  • Most packages come directly from Debian testing and its normal security/update flow.
  • KDE Plasma, Calamares, PipeWire, Mesa, systemd, apt, dpkg, and core userland follow their upstream projects.
  • Debian tooling still works: apt, dpkg,systemctl, and standard logs are intact.

What Shadowfetch adds

  • Signed ISO artifacts and a public GPG key for verification.
  • A signed APT repository athttps://www.shadowfetch.com/linux/apt/for Shadowfetch packages.
  • UFW firewall enabled, MAC-address randomization defaults, hardened sysctl settings, zram, theming, Welcome flow, and local-AI setup helpers.
  • Local AI is designed to run on your machine through Ollama/Open-WebUI. Model downloads still come from their original model hosts when you choose to download them.

Signing

GPG signing key
8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1
APT repository
https://www.shadowfetch.com/linux/apt/

Download the public keyFull verification guide

The key is served from this site over HTTPS. Fetch it and print its fingerprint without importing anything into your keyring, then compare the result against the fingerprint above:

curl -fsSL https://www.shadowfetch.com/linux/shadowfetch.gpg.asc | gpg --show-keys --with-fingerprint

It is not on keys.openpgp.org orkeyserver.ubuntu.com; a --recv-keys against either fails, so this page does not tell you to try. Verifying the key you fetched against the fingerprint published here is what establishes the trust anchor.

What Shadowfetch does not collect

The installed OS does not include a Shadowfetch telemetry daemon, account requirement, or background analytics service. The website and download infrastructure may still produce ordinary web/CDN logs at the hosting layer.

Current security caveats

  1. Secure Boot signing is not available yet.
  2. Debian testing moves faster than Debian stable; update risk is part of the model.
  3. The distribution is young. Treat the known-issues page as required reading before installing on a production machine.

Read the known issues →

Debian is a registered trademark of Software in the Public Interest, Inc. Shadowfetch Linux is an independent derivative and is not affiliated with or endorsed by the Debian project.