Shadowfetch Linux 2.1.3 «Umbra»

Verify Shadowfetch Linux

Every public Shadowfetch Linux ISO is shipped with a SHA-256 checksum, a detached GPG signature, and the Shadowfetch signing key. Check those before installing.

Why verify?

Two quick checks, two different guarantees: theSHA-256 checksum proves the file downloadedintact (no corruption, no truncated transfer), and theGPG signature proves it is authentic— the exact ISO Shadowfetch published, not a tampered copy from a mirror or a bad network. It takes a minute and means you can install with confidence.

Current release

shadowfetch-2.1.3-amd64.iso — 2.1.3 «Umbra»,4.01 GB (3.73 GiB), published 2026-08-02.

SHA-256

5f6a639b98e280c3fd46fc581ed899ec4ca861fb924bed266d4e13b9f4d0a2fd  shadowfetch-2.1.3-amd64.iso

Signing key

Fingerprint: 8F13 CE15 35EE 1F4A 2916  A1F7 3C5C 900B 7BE8 0CA1

Download the public key Detached signature (shadowfetch-2.1.3-amd64.iso.asc)SHA256SUMS on GitHub

Not downloaded the image yet? It is onthe download page, with the exact byte count and the USB-writing instructions.

Verify on Linux or macOS

Put the ISO, the .asc signature, andshadowfetch.gpg.asc in the same folder, open a terminal there, and run:

gpg --import shadowfetch.gpg.asc
gpg --verify shadowfetch-2.1.3-amd64.iso.asc
shasum -a 256 shadowfetch-2.1.3-amd64.iso

For the signature, you want a line that reads:

gpg: Good signature from "Shadowfetch <...>"

A warning here is normal — not an error.

Right after Good signature, GPG will almost always also print:

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

That is expected. It only means you have not personally marked the Shadowfetch key as trusted in your own keyring — it does not mean the signature failed. As long as you see Good signature and the fingerprint matches8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1 above, you are good.

For the checksum, the 64-character hash thatshasum prints must match the value shown underCurrent release above. (On most Linux distros the command issha256sum shadowfetch-2.1.3-amd64.iso instead ofshasum -a 256.)

Verify on Windows

No extra tools needed for the checksum. Open PowerShellor Command Prompt in the folder with the ISO and run:

CertUtil -hashfile shadowfetch-2.1.3-amd64.iso SHA256

Compare the hash it prints to the value under Current release— they must match (case does not matter).

To check the GPG signature on Windows, installGpg4win(which includes the Kleopatra app):

Open Kleopatra, choose File -> Import, and import shadowfetch.gpg.asc (the signing key).
Choose File -> Decrypt/Verify Files and select shadowfetch-2.1.3-amd64.iso.asc (Kleopatra finds the ISO beside it automatically).
A green “Valid signature” from Shadowfetch is what you want. As on Linux, a note that the key is not certified / not trusted is normal — verify the fingerprint matches the one above and you are done.

What Shadowfetch provides

Shadowfetch packages, themes, defaults, Welcome flow, privacy defaults, and local-AI setup.
A signed APT repository at https://www.shadowfetch.com/linux/apt/
Debian testing remains the base package ecosystem. Shadowfetch is independent and not endorsed by Debian.

Shadowfetch Linux is free, and it stays free — verifying it costs you nothing extra. If it turns out to be useful to you and you would like to help fund the development time behind it, there is atip jar. It is optional and changes nothing about the ISO you just verified.

Debian is a registered trademark of Software in the Public Interest, Inc. Shadowfetch Linux is an independent derivative and is not affiliated with or endorsed by the Debian project.