Shadowfetch Linux 4.1.0 «Umbra»
APT repository
A signed APT repository at https://www.shadowfetch.com/linux/apt/. If you already run Debian and just want the Shadowfetch metapackages without reinstalling, add it and pull them with apt.
Repository
These are the fields the repository itself publishes, from signed dists/umbra/InRelease metadata.
- Origin
- Shadowfetch
- Label
- Shadowfetch
- Codename
- umbra
- Components
- main
- Architectures
- amd64
- Date
- Thu, 10 Sep 2026 21:27:17 UTC
- Valid-Until
- Tue, 09 Mar 2027 21:27:17 UTC
Add it to an existing Debian system
The repository is signed, so the key goes into/etc/apt/keyrings/ and the source line references it withsigned-by. Nothing is added to your global trusted keyring.
curl -fsSL https://www.shadowfetch.com/linux/apt/shadowfetch.gpg.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/shadowfetch.gpg
echo "deb [signed-by=/etc/apt/keyrings/shadowfetch.gpg] https://www.shadowfetch.com/linux/apt/ umbra main" \
| sudo tee /etc/apt/sources.list.d/shadowfetch.list
sudo apt update
sudo apt install shadowfetch-desktop # full creative workstation
# or pick à la carte:
sudo apt install shadowfetch-themes shadowfetch-defaults
sudo apt install shadowfetch-creative-baseThe signing key fingerprint is8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1 — the same key that signs the ISO. Check it against theverification guide before you trust it.
Workbench and optional AI setup
You do not need to reinstall to add the current project, agent-safety, and setup interfaces. On a Debian Testing system with the repository added:
sudo apt --simulate install shadowfetch-control-center shadowfetch-fireline shadowfetch-welcome
sudo apt install shadowfetch-control-center shadowfetch-fireline shadowfetch-welcomeMission Control pulls in its matching mission engine and desktop defaults. Together these packages provide the native task queue, health and hardware inspection, Element Workbench, Firebreak, AI Ignition, and optional coding-agent setup entry points: shadowfetch-workbench,shadowfetch-firebreak, shadowfetch-ai-ignition,shadowfetch-grok-bot, and shadowfetch-gpu. No model, cloud account, or credential is included by this transaction.
shadowfetch-defaults also applies Shadowfetch desktop defaults. Themes and branding remain separate packages; review the package plan with APT simulation before adding the layer to a system you already depend on.
If you already run grub-btrfs, pin it first. This repository ships grub-btrfs 4.14-2, and that version sorts above the build SpiralLinux and others provide, so an upgrade can replace a Snapper setup you are happy with:
printf 'Package: grub-btrfs\nPin: origin ""\nPin-Priority: 1001\n' \
| sudo tee /etc/apt/preferences.d/keep-my-grub-btrfsWhat the repository contains
Eighteen packages in component main, architecture all except shadowfetch-drkonqi-pickup (amd64), shadowfetch-ember (amd64). Everything else on a Shadowfetch system comes from upstream Debian, not from here.
| Package | Version | Section | Description |
|---|---|---|---|
grub-btrfs | 4.14-2 | admin | Include Btrfs snapshots as GRUB boot entries (vendored v4.14) grub-btrfs adds a GRUB submenu listing your Btrfs snapshots so a broken upgrade is one reboot away from a known-good system. The grub-btrfsd daemon watches the snapshot directory and regenerates the menu automatically. . Vendored from upstream Antynea/grub-btrfs v4.14 (GPL-3+) by Shadowfetch Linux because the Debian package is not currently available in testing. |
shadowfetch-branding | 4.1.0-1 | misc | Shadowfetch branding assets Ships the Shadowfetch ASCII logo (consumed by fastfetch), the message-of-the-day, an upgrade-safe os-release identity, and miscellaneous brand-identity files. |
shadowfetch-control-center | 4.1.0-1 | x11 | Shadowfetch Mission Control - agent tasks and system care The native desktop starts with persistent missions and the featured official Grok Bot integration. It also includes the private System Passport, Element Workbench, Ignite, Watch, Recover, Workspaces, Drivers and Software & Updates. Supports deep links (--page section[:tab]) with single-instance routing over the session bus, so Welcome, Firewatch, Phoenix and Fireproof all land in the same window. . Takes over /usr/bin/shadowfetch-control from shadowfetch-defaults; the 2.1.1 tools (Safe Update, System Health, Agent Studio, Agent Tools, First-run Setup, Graphics & Recovery) remain reachable inside their sections. All privileged actions go through systemd/polkit or pkexec helpers shipped by the pillar packages; the UI owns no root logic and makes no network connections. |
shadowfetch-creative-base | 4.1.0-1 | metapackages | Shadowfetch creative app baseline Installs the core set of creative applications Shadowfetch users expect: 2D, 3D, photo, audio, and video tools. Packages not currently available in Debian testing under their expected names (blender, lmms, carla, fonts-jetbrains-mono) are listed as Recommends so install doesn't fail — Flatpak fallbacks are offered in the welcome wizard. |
shadowfetch-defaults | 4.1.0-1 | misc | Desktop defaults, Control Center integration, health checks, and workspace helpers |
shadowfetch-desktop | 4.1.0-1 | metapackages | Shadowfetch creative workstation (KDE Plasma edition) Shadowfetch is a Debian-based Linux distribution for visual artists, musicians, and video creators. This metapackage installs the full Shadowfetch desktop experience: the KDE Plasma session, the creative-app baseline, themes, branding and the welcome tool, and the Shadowfetch pillars themselves -- Mission Control, Firebreak and the mission engine, Phoenix Recovery, Fireproof updates, Firewatch telemetry, Ember Mode, the hardware scanner and the seven-category launcher. |
shadowfetch-drkonqi-pickup | 4.1.0-1 | utils | finite login crash pickup for the Shadowfetch Plasma session Builds the KDE DrKonqi journal processor with a focused correction to its login pickup lifecycle. Empty scans and all pending batches finish cleanly, while journal and socket errors remain failures. A user service drop-in selects the helper only for pickup, retaining the upstream crash launcher, per-crash processor and maximum runtime safety limit. |
shadowfetch-ember | 4.1.0-1 | admin | Shadowfetch Ember Mode engine (one switch, auto-return to Balanced) Ember Mode is the Fire Edition speed switch. When armed it holds the 'performance' power profile via power-profiles-daemon (falling back to the cpupower governor on hardware without a ppd performance profile), pauses a small curated list of background services (PackageKit, fwupd, ModemManager -- each behind a gate condition, each crash-safe), and tilts CPU scheduling toward the user session with a runtime CPUWeight=40 drop-in on system.slice. . It always returns to Balanced: the profile hold dies with the daemon's D-Bus connection, an idempotent restore tool undoes every recorded mutation as ExecStartPre and ExecStopPost, an idle watchdog (driven by work-only load figures from Firewatch, never by chassis temperature) extinguishes after ten quiet minutes, and every mutation is --runtime/tmpfs so a power cut reverts by reboot. . Status is published read-only on the system bus as com.shadowfetch.Ember1. The active console user can flip the switch without a password (polkit rule); sampling, the effective-load index and the flame display belong to shadowfetch-firewatchd, and the switch UI lives in the Shadowfetch Control Center. |
shadowfetch-fireline | 4.1.0-1 | admin | Shadowfetch Fireline - contain, checkpoint and audit local AI agents Fireline is the agent-safety system of Shadowfetch Linux Fire and Ice. It lets you run any coding agent full-auto without handing it your whole machine. . shadowfetch-firebreak runs an agent inside bubblewrap with public system runtimes mounted read-only, a private home, explicit read grants and only the project workspace writable; it can cut the network, starts from a clean environment, takes a workspace checkpoint before the agent runs, and records every session to the audit journal. . shadowfetch-checkpoint snapshots, diffs and undoes a single ~/Workspaces workspace, so "undo everything the agent did" is one command. . shadowfetch-mcp ships four signed, dependency-free MCP servers - passport (read-only system self-check), phoenix (read-only restore-point list), checkpoint (snapshot/diff/undo one workspace) and fs (scoped read-only file access) - so an agent on Shadowfetch can call a checkpoint before it touches anything. Everything here is read-only against the system except the workspace the user named. |
shadowfetch-fireproof | 4.1.0-1 | admin | Shadowfetch Fireproof safe system updates Fireproof is how Shadowfetch Linux updates itself. Opening the analyze screen takes no apt lock and downloads nothing: the pending upgrade is simulated read-only (python3-apt, same resolver as apt), holds surface as pinned, library renames collapse to one line, and critical packages are flagged red. The dpkg lock is taken only at commit, where the approved change-set hash is re-validated first. . Updates are wrapped in a Phoenix Point automatically by snapper's own apt hooks - Fireproof creates zero snapshots of its own, it only names the first pre-snapshot of the transaction as the rollback target. After the commit a headless verify battery checks dpkg consistency, initrd freshness, GRUB, dkms modules, newly failed services, and the network; if the desktop ever fails to come back, the next boot opens recovery at exactly the right Point. One command (fireproof) drives everything the page can do. No telemetry, no unattended downloads or installs. |
shadowfetch-firewatchd | 4.1.0-1 | admin | Shadowfetch Firewatch telemetry daemon The always-on sensor source behind the Firewatch page of the Shadowfetch Control Center and the single source of the ELI/flame level that Ember Mode consumes. Publishes org.shadowfetch.Firewatch1 on the system bus: CPU/RAM/PSI, hwmon temperatures and fans, RAPL package watts, whole-GPU stats, a per-application heat map with human display names and icons, storage health via smartctl and nvme smart-log, and thermal-throttle events. . The daemon reads local system measurements and does not poll model services. NVIDIA telemetry uses a bounded local nvidia-smi query after the user installs a driver and reports whole-GPU statistics only. |
shadowfetch-hwscan | 4.1.0-1 | utils | Shadowfetch hardware and AI capability scanner One scanner, one fact file. Reads CPU flags, cores, RAM and GPUs using unprivileged sysfs and /proc reads plus two time-boxed local probes (vulkaninfo --json and nvidia-smi, 3 s each, failure means "unknown"), and writes the world-readable fact file /var/lib/shadowfetch/hwscan.json that every Shadowfetch surface reads: the Ignition AI Workstation card, the Welcome model cards, and the Control Center Agents and Drivers pages. . Every VRAM figure carries a source label (measured, estimated, shared or unknown), the verdict wording never calls slow hardware comfortable, and the deterministic recommendation table is pinned by fixture unit tests run at build time. Capabilities at rest only: Firewatch owns every runtime number. Nothing here talks to the network. |
shadowfetch-menus | 4.1.0-1 | misc | Shadowfetch seven-category application launcher XDG menu merge-dir drop-in that replaces the stock top-level launcher categories with the seven Shadowfetch sections: Create, Develop, Communicate, Play, Protect, System, and AI and Agents, plus the preserved Lost & Found (OnlyUnallocated) catch-all so no application can ever disappear from the menu. . Ships /etc/xdg/menus/applications-merged/shadowfetch-launcher.menu and the seven matching .directory files. plasma-workspace's own menu conffile is never touched, and kmenuedit user edits always win over this file (the stock DefaultMergeDirs merge happens before the kmenuedit MergeFile merge). |
shadowfetch-missions | 4.1.0-1 | utils | Durable, scoped agent missions with review and recovery Persistent SQLite task queue, bounded Codex cloud execution, cited document reports, verified media exports, receipts and workspace recovery. Runs as the logged-in user; offline media needs no account; Codex requires configured API credentials. |
shadowfetch-nvidia | 4.1.0-1 | metapackages | Shadowfetch NVIDIA setup compatibility package Keeps upgrades from the former driver bundle safe without installing a driver automatically. Run shadowfetch-gpu to inspect the detected card, verify NVIDIA's Debian repository, review the recommended open or closed kernel-module flavor, and approve a removal-free driver transaction. |
shadowfetch-phoenix | 4.1.0-1 | admin | Btrfs Phoenix Points, crash-atomic rollback, Last Known Good Flame recovery, desktop reset, and privacy-safe recovery reports |
shadowfetch-themes | 4.1.0-1 | x11 | Shadowfetch dark color scheme and look-and-feel Ships the Shadowfetch Dark KDE color scheme (signature violet accent on near-black background) and a minimal Plasma look-and-feel package (org.shadowfetch.dark) that bundles the scheme with sensible Plasma defaults: Breeze widgets, Papirus-Dark icons, breeze-dark plasma theme. |
shadowfetch-welcome | 4.1.0-1 | x11 | Shadowfetch first-boot welcome experience A simple PyQt6 application launched on first login that walks the user through accent color selection, optional Flatpak application installs, and other first-run setup. |
What the metapackages pull in
A metapackage installs nothing itself; it is a list of dependencies. So that the list is not a surprise, here it is in full.
shadowfetch-creative-basekrita, inkscape, audacity, kdenlive, ffmpeg, fonts-intershadowfetch-desktopshadowfetch-themes (= 4.1.0-1), shadowfetch-defaults (= 4.1.0-1), shadowfetch-branding (= 4.1.0-1), shadowfetch-welcome (= 4.1.0-1), shadowfetch-creative-base (= 4.1.0-1), shadowfetch-fireline (= 4.1.0-1), shadowfetch-missions (= 4.1.0-1), shadowfetch-drkonqi-pickup (= 4.1.0-1), shadowfetch-control-center (= 4.1.0-1), shadowfetch-ember (= 4.1.0-1), shadowfetch-firewatchd (= 4.1.0-1), shadowfetch-fireproof (= 4.1.0-1), shadowfetch-hwscan (= 4.1.0-1), shadowfetch-menus (= 4.1.0-1), shadowfetch-phoenix (= 4.1.0-1), kde-plasma-desktop, sddm, pipewire, pipewire-pulse, wireplumber, network-manager, flatpak, plasma-discover-backend-flatpakshadowfetch-nvidiashadowfetch-defaults (= 4.1.0-1), dkms, mokutil
Or install the whole thing
The repository is the à la carte route. The full workstation - installer, theme, first-boot wizard, privacy defaults and agent setup tools - ships as the ISO. Optional vendor applications remain explicit post-install choices.