Linux

Shadowfetch Linux

Security model

Shadowfetch Linux is a Debian-testing derivative with a small Shadowfetch layer: branding, defaults, curated packages, optional agent setup, installer polish, and a signed APT repository. We do not claim Debian endorsement, magic anonymity, or enterprise hardening.

Verify the current release →

What is inherited

  • Most packages come directly from Debian testing and its normal security/update flow.
  • KDE Plasma, Calamares, PipeWire, Mesa, systemd, apt, dpkg, and core userland follow their upstream projects.
  • Debian tooling still works: apt, dpkg,systemctl, and standard logs are intact.

What Shadowfetch adds

  • Signed ISO artifacts and a public GPG key for verification.
  • A signed APT repository athttps://www.shadowfetch.com/linux/apt/for Shadowfetch packages.
  • UFW firewall enabled, MAC-address randomization defaults, hardened sysctl settings, zram, theming, Welcome flow, and featured agent setup.
  • Code and source-report missions run under a provider you name per mission — codex and claude are cloud, localmodel is on-device with no network at all, and offline media exports do not send project material to an AI provider. Mission Control records scope and evidence. Firebreak confines the process view to the approved workspace and required system paths, excludes other personal folders and known credential paths, and records a launch receipt. It also enforces, rather than only recording: every sandbox gets its own network namespace in both postures, so host loopback services and abstract sockets are out of reach even while a task is online; where a mission declares destinations, a default-DROP nftables ruleset permits only the addresses those names resolved to; declared masked paths are real mounts; and a syscall filter denies 46 calls in every sandbox or the run is refused rather than started unfiltered.

Signing

GPG signing key
8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1
APT repository
https://www.shadowfetch.com/linux/apt/

Download the public keyFull verification guide

The key is served from the freeze host over HTTPS (www.shadowfetch.com). A copy is also at/shadowfetch.gpg.asc on this site. Fetch it and print its fingerprint without importing anything into your keyring, then compare the result against the fingerprint above:

curl -fsSL https://www.shadowfetch.com/linux/shadowfetch.gpg.asc | gpg --show-keys --with-fingerprint

It is not on keys.openpgp.org orkeyserver.ubuntu.com; a --recv-keys against either fails, so this page does not tell you to try. Verifying the key you fetched against the fingerprint published here is what establishes the trust anchor.

Local records and connected services

Firewatch reads hardware metrics locally and exposes them on the system bus. Mission Control keeps its queue and execution receipts on this computer. Using the desktop does not require a Shadowfetch account. The website and download infrastructure may still produce ordinary web/CDN logs at the hosting layer. Optional vendor apps have their own privacy policies and may contact their services for accounts, updates, relays, model discovery or downloads. Verifying a local Mission Control request does not certify all background traffic from those apps.

Current security caveats

  1. Secure Boot signing is not available yet.
  2. Debian testing moves faster than Debian stable; update risk is part of the model.
  3. Official native Grok Bot and optional Codex, Claude Code, Grok Build, and Cursor Agent installs use their providers' own sign-in and network services; Shadowfetch does not grant them an account or publishing authority.
  4. The egress allowlist is a control only where a mission declares destinations. A connected task with none declared installs no ruleset and reaches anything this machine can reach — the local network is not the extent of it.
  5. DNS leaves a sandbox whose filter is working: the resolver has to be reachable or nothing routes. An allowlist narrows where bytes may be sent, not what can be signalled out in a query name. Filtering is by resolved IPv4 address, fixed once at launch.
  6. Masking is by path. A hardlink to the same inode under a name that is not masked is still readable.
  7. A credential you grant a mission is present in the sandbox environment, so anything the agent starts can read it. What is enforced is that a credential you did not grant is not there at all.
  8. The sandbox runs as your own user. Root inside its user namespace is not a different account outside it.
  9. The distribution is young. Treat the known-issues page as required reading before installing on a production machine.

Read the known issues →

Debian is a registered trademark of Software in the Public Interest, Inc. Shadowfetch Linux is an independent derivative and is not affiliated with or endorsed by the Debian project.