Shadowfetch Linux 2.0.1 “Umbra” — Reachable

Download

shadowfetch-2.0.1-amd64.iso - 4,498,606,080 bytes (4.19 GiB)

sha256  b5e7fbe232027958aac2296c2e623a56e20f85c61d444fd59a784c2edbdb04be

The ISO is not attached here: a GitHub release asset is capped at 2 GiB and this image is more than twice that. This release carries the material you verify it with, plus a web-seeded .torrent that works with no peers.

The image is 203,638,785 bytes larger than FAT32 can hold in a single file. On a FAT32 stick the copy fails with "file too large" - use exFAT, or write the ISO to the raw device with dd, Rufus or balenaEtcher rather than copying it onto a filesystem.

What 2.0.1 fixes

apt works on installed systems again. Every install up to 2.0.0 finished by overwriting its own sources.list with Debian's stock stable template. Shadowfetch tracks testing, so installed machines ran a testing userland pointed at a stable archive: installing a small package could propose removing large parts of the preinstalled creative stack, and later failed outright. Dropping contrib and non-free also left the NVIDIA packages with no upgrade path. The installer now derives suite, mirror and components from the image it is installing, verifies what it wrote, and refuses to finish rather than hand over a system pointed at the wrong archive.

The on-device AI tools are reachable. The AI Agent Setup Guide pointed at a document that shipped compressed, so clicking it did nothing at all. "Pick a Local AI Model" carried a flag that hides entries from graphical menus. And the seven AI applications were spread across four unrelated categories. They now sit together under Local AI, and both broken entries work.

Virtual machines get a working desktop. spice-vdagent, qemu-guest-agent and open-vm-tools now ship, so a guest can negotiate its resolution and share a clipboard under QEMU, SPICE and VMware. VirtualBox still needs Oracle's Guest Additions, which Debian does not package. All are inert on bare metal.

The installer tells the truth about itself. The Calamares version is derived from the system's own version file at build time and the build fails if the two disagree - a 1.8.1 image once greeted users as 1.8.0. The requirements check now matches the published hardware page at 40 GB and 4 GB of RAM, and warns rather than blocking.

The live account is removed with proof. The step that deletes the live shadow account suppressed every error and always reported success. Measured on a real install the removal did work, so shipped systems were not affected, but it now verifies all five artefacts including the password hash and stops the install if any survive.

Full notes: https://www.shadowfetch.com/linux/changelog#v2-0-1

Verify

8F13 CE15 35EE 1F4A 2916  A1F7 3C5C 900B 7BE8 0CA1

curl -O https://www.shadowfetch.com/linux/download/shadowfetch-2.0.1-amd64.iso
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.1/shadowfetch-2.0.1-amd64.iso.asc
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.1/shadowfetch-release.asc

gpg --import shadowfetch-release.asc
gpg --verify shadowfetch-2.0.1-amd64.iso.asc shadowfetch-2.0.1-amd64.iso
sha256sum -c <<< "b5e7fbe232027958aac2296c2e623a56e20f85c61d444fd59a784c2edbdb04be  shadowfetch-2.0.1-amd64.iso"

gpg --verify must print Good signature. A warning that the key is not certified is expected: it only means you have not personally signed it.

SHA256SUMS carries a detached signature over its exact bytes, never a clearsigned one.

Base: Debian testing - KDE Plasma 6 - amd64 hybrid ISO - built 2026-07-24

Support the project

Shadowfetch Linux is free, and there is no paid tier, no telemetry and nothing
held back for a sponsor. If it is useful to you and you want to put something in
the tin, it goes to build costs and hardware for testing.

https://buymeacoffee.com/shadowfetch

Not expected, and it changes nothing about what you get. Reporting a bug you hit
is worth more to the project than a coffee.

Shadowfetch Linux 2.0.0 “Umbra”

Download

shadowfetch-2.0.0-amd64.iso — 4,486,000,640 bytes (4.18 GiB)

sha256  0cbf9b90a4e561c57167cbac55d6fc4d02efc3dbd12a9c97c5034afc9fe6c671

The ISO is not attached to this release. A GitHub release asset is capped at 2 GiB and this
image is 2.09x that, so the image is served from the project's own storage and this release carries
the material you verify it with.

A .torrent is attached. It is web-seeded from the same URL, so it works with zero peers.

Note: the image is 191,033,345 bytes larger than FAT32 can hold in a single file. If your USB
stick is FAT32 the copy will fail with "file too large" — use exFAT, or write the ISO to the raw
device with dd/Rufus/balenaEtcher rather than copying it onto a filesystem.

Verify before installing

Signing key fingerprint:

8F13 CE15 35EE 1F4A 2916  A1F7 3C5C 900B 7BE8 0CA1

curl -O https://www.shadowfetch.com/linux/download/shadowfetch-2.0.0-amd64.iso
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.0/shadowfetch-2.0.0-amd64.iso.asc
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.0/shadowfetch-release.asc

gpg --import shadowfetch-release.asc
gpg --verify shadowfetch-2.0.0-amd64.iso.asc shadowfetch-2.0.0-amd64.iso
sha256sum -c <<< "0cbf9b90a4e561c57167cbac55d6fc4d02efc3dbd12a9c97c5034afc9fe6c671  shadowfetch-2.0.0-amd64.iso"

gpg --verify must print Good signature. It will also warn that the key is not certified —
that is expected and only means you have not personally signed the key.

The key is published here on GitHub, on a different provider with different credentials from
shadowfetch.com. Do not take the fingerprint from shadowfetch.com alone: the ISO, the checksum, the
verify page and that site's TLS certificate all sit under one account. Confirm it in at least two
independent places — this release, SECURITY.md, the README, and on an installed system
/etc/apt/keyrings/shadowfetch.gpg, which is the same key.

SHA256SUMS carries a detached signature over its exact bytes, never a clearsigned one.

What is in 2.0.0 "Umbra"

Full notes: https://www.shadowfetch.com/linux/changelog#v2-0-0

• Bedrock — Btrfs with a dedicated @snapshots subvolume and an automatic snapshot before every
  apt transaction; roll back to the previous snapshot straight from the GRUB menu via grub-btrfs.
• Browser Migration assistant — validates bookmark HTML and password CSV exports, stages them
  privately, and handles temporary Flatpak access for Brave.
• Control Center: safe updates, plain-language health checks, recovery, graphics and agent tools.
• On-device agents with a per-project workspace (tasks, memory, artifacts, safety rules).

Base: Debian testing derivative · KDE Plasma 6 · amd64 hybrid ISO · built 2026-07-21

Assets

File	What it is
shadowfetch-release.asc	Public signing key
shadowfetch-2.0.0-amd64.iso.asc	Detached signature over the ISO
SHA256SUMS	Checksum, sha256sum -c format
SHA256SUMS.asc	Detached signature over SHA256SUMS
shadowfetch-2.0.0-amd64.iso.torrent	Web-seeded torrent
packages.manifest	Package list of the built image