Download
shadowfetch-2.0.1-amd64.iso - 4,498,606,080 bytes (4.19 GiB)
sha256 b5e7fbe232027958aac2296c2e623a56e20f85c61d444fd59a784c2edbdb04be
The ISO is not attached here: a GitHub release asset is capped at 2 GiB and this image is more than twice that. This release carries the material you verify it with, plus a web-seeded .torrent that works with no peers.
The image is 203,638,785 bytes larger than FAT32 can hold in a single file. On a FAT32 stick the copy fails with "file too large" - use exFAT, or write the ISO to the raw device with
dd, Rufus or balenaEtcher rather than copying it onto a filesystem.
What 2.0.1 fixes
apt works on installed systems again. Every install up to 2.0.0 finished by overwriting its own sources.list with Debian's stock stable template. Shadowfetch tracks testing, so installed machines ran a testing userland pointed at a stable archive: installing a small package could propose removing large parts of the preinstalled creative stack, and later failed outright. Dropping contrib and non-free also left the NVIDIA packages with no upgrade path. The installer now derives suite, mirror and components from the image it is installing, verifies what it wrote, and refuses to finish rather than hand over a system pointed at the wrong archive.
The on-device AI tools are reachable. The AI Agent Setup Guide pointed at a document that shipped compressed, so clicking it did nothing at all. "Pick a Local AI Model" carried a flag that hides entries from graphical menus. And the seven AI applications were spread across four unrelated categories. They now sit together under Local AI, and both broken entries work.
Virtual machines get a working desktop. spice-vdagent, qemu-guest-agent and open-vm-tools now ship, so a guest can negotiate its resolution and share a clipboard under QEMU, SPICE and VMware. VirtualBox still needs Oracle's Guest Additions, which Debian does not package. All are inert on bare metal.
The installer tells the truth about itself. The Calamares version is derived from the system's own version file at build time and the build fails if the two disagree - a 1.8.1 image once greeted users as 1.8.0. The requirements check now matches the published hardware page at 40 GB and 4 GB of RAM, and warns rather than blocking.
The live account is removed with proof. The step that deletes the live shadow account suppressed every error and always reported success. Measured on a real install the removal did work, so shipped systems were not affected, but it now verifies all five artefacts including the password hash and stops the install if any survive.
Full notes: https://www.shadowfetch.com/linux/changelog#v2-0-1
Verify
8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1
curl -O https://www.shadowfetch.com/linux/download/shadowfetch-2.0.1-amd64.iso
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.1/shadowfetch-2.0.1-amd64.iso.asc
curl -LO https://github.com/ShadowfetchAI/shadowfetch-linux/releases/download/v2.0.1/shadowfetch-release.asc
gpg --import shadowfetch-release.asc
gpg --verify shadowfetch-2.0.1-amd64.iso.asc shadowfetch-2.0.1-amd64.iso
sha256sum -c <<< "b5e7fbe232027958aac2296c2e623a56e20f85c61d444fd59a784c2edbdb04be shadowfetch-2.0.1-amd64.iso"gpg --verify must print Good signature. A warning that the key is not certified is expected: it only means you have not personally signed it.
SHA256SUMS carries a detached signature over its exact bytes, never a clearsigned one.
Base: Debian testing - KDE Plasma 6 - amd64 hybrid ISO - built 2026-07-24
Support the project
Shadowfetch Linux is free, and there is no paid tier, no telemetry and nothing
held back for a sponsor. If it is useful to you and you want to put something in
the tin, it goes to build costs and hardware for testing.
https://buymeacoffee.com/shadowfetch
Not expected, and it changes nothing about what you get. Reporting a bug you hit
is worth more to the project than a coffee.