Blunix v0.1.1-rc.2: first signed release

The first signed Blunix release. It is a release candidate, based on Debian 13 (trixie).

SHA256SUMS lists the sha256 of every file here. SHA256SUMS.asc is a signature over it by the Blunix release key:

62F7 36BE A2AB 2E1F A16D  5138 BCB3 426C 090A DF92
Blunix Release Signing <sign-releases@blunix.io>

The key is in the repository at keys/blunix-releases.asc. The tag v0.1.1-rc.2 is signed by the same key. builder1 built the release from that tag in a digest-pinned container, and the release was signed offline afterwards. build-provenance.json records the inputs, the container and every file's hash.

Verify

Download the files, SHA256SUMS and SHA256SUMS.asc into one folder, then:

gpg --import blunix-releases.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS

gpg must say Good signature from the fingerprint above. Every line from sha256sum must say OK. On a Mac, use shasum -a 256 -c SHA256SUMS. Do not boot or write a file that fails.

The attached RELEASE-NOTES.md was written by the build before signing, so it still calls this release unsigned. This page replaces it.

Assets

File	What it is
blunix-installer.iso	The live installer. Write it to a USB stick or attach it as a CD.
blunix.raw.zst	The disk image the installer writes. Also bootable on its own after zstd -d.
vmlinuz, initrd.img, blunix.squashfs	Netboot media for iPXE (image/ipxe/blunix.ipxe).
SHA256SUMS, SHA256SUMS.asc	The sha256 of every file, and the signature over that list.
build-provenance.json	What was built, from which commit, with which inputs.
SOURCES.md	Every Debian source package at its exact version, with the written offer for source.

Boot

• The installer ISO boots on UEFI and on BIOS, from a USB stick or optical media.
• An installed disk boots on UEFI only.
• Netboot is for trusted LANs only. The kernel, initrd and squashfs come over plain http, and iPXE does not check their digest. Check them against the signed SHA256SUMS before serving them.
• blunix.raw.zst, decompressed and booted directly, asks on tty1 for the build hostname and the key at first boot, and waits for a person. A disk written by the installer already has its document and does not ask.
• Each machine makes its own ssh host keys at first boot. None ship in the image.

Licenses and source

• Debian packages in these images keep their own licenses, many of them the GNU GPL. SOURCES.md lists every source package at its exact version, with a snapshot.debian.org link and a written offer for the corresponding source.
• Blunix's own code is source-available under the PolyForm Noncommercial License 1.0.0. It is free for personal use and noncommercial organizations. Commercial use needs a commercial license (see COMMERCIAL.md in the repository).

Blunix v0.1.0: first host, unsigned

Blunix v0.1.0

This is an unsigned test release. Nothing in it is signed yet. SHA256SUMS
proves a download matches what was built; it does not prove who built it.

Blunix v0.1.0 is based on Debian 13 (trixie).

Assets

File	What it is
blunix-installer.iso	The live installer. Write it to a USB stick or attach it as a CD.
blunix.raw.zst	The disk image the installer writes. Also bootable on its own after zstd -d.
vmlinuz, initrd.img, blunix.squashfs	Netboot media for iPXE (image/ipxe/blunix.ipxe).
SHA256SUMS	The sha256 of every file above.

Boot

• The installer ISO boots on UEFI and on BIOS, from a USB stick or optical media.
• An installed disk boots on UEFI only.
• Netboot is for trusted LANs only until images are signed. The kernel, initrd
  and squashfs come over plain http, and iPXE does not check their digest.
• blunix.raw.zst, decompressed and booted directly, asks on tty1 for the
  build hostname and the key at first boot, and waits for a person. A disk
  written by the installer already has its document and does not ask.
• Each machine makes its own ssh host keys at first boot. None ship in the image.

Verify

Download the files and SHA256SUMS into one folder, then:

sha256sum -c --ignore-missing SHA256SUMS

On a Mac, use shasum -a 256 -c SHA256SUMS. Every line must say OK. Do not
boot or write a file that fails.

Licenses and source

• Debian packages in these images keep their own licenses, many of them the GNU GPL. SOURCES.md, attached to this release, lists every source package at its exact version, with a snapshot.debian.org link and a written offer for the corresponding source.
• Blunix's own code is source-available under the PolyForm Noncommercial License 1.0.0. It is free for personal use and noncommercial organizations. Commercial use needs a commercial license (see COMMERCIAL.md in the repository).