diff --git a/.github/CI-SECRETS.md b/.github/CI-SECRETS.md index 0282276..ff0880c 100644 --- a/.github/CI-SECRETS.md +++ b/.github/CI-SECRETS.md @@ -5,22 +5,31 @@ The release pipeline (`.github/workflows/build-iso.yml`) needs these secrets con | Secret | What | Where to get it | |---|---|---| -| `RELEASE_GITHUB_TOKEN` | GitHub PAT used by `softprops/action-gh-release` to create signed releases. Needs `contents:write` on this repo. | github.com → Settings → Developer settings → Personal access tokens. **Already set.** | -| `SHADOWFETCH_GPG_PRIVATE_KEY` | ASCII-armored private key for the Shadowfetch APT/ISO signing key (fingerprint `8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1`). Used to sign the ISO and the reprepro repo. | Export from the build host with: `gpg --armor --export-secret-keys signing@shadowfetch.com`. **Not yet set.** | -| `R2_ACCESS_KEY_ID` | Access Key ID for an R2 API token scoped to `shadowfetch-linux` bucket (Object Read & Write). | Cloudflare dashboard → R2 → Manage R2 API Tokens → Create. **Not yet set.** (Old token used for manual publish should be rotated.) | -| `R2_SECRET_ACCESS_KEY` | Secret Access Key paired with `R2_ACCESS_KEY_ID`. | Shown once when token is created. **Not yet set.** | -| `CLOUDFLARE_API_TOKEN` | Cloudflare API token used by `wrangler deploy` to publish the `shadowfetch-linux` Worker. Needs Workers Scripts:Edit + Workers Routes:Edit + Workers KV:Edit on the account, on zone `shadowfetch.com`. | Cloudflare dashboard → My Profile → API Tokens → Create. **Not yet set.** | +| `RELEASE_GITHUB_TOKEN` | GitHub PAT used by `softprops/action-gh-release` to create signed releases. Needs `contents:write` on this repo. | github.com → Settings → Developer settings → Personal access tokens. | +| `SHADOWFETCH_GPG_PRIVATE_KEY` | ASCII-armored private key for the Shadowfetch APT/ISO signing key (fingerprint `8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1`). Used to sign the ISO and the reprepro repo. | Export from the build host with: `gpg --armor --export-secret-keys signing@shadowfetch.com`. | +| `R2_ACCESS_KEY_ID` | Access Key ID for an R2 API token scoped to `shadowfetch-linux` bucket (Object Read & Write). | Cloudflare dashboard → R2 → Manage R2 API Tokens → Create. Rotate any token that was used for manual publish. | +| `R2_SECRET_ACCESS_KEY` | Secret Access Key paired with `R2_ACCESS_KEY_ID`. | Shown once when the token is created. | +| `CLOUDFLARE_API_TOKEN` | Cloudflare API token used by `wrangler deploy` to publish the `shadowfetch-linux` Worker. Needs Workers Scripts:Edit + Workers Routes:Edit + Workers KV:Edit on the account, on zone `shadowfetch.com`. | Cloudflare dashboard → My Profile → API Tokens → Create. | + +This file names secrets. It does not contain secret values. Do not paste key +material, tokens, or `.env` contents into issues, PRs, or this document. + +The ISO itself is **not** uploaded to GitHub Releases (2 GiB per-file limit; +2.1.5 is 3.97 GB). The workflow attaches only `.iso.sha256` and `.iso.asc`. ## How the workflow triggers -- **Tag push (`v*`)**: full release pipeline — build ISO, sign, publish to R2, deploy Worker, create draft GitHub release. -- **Manual dispatch (`workflow_dispatch`)**: build only by default; choose `publish=true` to also publish + deploy. Useful for dry-runs. +- **Tag push (`v*`):** full release pipeline — build ISO, sign, publish to R2, deploy Worker, create draft GitHub release. +- **Manual dispatch (`workflow_dispatch`):** build only by default; choose `publish=true` to also publish + deploy. Useful for dry-runs. ## Cutting a release ```sh -git tag v1.0.1 -git push origin v1.0.1 +git tag v2.1.5 +git push origin v2.1.5 ``` -Workflow runs in CI. When it finishes (~60 min), publish the draft release in the GitHub UI. +The tag name must match `VERSION` in the Makefile (`v2.1.5` for the current +tree). Workflow runs in CI. When it finishes, publish the draft release in the +GitHub UI. Paste verify URLs from `docs/GITHUB-RELEASE.md` if the generated +body is too thin. diff --git a/.github/DISCUSSION_TEMPLATE/support.yml b/.github/DISCUSSION_TEMPLATE/support.yml deleted file mode 100644 index 9c2c992..0000000 --- a/.github/DISCUSSION_TEMPLATE/support.yml +++ /dev/null @@ -1,14 +0,0 @@ -body: - - type: markdown - attributes: - value: | - Use this space for support questions, installation notes, and hardware observations that are not yet reproducible bugs. - If you have a reproducible bug, use the Bug report issue template instead. - Do not post password CSVs, secrets, tokens, or unredacted private diagnostics. - - type: textarea - id: question - attributes: - label: Question or report - description: Include the ISO filename, boot mode, hardware model, and what you tried when useful. - validations: - required: true diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 61098c6..35f24d0 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -6,14 +6,14 @@ body: - type: markdown attributes: value: | - Use Discussions for support questions. Use this form for reproducible bugs. + Use this form for reproducible bugs. Hardware compatibility notes belong on the Hardware report form. Do not attach password CSVs, secrets, tokens, or unredacted private logs. - type: input id: iso attributes: label: ISO filename description: Exact ISO filename you downloaded or installed from. - placeholder: shadowfetch-2.1.1-amd64.iso + placeholder: shadowfetch-2.1.5-amd64.iso validations: required: true - type: dropdown diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 58da664..1c67660 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,11 +1,11 @@ -blank_issues_enabled: false +blank_issues_enabled: true contact_links: - - name: Support questions and install help - url: https://github.com/ShadowfetchLinux/shadowfetch-linux/discussions - about: Use Discussions for questions, install reports, and hardware notes that are not reproducible bugs. - name: Verification guide url: https://www.shadowfetchlinux.org/verify about: Verify the ISO checksum, detached signature, and signing key before installing. - name: Security model url: https://www.shadowfetchlinux.org/security - about: Read the Shadowfetch Linux security model and reporting guidance. + about: Read the Shadowfetch Linux security model. Report vulnerabilities privately to shadowfetchlinux@gmail.com. + - name: Canonical website + url: https://www.shadowfetchlinux.org + about: Download page, install guide, known issues, and the current 2.1.5 release notes. diff --git a/.github/ISSUE_TEMPLATE/hardware_report.yml b/.github/ISSUE_TEMPLATE/hardware_report.yml index e6b2edc..3ffbc6a 100644 --- a/.github/ISSUE_TEMPLATE/hardware_report.yml +++ b/.github/ISSUE_TEMPLATE/hardware_report.yml @@ -6,8 +6,16 @@ body: - type: markdown attributes: value: | - Hardware reports help build the community test matrix. Use Discussions for support questions before opening a bug. + Hardware reports help build the community test matrix. Reproducible bugs belong on the Bug report form. Do not attach secrets, password CSVs, or unredacted private diagnostics. + - type: input + id: iso + attributes: + label: ISO filename + description: Exact ISO filename you downloaded or installed from. + placeholder: shadowfetch-2.1.5-amd64.iso + validations: + required: true - type: input id: computer_model attributes: diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..c07c5bc --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,13 @@ +## What this PR changes + +- [ ] `make source-gate` passes locally (or I explain why it cannot run here) +- [ ] No ISO, torrent, `.deb`, GPG private key, Cloudflare token, or secret leaked in the diff +- [ ] Docs and comments match 2.1.5 if they mention the current stable + +## How to test + + + +## Notes + + diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml index 6d28268..5cd21bb 100644 --- a/.github/workflows/build-iso.yml +++ b/.github/workflows/build-iso.yml @@ -99,6 +99,27 @@ jobs: npm install -g wrangler cd web/shadowfetch-linux-worker && wrangler deploy + - name: Compose GitHub release notes + if: startsWith(github.ref, 'refs/tags/v') + run: | + VERSION=$(awk '/^VERSION[[:space:]]*\?=/{print $3; exit}' Makefile) + ISO="shadowfetch-${VERSION}-amd64.iso" + SHA=$(awk '{print $1; exit}' "${ISO}.sha256") + cat > /tmp/github-release-body.md < Compute**. -- The relay and shared-compute endpoints remain loopback-only by default. -- Codex CLI remains optional and independent of the local Buzz model path. -- Shadowfetch includes no OpenAI credential. Codex offers its own supported - sign-in methods only after the user explicitly installs and opens it. -- A Codex download or authentication failure cannot block the base operating - system installation or remove a working Buzz setup. -- Retired agent and secondary model runtimes do not return to the active image - or menus. - -## Upgrade from 2.1.4 - -The supported in-place path is the signed Shadowfetch APT repository: - -```bash -sudo apt update -shadowfetch-update -``` - -Release acceptance must exercise that transaction from a real 2.1.4 -installation, preserve user files and Buzz state, reboot cleanly, and show no -failed services. The 2.1.4 recovery and removal-safety checks remain in force. - -## Deferred to 2.2.0 - -The offline-oriented `shadowfetch-hardware` repair helper under `next-release/` -remains staged and unshipped. Guide 2.1.5 explains measured state and opens -existing safe tools; autonomous repair plans and new model runtimes remain -outside this release. - -## Release gates - -- Pass source, behavior, syntax, ShellCheck, secret, and retired-runtime scans. -- Prove the Passport omits seeded host, account, network, serial, PCI-slot, and - filesystem identifiers; prove the check itself performs no upload or repair. -- Exercise Guide in both the final live session and a real 2.1.4-to-2.1.5 - upgraded installation, including redacted HTML and JSON export. -- Build and inspect every 2.1.5 binary and corresponding source package. -- Verify the signed local repository, package install, upgrade, and rollback. -- Verify the exact ISO structure, checksum, detached signature, BIOS, and UEFI. -- Complete clean BIOS and encrypted UEFI installations and reboot tests. -- Exercise Buzz setup, model consent, real inference, failure recovery, relay - isolation, and Plasma Wayland responsiveness. -- Exercise the Codex opt-in default, installer and release verification, - user-level ownership, menu integration, cancellation, retry and authentic - first-launch sign-in screen without preloaded credentials. -- Run sustained CPU, memory, storage, network, graphics, Buzz, reboot, and - filesystem stress checks. -- Capture fresh 2.1.5 screenshots and inspect them for stale branding, blank - windows, overlap, clipping, and misleading model state. -- Stage and verify website, GitHub, and Archive.org metadata before publication. -- Publish only after all required prepublication cases are green, then verify - every public artifact and canonical URL before marking 2.1.5 released. +This root path is a pointer so older links keep resolving. Do not edit a +second copy here. diff --git a/ROADMAP-NEXT-BUILD.md b/ROADMAP-NEXT-BUILD.md index 9a9a1d2..e8111bd 100644 --- a/ROADMAP-NEXT-BUILD.md +++ b/ROADMAP-NEXT-BUILD.md @@ -1,5 +1,10 @@ # Shadowfetch Linux — Next-Build Idea Backlog (post-1.0.6) +> **Historical.** Compiled 2026-05-29 against 1.0.6. It is not the 2.1.5 plan. +> Several items below (local AI, Btrfs snapshots, Calamares) later shipped in a +> different form. Current direction: [`docs/FIRE_ROADMAP.md`](docs/FIRE_ROADMAP.md) +> and https://www.shadowfetchlinux.org/roadmap. + *Compiled 2026-05-29 from Reddit research across r/linux, r/linux4noobs, r/DistroHopping, r/unixporn, r/kde, r/linux_gaming, r/privacy, r/debian, r/selfhosted (4 parallel research sweeps). Filtered against what 1.0.6 "Umbra" already ships. Tags: **Impact** (★ demand) · **Effort** (E/M/H) · 🜂 = strong Shadowfetch brand fit.* > **Hard constraint to respect:** 1.0.6's squashfs is already **3.1 GiB of the 4 GiB limit**. Heavy additions (Steam+Proton-GE ≈2 GB, AI tooling, models) must be **first-boot downloads via the Welcome app, NOT baked into the ISO** — both to stay under 4 GiB and to keep the image lean. This shapes the whole plan: bake *config*, download *bulk*. diff --git a/SECURITY.md b/SECURITY.md index ebb51e0..3ff39a2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,7 @@ Verify the ISO before installing it. The checksum proves the file downloaded int Current signing key fingerprint: -`8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1` +`8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1` Current verification guide: https://www.shadowfetchlinux.org/verify @@ -16,11 +16,17 @@ Security model: https://www.shadowfetchlinux.org/security A normal GPG "not certified with a trusted signature" warning means you have not personally trusted the key; it is not the same as a failed signature. Compare the fingerprint above before trusting the download. +Signed ISO bytes, checksum sidecars, detached signatures, and the APT repo are served from the freeze host `https://www.shadowfetch.com/linux/`. Human-facing guides live on `https://www.shadowfetchlinux.org`. The public key is on both hosts (`/linux/shadowfetch.gpg.asc` on the freeze host, `/shadowfetch.gpg.asc` on the public site). + ## Reporting security-sensitive findings -Use the security surface for private or security-sensitive findings. Do not attach secrets, private keys, password exports, access tokens, or unredacted diagnostics to public issues. +Email **shadowfetchlinux@gmail.com** — the address published on https://www.shadowfetchlinux.org — for private or security-sensitive findings. Do not attach secrets, private keys, password exports, access tokens, or unredacted diagnostics to public issues. + +This GitHub account is a User, not an Organization. Prefer email over a public issue for anything that could be used to attack users or the build/signing pipeline. -For hardware and install bugs, GitHub Issues are fine. If you include `shadowfetch-health --json`, remove anything you consider private before posting. +For hardware and install bugs, GitHub Issues are fine: https://github.com/ShadowfetchLinux/shadowfetch-linux/issues + +If you include `shadowfetch-health --json`, remove anything you consider private before posting. ## Public issue boundaries @@ -30,5 +36,3 @@ Please do not post: - private keys, tokens, or credentials; - full disk serial inventories if you do not want them public; - logs that include private hostnames, usernames, or network names without redaction. - -Use GitHub Issues for support questions, hardware reports, and non-sensitive installation notes: https://github.com/Realbobcorbin/shadowfetch-linux/issues diff --git a/docs/GITHUB-RELEASE.md b/docs/GITHUB-RELEASE.md new file mode 100644 index 0000000..12e23f3 --- /dev/null +++ b/docs/GITHUB-RELEASE.md @@ -0,0 +1,49 @@ +# GitHub release notes (paste template) + +GitHub's per-file release-asset limit is 2 GiB. The Shadowfetch ISO is ~4 GB, +so **do not attach the ISO** to a GitHub Release. Attach only the small +verification files (`.iso.sha256`, `.iso.asc`) if you want them on the tag; +the signed image itself stays on the freeze host. + +The current tag is `v2.1.5`. The notes already published there can be replaced +with the body below if they drift. Future tags can start from this template. + +Checksums in-tree: [`SHA256SUMS`](../SHA256SUMS) (signed as `SHA256SUMS.asc`). +The public key copy in this repo is [`shadowfetch-release.asc`](../shadowfetch-release.asc). + +## Body for v2.1.5 + +~~~~markdown +## Shadowfetch Linux 2.1.5 «Umbra» — Fire Edition + +GitHub does not host the ISO (4 GB; GitHub's per-file limit is 2 GiB). +Download the signed image from the freeze host, then verify it. + +### Download +- **ISO:** https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso — 3,968,471,040 bytes (3.97 GB / 3.70 GiB), BIOS + UEFI hybrid +- **SHA-256:** `848f043e4d6f85c3607e7034ba911a1ce8b4a317674feebef8b07fcd8f531c24` +- **Checksum sidecar:** https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.sha256 +- **Signature:** https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.asc +- **Signing key:** https://www.shadowfetch.com/linux/shadowfetch.gpg.asc +- **Fingerprint:** `8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1` +- **Verify guide:** https://www.shadowfetchlinux.org/verify +- **Download page:** https://www.shadowfetchlinux.org/download +- **Archive.org mirror:** https://archive.org/details/shadowfetch-linux-2-1-5 + +### Verify + +```sh +curl -LO https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso +curl -LO https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.sha256 +curl -LO https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.asc +curl -LO https://www.shadowfetch.com/linux/shadowfetch.gpg.asc +gpg --import shadowfetch.gpg.asc \ + && gpg --verify shadowfetch-2.1.5-amd64.iso.asc shadowfetch-2.1.5-amd64.iso \ + && sha256sum -c shadowfetch-2.1.5-amd64.iso.sha256 +``` + +A GPG "not certified with a trusted signature" warning only means you have not +personally trusted the key. Compare the fingerprint before you trust the download. + +Full notes: https://github.com/ShadowfetchLinux/shadowfetch-linux/blob/main/docs/RELEASE-2.1.5.md +~~~~ diff --git a/docs/RELEASE-2.1.5.md b/docs/RELEASE-2.1.5.md index c244758..47ac57e 100644 --- a/docs/RELEASE-2.1.5.md +++ b/docs/RELEASE-2.1.5.md @@ -11,8 +11,13 @@ and the public artifacts were verified after publication. - SHA-256: `848f043e4d6f85c3607e7034ba911a1ce8b4a317674feebef8b07fcd8f531c24` - Detached signature: `shadowfetch-2.1.5-amd64.iso.asc` - Signing key: `8F13 CE15 35EE 1F4A 2916 A1F7 3C5C 900B 7BE8 0CA1` -- Download: https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso -- Canonical website: https://www.shadowfetchlinux.org · Mirror: https://archive.org/details/shadowfetch-linux-2-1-5 +- Canonical website: https://www.shadowfetchlinux.org +- Download page: https://www.shadowfetchlinux.org/download +- Signed ISO (freeze host; this is the URL that returns the image bytes): https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso +- Checksum sidecar: https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.sha256 +- Detached signature: https://www.shadowfetch.com/linux/download/shadowfetch-2.1.5-amd64.iso.asc +- Signing key: https://www.shadowfetch.com/linux/shadowfetch.gpg.asc (also https://www.shadowfetchlinux.org/shadowfetch.gpg.asc) +- Mirror: https://archive.org/details/shadowfetch-linux-2-1-5 ## Release goal diff --git a/kimi-k3-abstract-hero.jpg b/kimi-k3-abstract-hero.jpg deleted file mode 100644 index 1e87081..0000000 Binary files a/kimi-k3-abstract-hero.jpg and /dev/null differ diff --git a/live-build/config/archives/README.md b/live-build/config/archives/README.md index 309d238..352431c 100644 --- a/live-build/config/archives/README.md +++ b/live-build/config/archives/README.md @@ -7,8 +7,9 @@ and tears it down on exit. `shadowfetch.list.binary` is the apt sources entry that ships *inside* the final ISO, pointing at the public APT repo at -`https://shadowfetch.com/linux/apt/`. End users get incremental updates -through that URL. +`https://www.shadowfetch.com/linux/apt`. End users get incremental updates +through that URL. Human-facing docs live on https://www.shadowfetchlinux.org ; +do not point apt at the `.org` host. The matching `.key.chroot` / `.key.binary` files (GPG public key, armored) are copied here by `make iso` from `repo/shadowfetch.gpg.asc`. They're diff --git a/packages.manifest b/packages.manifest index af13b03..e072916 100644 --- a/packages.manifest +++ b/packages.manifest @@ -1,3 +1,5 @@ +# Historical 2.1.1 reprepro listing. Not the current 2.1.5 inventory. +# Current package versions are 2.1.5-1 (see packages/*/debian/changelog). umbra|main|amd64: grub-btrfs 4.14-1shadowfetch1 umbra|main|amd64: shadowfetch-branding 2.1.1-1 umbra|main|amd64: shadowfetch-creative-base 2.1.1-1 diff --git a/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/LICENSES.md b/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/LICENSES.md index 478fcb4..1d11685 100644 --- a/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/LICENSES.md +++ b/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/LICENSES.md @@ -30,9 +30,9 @@ license does not grant rights to those downloaded products. The complete corresponding source for the Shadowfetch packages is: * published at https://github.com/ShadowfetchLinux/shadowfetch-linux - * available as a source tarball at - https://shadowfetch.com/linux/apt/sources/shadowfetch-source-2.1.5.tar.gz + * published in the signed APT `main/source` component at + https://www.shadowfetch.com/linux/apt/dists/umbra/main/source/ For source of any upstream Debian/KDE component, contact -signing@shadowfetch.com and we will direct you to, or provide, the exact +shadowfetchlinux@gmail.com and we will direct you to, or provide, the exact corresponding source for the version shipped. diff --git a/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/SOURCES.md b/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/SOURCES.md index 1bc0785..91b8b48 100644 --- a/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/SOURCES.md +++ b/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/SOURCES.md @@ -31,12 +31,14 @@ Official documentation is linked from `CODING-AGENTS.md`. ### Written offer for corresponding source The complete corresponding source for the Shadowfetch packages of THIS release -is published as a signed tarball alongside the release: +is published in the signed APT repository's `main/source` component, and in +this project's public git tree: - https://shadowfetch.com/linux/apt/sources/shadowfetch-source-2.1.5.tar.gz + https://github.com/ShadowfetchLinux/shadowfetch-linux + https://www.shadowfetch.com/linux/apt/dists/umbra/main/source/ -Its SHA-256 is published next to it (…tar.gz.sha256). The project's public home -and issue tracker are at https://github.com/ShadowfetchLinux/shadowfetch-linux . -For the corresponding source of any upstream Debian/KDE component shipped in -this image, email signing@shadowfetch.com and we will provide the exact source -for the version shipped, at no more than the cost of distribution. +Enable the source component and fetch a package with `apt-get source`, for +example `apt-get source shadowfetch-welcome`. For the corresponding source of +any upstream Debian/KDE component shipped in this image, email +shadowfetchlinux@gmail.com and we will provide the exact source for the version +shipped, at no more than the cost of distribution. diff --git a/shadowfetch-2.1.4-amd64.iso.torrent b/shadowfetch-2.1.4-amd64.iso.torrent deleted file mode 100644 index edd3905..0000000 Binary files a/shadowfetch-2.1.4-amd64.iso.torrent and /dev/null differ diff --git a/web/shadowfetch-linux-worker/README.md b/web/shadowfetch-linux-worker/README.md index 39d4703..e6952fc 100644 --- a/web/shadowfetch-linux-worker/README.md +++ b/web/shadowfetch-linux-worker/README.md @@ -1,19 +1,21 @@ # shadowfetch-linux Worker -Cloudflare Worker that serves the `shadowfetch.com/linux/*` subtree: +Cloudflare Worker that serves **signed artifacts** under `shadowfetch.com/linux/*`. + +Human-facing pages (download, verify, install, changelog, `releases.json`) are +canonical on **https://www.shadowfetchlinux.org**. In production those +`/linux/...` HTML routes 301 there. This Worker still owns: -- `/linux/` — landing page (auto-detects latest ISO in R2 and surfaces it) -- `/linux/download` — download page with checksum + signature instructions - `/linux/download/` — streams from R2 `releases/` (Range-supporting) -- `/linux/install` — install guide (Calamares walkthrough + add-to-existing-Debian flow) -- `/linux/docs` — documentation index for install, verification, hardware, security, recovery, and release notes -- `/linux/changelog` — release notes -- `/linux/releases.json` — machine-readable metadata for the current signed release -- `/linux/releases.atom.xml` — Atom feed containing the current signed release - `/linux/shadowfetch.gpg.asc` — public signing key (also at `/linux/apt/shadowfetch.gpg.asc` for `signed-by=`) - `/linux/apt/...` — APT repo proxy, passes through R2 `apt/...` (reprepro output) -The existing `shadowfetch-home` Worker handles `shadowfetch.com/` (the apps studio). It is **not modified** by this Worker — Cloudflare's most-specific route match means `/linux*` lands here and everything else still goes to shadowfetch-home. +HTML page handlers remain in `src/index.js` for local `wrangler dev` and as a +fallback. Do not treat them as the public site; the Astro site on +shadowfetchlinux.org is current (2.1.5 / Buzz). The in-Worker copy still +describes older local-AI wording in places and is not the reviewer surface. + +The existing `shadowfetch-home` Worker handles `shadowfetch.com/` (the apps studio). It is **not modified** by this Worker. ## R2 layout diff --git a/web/shadowfetch-linux-worker/src/index.js b/web/shadowfetch-linux-worker/src/index.js index 168ebaa..74b5f0e 100644 --- a/web/shadowfetch-linux-worker/src/index.js +++ b/web/shadowfetch-linux-worker/src/index.js @@ -1,6 +1,11 @@ -// shadowfetch.com/linux/* — landing + download + APT repo proxy +// shadowfetch.com/linux/* — signed ISO/APT artifact proxy (R2) // Bindings: RELEASES (R2 bucket "shadowfetch-linux") // +// Human-facing pages are canonical on https://www.shadowfetchlinux.org . +// Production 301s /linux HTML routes there. This file still contains HTML +// fallbacks for wrangler dev; artifact routes (/linux/download/*, /linux/apt/*, +// /linux/shadowfetch.gpg.asc) are what production uses. +// // R2 layout: // releases/shadowfetch--amd64.iso // releases/shadowfetch--amd64.iso.sha256 @@ -13,7 +18,7 @@ const GPG_FINGERPRINT = "8F13CE1535EE1F4A2916A1F73C5C900B7BE80CA1"; const SHADOWFETCH_211_TORRENT_ALIAS = "/linux/download/shadowfetch-2.1.1-amd64.iso.torrent"; const SHADOWFETCH_211_TORRENT_RELEASE = - "https://github.com/Realbobcorbin/shadowfetch-linux/releases/download/v2.1.1/shadowfetch-2.1.1-amd64.iso.torrent"; + "https://archive.org/download/shadowfetch-linux-2-1-1/shadowfetch-2.1.1-amd64.iso.torrent"; // The raw download stats at /linux/_stats are gated behind a secret. Set it once: // wrangler secret put STATS_TOKEN @@ -665,7 +670,7 @@ function humanBytes(n) { const SITE = "https://www.shadowfetch.com"; const OG_IMAGE = SITE + "/linux/assets/sf-logo-nav.png"; -const SITE_BUILD = "2026.08.11.1"; +const SITE_BUILD = "2026.08.21.1"; const CLOUDFLARE_WEB_ANALYTICS_TOKEN = "1433629b72d147acb61f41a951d81de1"; const DEFAULT_DESC = "Shadowfetch Linux (Umbra) — a private, AI-ready creative workstation built honestly on Debian. KDE Plasma 6, themed in shadow and gold, local AI built in, every creative tool ready out of the box.";