skills.rest
doctorspider42
doctorspider42COMMUNITY
Explore all skills by this author →
GitHub

debian-media

Downloads and verifies Debian, Ubuntu, and Fedora installation media with OpenPGP signature chains.

Updated Aug 18, 2026
Search Tags:#rust#signature verification#debian#fedora#download cache#vmm#openpgp
One-click install
npx skills add https://github.com/doctorspider42/entangled-destop --skill debian-media-doctorspider42
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: debian-media
Source: https://github.com/doctorspider42/entangled-destop/tree/main/.agents/skills/debian-media
Command: npx skills add https://github.com/doctorspider42/entangled-destop --skill debian-media-doctorspider42

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Fetching Linux distribution installation media safely requires verifying signatures and checksums in the correct order, handling resumable downloads, and maintaining a provenance cache — mistakes here silently install unverified or wrong images. ## Core Features & Use Cases - Verified media downloads: Resolves Debian channel/version URLs, verifies detached OpenPGP signatures against pinned keyrings before checking SHA-512/SHA-256 digests, and writes provenance manifests next to every artifact. - Resumable cache management: Uses HTTP Range requests with .part files, a versioned cache layout under $XDG_CACHE_HOME/entangled/media, and no-op re-fetches when the manifest verifies. - Guest bootstrap kernel and Fedora/Ubuntu scripts: Covers the pinned-SHA-256 bootstrap kernel trust model, Fedora clearsigned CHECKSUM handling, kickstart delivery via OEMDRV seed images, and the quirks of automated Fedora installs. - Use Case: Before modifying entangled fetch or the debian-media crate, load this Skill to understand the trust chain ordering, license constraints (rpgp instead of sequoia-openpgp), and test scaffolding so changes do not break verification guarantees. ## Quick Start Load the debian-media skill before working on entangled fetch or media verification code in the debian-media crate.

Frequently Asked Questions about debian-media

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify Debian ISO downloads with OpenPGP in Rust?▼

Verify the detached SHA512SUMS.sign signature against the pinned Debian CD keyring first, then stream-verify the ISO's SHA-512 digest while downloading. Use the rpgp crate for OpenPGP, since sequoia-openpgp is LGPL and blocked by cargo deny.

What is the trust chain for Debian netboot installer files?▼

The netboot directory publishes no signature of its own; the signed archive Release file is the root. Verify Release.gpg against the Debian archive keyring, then follow SHA-256 hashes through Release to images/SHA256SUMS to the linux and initrd.gz files.

Why does cargo deny block sequoia-openpgp in this project?▼

sequoia-openpgp is LGPL-licensed, which violates the project's no-copyleft rule enforced by cargo deny. The rpgp crate (pgp on crates.io) is MIT/Apache-2.0 and is the approved OpenPGP implementation.

How do resumable downloads work with checksum verification?▼

Downloads land in a .part file and use HTTP Range requests to resume after interruption. Because hash state cannot persist across runs, the existing prefix is re-hashed on resume, and the file is renamed only after the digest check passes.

Why can't the Fedora Live ISO be kickstarted?▼

The Live image's initramfs contains no anaconda dracut modules, so nothing in it can find or parse a kickstart by any route. Use the Fedora Everything netinst ISO for automated installs; the Live image only boots to a desktop.

What are the limitations of the bootstrap kernel trust model?▼

The bootstrap kernel has no signature; its anchor is a SHA-256 pin embedded in the binary via include_str. Its manifest records signature_verified as false, and release tags must never be rebuilt in place so pins keep fetching the same bytes.

Related Skills

Explore More Software Engineering Skills→
vigoliumvigolium
965

sarif-parsing

Convert SARIF static analysis outputs into deduplicated findings for CI/CD gating.

Official
Intermediate
MrPointerMrPointer
2

testing-e2e-containers

Execute end-to-end installer tests in Docker containers across Ubuntu, Debian, and Fedora.

Community
Advanced
apacheapache
79

magpie-dependency-license-audit

Audit dependency licenses and classify them against configurable policies.

Official
Advanced
dchukdchuk
30

packaging-tauri-for-linux

Package Tauri v2 applications into AppImage, Debian, RPM, Flatpak, Snap, and AUR formats.

Community
Advanced