APT Repository

APT Repository

SkillFishOS ships a signed APT repository (codename aetherium) that delivers the custom kernel and every native app as updatable .debs.

Where it lives

Built with reprepro on the release machine; suite aetherium, component main, architectures amd64 i386 source, GPG-signed. Three mirrors serve the same signed tree:

#	Mirror	Notes
1	https://skillfishos.com/apt	OVH, ours, carries the normal traffic
2	https://mtsistemi.github.io/SkillFishOS	GitHub Pages, absorbs bursts
3	https://deb.skillfishos.com	at home; last on purpose, a home line's upstream is not a CDN

Signing happens in exactly one place. The other two receive a copy that is already signed, so a compromised mirror cannot inject a package — at worst it serves something stale, and Signed-By in the source file catches the rest.

Client setup (already on the ISO)

The installed system already has:

• skillfishos-archive-keyring — the signing key and the mirror list.
• /etc/apt/sources.list.d/skillfishos.sources, which does not name one address:

Types: deb
URIs: mirror+file:/etc/apt/mirrors/skillfishos.list
Suites: aetherium
Components: main
Signed-By: /usr/share/keyrings/skillfishos-archive-keyring.gpg

apt walks that list in order: if the first mirror does not answer it drops it and moves on, so one mirror going down no longer stops updates.

New mirrors arrive on their own. skillfish-aggiorna-mirror.timer runs weekly, fetches a signed mirrors.list.gpg from whichever known mirror answers, verifies it against the archive key already installed, and rewrites the local list. The list is signed not because anyone could inject packages — they cannot — but because whoever controls the list controls where you download from.

So apt update && apt full-upgrade, the SkillFishOS Hub, or KDE Discover all pull SkillFishOS updates alongside Debian's.

What's in it

Package	Notes
skillfishos-kernel	thin wrapper that fetches the full kernel .deb from the GitHub Release
skillfish-tuner	SkillFishOS Tuner
skillfish-hub	SkillFishOS Hub
skillfish-ai-panel	on-device AI panel
skillfish-monitor	live sensor charts
skillfish-kernel-manager	kernel chooser / remover
skillfish-iso-mount	Dolphin ISO mounting
skillfish-menu	the "SkillFishOS" submenu

i386 is populated by reprepro flood so the Architecture: all packages resolve on every arch.

Snapshots = a safety net

Because Snapper takes a Btrfs snapshot before and after every apt transaction (with @home kept separate), a bad update is one GRUB rollback away — see Installation.

Publishing (maintainers)

Bump the package version → reprepro includedeb aetherium <deb> → reprepro flood aetherium i386 → tar dists+pool+keyring → publish to the gh-pages branch and mirror to OVH. The kernel image is published as a GitHub Release asset (it exceeds the 100 MB GitHub Pages limit) and pulled out-of-band by the wrapper's postinst.