dotfiles-Debian

OS-nativeStable

Debian-family apt layer targeting Ubuntu 24.04 LTS. The fleet’s only frozen release — so most of the modern-CLI stack arrives as pinned, checksum-verified upstream assets.

Highlights

  • apt + vendor repos
  • SHA-256 pinned assets
  • version-floor CI gate
  • Ubuntu 24.04 + Debian trixie

How it fits

The OS-native layer — Package manager, paths, clipboard — what changes with the OS. It builds on Core, which is vendored into its core/ directory. See the three-layer model for how the layers compose.

Getting started

git clone https://github.com/dotgibson/dotfiles-Debian ~/dotfiles-Debian
cd ~/dotfiles-Debian
./bootstrap.sh
exec zsh

Targets Ubuntu 24.04 LTS; Debian trixie is proven in CI. Flags: --links-only, --no-upgrade, --no-unattended, --force-os (for Mint/Pop!_OS/Raspbian).

What actually bites

  • A frozen archive changes the question — Ubuntu LTS froze in April 2024, so “apt has it” is not the same as “apt has a version Core can use”. noble resolves neovim 0.9.5 and tree-sitter-cli 0.20.8 perfectly happily; Core needs 0.12 and 0.26.1. install/packages.txt declares # min: floors and CI enforces them — a resolution-only check would call that box healthy.
  • Pinned assets, never curl | sh — Twelve tools apt cannot supply come from GitHub release assets pinned by version AND SHA-256 in install/tool-versions.env. It is fail-closed: a missing pin, failed download, or hash mismatch skips that tool loudly rather than installing anything unverified. Neovim needs a tree install (bin/ + share/nvim/runtime), not a lone binary.
  • Vendor apt repos yes, PPAs no — glow/gum come from Charm’s signed repo and op from 1Password’s — both vendor-signed and identical on Debian and Ubuntu. A PPA is keyed to an Ubuntu series, so it 404s on Debian and would break the trixie CI lane, and it is unpinned and single-maintainer besides.
  • This is the Kali repo now, too — It accepts ID=kali as a first-class target alongside Ubuntu and Debian, and it carries the WSL bootstrap. The three do not share an archive age — Ubuntu 24.04 froze in April 2024 while Kali tracks sid — so install/packages.txt is distro-tiered with # only:kali annotations: names Kali gets straight from apt are fetched as pinned, checksum-verified assets on the frozen LTS. The offensive tooling lives in dotfiles-Offense, stacked on top.

Read next

View dotfiles-Debian on GitHub ↗