iso

Storing an image is the same job as the file backend. What makes this a separate backend is that it LEARNS what the bytes are supposed to be instead of being told: a source declares where its checksums file, its detached signature, and its keyring live, and the line for your image in that manifest becomes the REQUIRED digest. Everywhere else verification is attested: an artifact is checked when upstream published a claim, and stored unverified when it published none. Here there is no such allowance — an image the manifest does not vouch for is refused.

Verification uses gpgv, never gpg --verify, and the difference is not pedantry. gpgv consults exactly the keyring you hand it, with no keyserver and no web of trust. gpg --verify against your ambient keyring succeeds for ANY key you happen to have installed — a much weaker claim wearing the same exit code and the same green tick.

It fails closed: a source declaring a signature with no keyring is refused at LOAD, not silently downgraded to checksums.

Images are pinned on arrival and live in their own image retention class, so garbage collection cannot reclaim one for being large and idle.

Declared images become generated iPXE scripts — a menu at /iso/boot.ipxe, one entry at /iso/boot/<id> — so a bare machine can netboot and install with every byte coming from the mirror.