visync 1.0.0__tar.gz

visync-1.0.0/.gitignore

@@ -0,0 +1,36 @@
+.venv/
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+.idea/
+.vscode/
+*.sublime-project
+*.sublime-workspace
+*.log
+*.sqlite3
+*.db
+*.bak
+*.backup
+*.swp
+.DS_Store
+*.egg-info/
+dist/
+build/
+*.egg
+*.mo
+*.pot
+*.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+
+# 255 KB audit dump accidentally committed; see git history before 8bb78aa
+audit.txt

visync-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hxmbl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

visync-1.0.0/PKG-INFO

@@ -0,0 +1,204 @@
+Metadata-Version: 2.5
+Name: visync
+Version: 1.0.0
+Summary: Ventoy ISO Synchronization Tool
+Project-URL: Homepage, https://github.com/hxmbl/visync
+Project-URL: Repository, https://github.com/hxmbl/visync
+Project-URL: Issues, https://github.com/hxmbl/visync/issues
+Author: hxmbl
+License: MIT
+License-File: LICENSE
+Keywords: checksum,iso,linux,package-manager,usb,ventoy
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Topic :: System :: Archiving :: Backup
+Classifier: Topic :: System :: Filesystems
+Classifier: Topic :: Utilities
+Requires-Python: <3.16,>=3.12
+Requires-Dist: rich>=13.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: pyright>=1.1.380; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.16; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Visync
+
+Ventoy Package Manager. Install, update, and manage Linux distros on your Ventoy drive.
+
+## Install
+
+Requires Python 3.12+ and a mounted Ventoy drive.
+
+```bash
+pip install visync
+```
+
+For a development checkout:
+
+```bash
+pip install -e ".[dev]"
+```
+
+Both layouts work out of the box: `config.toml` ships inside the installed package, so `visync search` finds the distro list from any directory.
+
+## Quick Start
+
+```bash
+# See what's available
+visync search
+
+# Auto-detect distros already on the drive
+visync autodetect
+
+# Install a distro
+visync install archlinux
+visync install nixos-graphical
+
+# Batch install from file
+visync install -i packages.txt
+
+# Update all installed distros
+visync update
+
+# Update a specific distro
+visync update tails
+
+# Check for old versions (dry-run)
+visync sync
+
+# Remove old versions
+visync sync --clean
+
+# Remove a distro
+visync remove tails
+
+# Show distro details
+visync info archlinux
+
+# Verify checksums
+visync verify
+```
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `visync search [query]` | List available distros (filter by query) |
+| `visync install <name>` | Download and register a distro |
+| `visync install -i <file>` | Batch install from file (one name per line) |
+| `visync remove <name>` | Delete from drive and unregister |
+| `visync update [name]` [--no-staging] | Update installed distros (all if no name given) |
+| `visync sync` [--no-staging] | Sync installed distros to latest |
+| `visync sync --all` [--no-staging] | Sync all configured distros |
+| `visync sync --clean` [--no-staging] | Remove old versions of same distro |
+| `visync sync --reset-visync` | Allow the watchdog to wipe an over-budget `.visync/` |
+| `visync list` | List ISOs on the drive |
+| `visync autodetect` | Register existing ISOs as installed |
+| `visync verify` | Verify checksums against upstream |
+| `visync info <name>` | Show distro details |
+
+## Batch Install File
+
+Create a text file with one distro name per line:
+
+```
+# My Ventoy setup
+archlinux
+nixos-minimal
+tails
+ubuntu-desktop
+ubuntu-server
+```
+
+Then run:
+
+```bash
+visync install -i packages.txt
+```
+
+Blank lines and lines starting with `#` are ignored.
+
+## Configuration
+
+Edit `config.toml` to add or remove distros. Each distro entry defines a scraping strategy, mirror URL, and checksum verification method.
+
+Config resolution order: explicit `--config` path, then `$VISYNC_CONFIG`, then `~/.config/visync/config.toml`, then the `config.toml` shipped inside the installed package. A `config.toml` in the current directory is only used as a last resort, so planted configs cannot hijack identification.
+
+**Release selection:** `version_filter` restricts a scraper to one release family before the newest match is chosen. Ubuntu entries use `\d*[02468]\.04(\.\d+)*` so they track the current LTS (26.04.1) and ignore interim releases (25.10, 26.10). NixOS resolves the newest stable `YY.MM` channel from the release bucket at scrape time, so it advances to the next stable without a config edit; set `channel = "26.05"` to pin deliberately while that channel is current.
+
+**Built-in strategies:**
+
+| Strategy | Description | Example |
+|---|---|---|
+| `direct_match` | Flat index page | Arch Linux |
+| `fedora_nested` | Version dirs + variant subdirs | Fedora, Fedora KDE |
+| `ubuntu_nested` | Version dirs | Ubuntu, Parrot Security |
+| `nixos_channel` | Stable-channel lookup + channel page parse | NixOS Minimal, NixOS Graphical |
+| `popos_api` | JSON API | Pop!_OS |
+| `tails_api` | JSON API | Tails |
+
+**Checksum formats:** `gpg_checksum` (Fedora — inline `SHA256 (file) = hash`), `sha256sums` (Ubuntu, Arch, Parrot, NixOS, Tails), `json` (Tails)
+
+Signature checking is configured separately via `signing_key_url` + `signing_key_fingerprint` and works with any signed layout, so Parrot's sectioned hash list gets both a signature check and a digest check.
+
+## How it works
+
+1. **Detect** — finds mounted Ventoy drives on Windows, macOS, or Linux (with udisksctl automount)
+2. **Scrape** — concurrent mirror scraping with TCP pre-flight checks and watchdog timeouts. A distro whose mirror can't be read is reported with the reason and makes the command exit non-zero; it is never silently counted as up to date
+3. **Select** — release-family filters keep scrapers on the intended series: Ubuntu tracks the current **LTS** (even-year `.04`, skipping interim releases and beta-only directories), and NixOS resolves the current **stable** channel from the release bucket instead of pinning a version string
+4. **Compare** — version-aware comparison (semantic or date-based) against local ISOs
+5. **Download** — streaming downloads with staging buffer (less drive wear), falls back to direct if staging full. Use `--no-staging` / `--no-buffer` to skip the staging buffer and download directly to the Ventoy drive.
+6. **Verify** — optional checksum verification against published hashes
+7. **Clean** — `--clean` removes deprecated ISOs of the same distro variant (dry-run by default)
+8. **State** — tracks installed distros in `.visync/installed.json`
+
+## Safety
+
+- `--clean` is dry-run by default, and `--dry-run` never modifies the drive — `sync --clean --dry-run` deletes nothing and does not touch `.visync/`
+- `remove` and `nuke-metadata` show exactly what will be deleted and ask for confirmation (`--yes` skips)
+- Ambiguous distro queries are refused with candidate lists instead of acting on an arbitrary match
+- Distro matching uses whole-token keywords (`pop` does not match `popcorn.iso`)
+- `.visync/` watchdog enforces a 1 GiB ceiling by deep-cleaning orphaned metadata. Wiping `.visync/` entirely is **opt-in** via `sync --reset-visync`, because it destroys `installed.json` and every registration
+- The watchdog never runs on `--dry-run`
+- Guardrails prevent deletion of `.iso` or `.img` files under any circumstance — including inside `.visync/metadata`
+- Downloads use parallel range requests with per-chunk HTTP 206 and byte-count validation; truncated or range-ignoring servers fail loudly instead of producing silent corruption
+- Checksum mismatch deletes the download; an *unreachable* checksum source keeps the file and warns (`UNVERIFIED`)
+- HTTPS is enforced for all mirrors and checksum sources (loopback exempt); https→http redirects are blocked
+- GPG signature verification supports fingerprint pinning via `signing_key_fingerprint`, and applies to any signed checksum file regardless of its digest layout (Fedora's inline `SHA256 (file) = hash`, Parrot's sectioned md5/sha256/sha512 list)
+- When multiple digests for the same file appear in one signed list, the configured `checksum_algo` selects the section — a first-match parser would compare an MD5 against a SHA-256 and delete a good download as corrupt
+- Failed downloads clean up `.part` files automatically
+- Install verifies file exists on drive before marking as installed
+- State and metadata writes are atomic (tmp file + rename)
+
+## Tests
+
+```bash
+python3 -m pytest test/ -v
+```
+
+CI installs from the committed `uv.lock` so a dependency release cannot break the build without a diff. `uv` is used for reproducible CI and builds only — installing visync itself with `pip` is fully supported.
+
+## Debug
+
+```bash
+VISYNC_DEBUG=1 visync sync
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

visync-1.0.0/README.md

@@ -0,0 +1,166 @@
+# Visync
+
+Ventoy Package Manager. Install, update, and manage Linux distros on your Ventoy drive.
+
+## Install
+
+Requires Python 3.12+ and a mounted Ventoy drive.
+
+```bash
+pip install visync
+```
+
+For a development checkout:
+
+```bash
+pip install -e ".[dev]"
+```
+
+Both layouts work out of the box: `config.toml` ships inside the installed package, so `visync search` finds the distro list from any directory.
+
+## Quick Start
+
+```bash
+# See what's available
+visync search
+
+# Auto-detect distros already on the drive
+visync autodetect
+
+# Install a distro
+visync install archlinux
+visync install nixos-graphical
+
+# Batch install from file
+visync install -i packages.txt
+
+# Update all installed distros
+visync update
+
+# Update a specific distro
+visync update tails
+
+# Check for old versions (dry-run)
+visync sync
+
+# Remove old versions
+visync sync --clean
+
+# Remove a distro
+visync remove tails
+
+# Show distro details
+visync info archlinux
+
+# Verify checksums
+visync verify
+```
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `visync search [query]` | List available distros (filter by query) |
+| `visync install <name>` | Download and register a distro |
+| `visync install -i <file>` | Batch install from file (one name per line) |
+| `visync remove <name>` | Delete from drive and unregister |
+| `visync update [name]` [--no-staging] | Update installed distros (all if no name given) |
+| `visync sync` [--no-staging] | Sync installed distros to latest |
+| `visync sync --all` [--no-staging] | Sync all configured distros |
+| `visync sync --clean` [--no-staging] | Remove old versions of same distro |
+| `visync sync --reset-visync` | Allow the watchdog to wipe an over-budget `.visync/` |
+| `visync list` | List ISOs on the drive |
+| `visync autodetect` | Register existing ISOs as installed |
+| `visync verify` | Verify checksums against upstream |
+| `visync info <name>` | Show distro details |
+
+## Batch Install File
+
+Create a text file with one distro name per line:
+
+```
+# My Ventoy setup
+archlinux
+nixos-minimal
+tails
+ubuntu-desktop
+ubuntu-server
+```
+
+Then run:
+
+```bash
+visync install -i packages.txt
+```
+
+Blank lines and lines starting with `#` are ignored.
+
+## Configuration
+
+Edit `config.toml` to add or remove distros. Each distro entry defines a scraping strategy, mirror URL, and checksum verification method.
+
+Config resolution order: explicit `--config` path, then `$VISYNC_CONFIG`, then `~/.config/visync/config.toml`, then the `config.toml` shipped inside the installed package. A `config.toml` in the current directory is only used as a last resort, so planted configs cannot hijack identification.
+
+**Release selection:** `version_filter` restricts a scraper to one release family before the newest match is chosen. Ubuntu entries use `\d*[02468]\.04(\.\d+)*` so they track the current LTS (26.04.1) and ignore interim releases (25.10, 26.10). NixOS resolves the newest stable `YY.MM` channel from the release bucket at scrape time, so it advances to the next stable without a config edit; set `channel = "26.05"` to pin deliberately while that channel is current.
+
+**Built-in strategies:**
+
+| Strategy | Description | Example |
+|---|---|---|
+| `direct_match` | Flat index page | Arch Linux |
+| `fedora_nested` | Version dirs + variant subdirs | Fedora, Fedora KDE |
+| `ubuntu_nested` | Version dirs | Ubuntu, Parrot Security |
+| `nixos_channel` | Stable-channel lookup + channel page parse | NixOS Minimal, NixOS Graphical |
+| `popos_api` | JSON API | Pop!_OS |
+| `tails_api` | JSON API | Tails |
+
+**Checksum formats:** `gpg_checksum` (Fedora — inline `SHA256 (file) = hash`), `sha256sums` (Ubuntu, Arch, Parrot, NixOS, Tails), `json` (Tails)
+
+Signature checking is configured separately via `signing_key_url` + `signing_key_fingerprint` and works with any signed layout, so Parrot's sectioned hash list gets both a signature check and a digest check.
+
+## How it works
+
+1. **Detect** — finds mounted Ventoy drives on Windows, macOS, or Linux (with udisksctl automount)
+2. **Scrape** — concurrent mirror scraping with TCP pre-flight checks and watchdog timeouts. A distro whose mirror can't be read is reported with the reason and makes the command exit non-zero; it is never silently counted as up to date
+3. **Select** — release-family filters keep scrapers on the intended series: Ubuntu tracks the current **LTS** (even-year `.04`, skipping interim releases and beta-only directories), and NixOS resolves the current **stable** channel from the release bucket instead of pinning a version string
+4. **Compare** — version-aware comparison (semantic or date-based) against local ISOs
+5. **Download** — streaming downloads with staging buffer (less drive wear), falls back to direct if staging full. Use `--no-staging` / `--no-buffer` to skip the staging buffer and download directly to the Ventoy drive.
+6. **Verify** — optional checksum verification against published hashes
+7. **Clean** — `--clean` removes deprecated ISOs of the same distro variant (dry-run by default)
+8. **State** — tracks installed distros in `.visync/installed.json`
+
+## Safety
+
+- `--clean` is dry-run by default, and `--dry-run` never modifies the drive — `sync --clean --dry-run` deletes nothing and does not touch `.visync/`
+- `remove` and `nuke-metadata` show exactly what will be deleted and ask for confirmation (`--yes` skips)
+- Ambiguous distro queries are refused with candidate lists instead of acting on an arbitrary match
+- Distro matching uses whole-token keywords (`pop` does not match `popcorn.iso`)
+- `.visync/` watchdog enforces a 1 GiB ceiling by deep-cleaning orphaned metadata. Wiping `.visync/` entirely is **opt-in** via `sync --reset-visync`, because it destroys `installed.json` and every registration
+- The watchdog never runs on `--dry-run`
+- Guardrails prevent deletion of `.iso` or `.img` files under any circumstance — including inside `.visync/metadata`
+- Downloads use parallel range requests with per-chunk HTTP 206 and byte-count validation; truncated or range-ignoring servers fail loudly instead of producing silent corruption
+- Checksum mismatch deletes the download; an *unreachable* checksum source keeps the file and warns (`UNVERIFIED`)
+- HTTPS is enforced for all mirrors and checksum sources (loopback exempt); https→http redirects are blocked
+- GPG signature verification supports fingerprint pinning via `signing_key_fingerprint`, and applies to any signed checksum file regardless of its digest layout (Fedora's inline `SHA256 (file) = hash`, Parrot's sectioned md5/sha256/sha512 list)
+- When multiple digests for the same file appear in one signed list, the configured `checksum_algo` selects the section — a first-match parser would compare an MD5 against a SHA-256 and delete a good download as corrupt
+- Failed downloads clean up `.part` files automatically
+- Install verifies file exists on drive before marking as installed
+- State and metadata writes are atomic (tmp file + rename)
+
+## Tests
+
+```bash
+python3 -m pytest test/ -v
+```
+
+CI installs from the committed `uv.lock` so a dependency release cannot break the build without a diff. `uv` is used for reproducible CI and builds only — installing visync itself with `pip` is fully supported.
+
+## Debug
+
+```bash
+VISYNC_DEBUG=1 visync sync
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

visync-1.0.0/config.toml

@@ -0,0 +1,259 @@
+#!/visync/config.toml
+[iso]
+download_dir = ""
+# ^ We don't download straight to the ventoy drive as its faster to verify and acts as a buffer. --no-buffer flag can override this, but verify will still happen, just on the drive.
+
+[checksums]
+enabled = true
+
+
+
+###################################
+####### DISTRO RECOGNITION ########
+###################################
+[base_distros]
+# Strict internal volume ID matches
+arch = "Arch Linux"
+fedora = "Fedora"
+ubuntu = "Ubuntu"
+debian = "Debian"
+
+[fork_overrides]
+# Key format: "parent_distro.keyword_in_filename" = "Clean Name"
+"arch.manjaro" = "Manjaro"
+"ubuntu.pop-os" = "Pop!_OS"
+"ubuntu.pop_os" = "Pop!_OS"
+"ubuntu.mint" = "Linux Mint"
+"debian.kali" = "Kali Linux"
+"debian.parrot" = "Parrot Security"
+# Fedora's aarch64 images carry "Fedora" in the volume ID, so without this they
+# are indistinguishable from x86_64 and install/remove cannot target one.
+"fedora.aarch64" = "Fedora ARM"
+
+[standalone_matches]
+# Text matching targets for standalone distros, flavors, and tools
+gparted = "GParted Live"
+hbcd = "Hiren's BootCD"
+hiren = "Hiren's BootCD"
+kodachi = "Linux Kodachi"
+nixos-minimal = "NixOS Minimal"
+nixos-graphical = "NixOS Graphical"
+nixos = "NixOS Minimal"
+parrot = "Parrot Security"
+pond = "Pond"
+pop = "Pop!_OS"
+systemrescue = "SystemRescue"
+rescuezilla = "Rescuezilla"
+tails = "Tails"
+tiny11 = "Tiny11"
+
+# Specific desktop flavor/version overrides so regex doesn't grab them poorly.
+# These must mirror the [distros.*] clean_name exactly: install/remove match an
+# identified distro against clean_name, so a missing entry here makes a
+# configured distro impossible to remove (test_verify_consistency_enforces this).
+fedora-kde = "Fedora KDE"
+fedora-arm = "Fedora ARM"
+ubuntu-desktop = "Ubuntu Desktop"
+ubuntu-server = "Ubuntu Server"
+
+###################################
+######## DYNAMIC SCRAPERS #########
+###################################
+#
+[distros.Fedora]
+clean_name = "Fedora"
+keyword = "fedora"
+strategy = "fedora_nested"
+# dl.fedoraproject.org serves an Anubis bot challenge to scrapers; kernel.org
+# mirrors the same tree bot-free. Integrity is pinned via signing_key_fingerprint.
+base_url = "https://mirrors.kernel.org/fedora/releases/"
+version_regex = 'href="([0-9]+)\s*/"'
+iso_regex = 'href="(Fedora-Workstation-Live-(?:x86_64-[0-9][0-9.\-]*\.iso|[0-9][0-9.\-]*\.x86_64\.iso))"'
+checksum_url = "{base_url}{version}/{variant_dir}/{arch}/iso/{checksum_stem}-CHECKSUM"
+checksum_format = "gpg_checksum"
+signing_key_url = "https://fedoraproject.org/fedora.gpg"
+# Release-signing keys from https://fedoraproject.org/fedora.gpg (refresh when
+# Fedora publishes new keys). Matches VALIDSIG fingerprints via --status-fd.
+signing_key_fingerprint = [
+    "C6E7F081CF80E13146676E88829B606631645531",
+    "36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6",
+    "4F50A6114CD5C6976A7F1179655A4B02F577861E",
+    "D924B10D3E810DABDD8B56B596E7E91491211FCE",
+]
+
+[distros.ArchLinux]
+clean_name = "Arch Linux"
+keyword = "archlinux"
+strategy = "direct_match"
+base_url = "https://geo.mirror.pkgbuild.com/iso/latest/"
+iso_regex = 'href="(archlinux-[0-9\.]+-x86_64\.iso)"'
+checksum_url = "{base_url}sha256sums.txt"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.UbuntuServer]
+clean_name = "Ubuntu Server"
+keyword = "live-server"
+strategy = "ubuntu_nested"
+base_url = "https://releases.ubuntu.com/"
+version_regex = 'href="([0-9\.]+)/"'
+# Current Ubuntu LTS only — see UbuntuDesktop for the rationale.
+version_filter = '\d*[02468]\.04(\.\d+)*'
+iso_regex = 'href="(ubuntu-[0-9\.-]+live-server-amd64\.iso)"'
+checksum_url = "{base_url}{version}/SHA256SUMS"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+################
+##### ARM ######
+################
+
+[distros.FedoraARM]
+clean_name = "Fedora ARM"
+keyword = "fedora-arm"
+strategy = "fedora_nested"
+# dl.fedoraproject.org serves an Anubis bot challenge to scrapers; kernel.org
+# mirrors the same tree bot-free. Integrity is pinned via signing_key_fingerprint.
+base_url = "https://mirrors.kernel.org/fedora/releases/"
+variant_path = "Workstation/aarch64/iso"
+version_regex = 'href="([0-9]+\s*/)"'
+# Fedora ships Workstation aarch64 lives under the standard variant subtree
+iso_regex = 'href="(Fedora-Workstation-Live-(?:aarch64-[0-9][0-9.\-]*\.iso|[0-9][0-9.\-]*\.aarch64\.iso))"'
+checksum_url = "{base_url}{version}/{variant_dir}/{arch}/iso/{checksum_stem}-CHECKSUM"
+checksum_format = "gpg_checksum"
+signing_key_url = "https://fedoraproject.org/fedora.gpg"
+signing_key_fingerprint = [
+    "C6E7F081CF80E13146676E88829B606631645531",
+    "36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6",
+    "4F50A6114CD5C6976A7F1179655A4B02F577861E",
+    "D924B10D3E810DABDD8B56B596E7E91491211FCE",
+]
+
+# NOTE: Arch Linux ARM was removed. os.archlinuxarm.org serves a TLS
+# certificate that does not match its hostname (scraping fails closed), and
+# its artifacts are per-device .tar.gz rootfs archives — not .iso/.img files
+# Ventoy can boot or visync can track. Re-add here if upstream publishes a
+# bootable image over a valid certificate.
+
+#############################
+###### ADDITIONAL DT #######
+#############################
+
+[distros.FedoraKDE]
+clean_name = "Fedora KDE"
+keyword = "fedora-kde"
+strategy = "fedora_nested"
+variant_path = "KDE/x86_64/iso"
+# dl.fedoraproject.org serves an Anubis bot challenge to scrapers; kernel.org
+# mirrors the same tree bot-free. Integrity is pinned via signing_key_fingerprint.
+base_url = "https://mirrors.kernel.org/fedora/releases/"
+version_regex = 'href="([0-9]+\s*/)"'
+iso_regex = 'href="(Fedora-KDE-Desktop-Live-(?:x86_64-[0-9][0-9.\-]*\.iso|[0-9][0-9.\-]*\.x86_64\.iso))"'
+checksum_url = "{base_url}{version}/{variant_dir}/{arch}/iso/{checksum_stem}-CHECKSUM"
+checksum_format = "gpg_checksum"
+signing_key_url = "https://fedoraproject.org/fedora.gpg"
+signing_key_fingerprint = [
+    "C6E7F081CF80E13146676E88829B606631645531",
+    "36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6",
+    "4F50A6114CD5C6976A7F1179655A4B02F577861E",
+    "D924B10D3E810DABDD8B56B596E7E91491211FCE",
+]
+
+[distros.UbuntuDesktop]
+clean_name = "Ubuntu Desktop"
+keyword = "desktop"
+strategy = "ubuntu_nested"
+base_url = "https://releases.ubuntu.com/"
+version_regex = 'href="([0-9\.]+)/"'
+# Track the current Ubuntu LTS rather than the newest release of any kind.
+# LTS is an even-numbered year with a .04 month; interim releases (26.10,
+# 25.10, ...) are excluded. Point releases like 26.04.1 also match, which is
+# what we want — those are the same LTS series.
+version_filter = '\d*[02468]\.04(\.\d+)*'
+iso_regex = 'href="(ubuntu-[0-9\.-]+desktop-amd64\.iso)"'
+checksum_url = "{base_url}{version}/SHA256SUMS"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.ParrotSecurity]
+clean_name = "Parrot Security"
+keyword = "parrot"
+strategy = "ubuntu_nested"
+base_url = "https://deb.parrotsec.org/parrot/iso/"
+version_regex = 'href="([0-9\.]+(?:-[0-9]+)?)/"'
+iso_regex = 'href="(Parrot-security-[0-9\.]+_amd64\.iso)"'
+# signed-hashes.txt is one clearsigned file listing md5, sha256 and sha512
+# sections for every image. The parser selects the sha256 section by header
+# and digest length — taking the first match would compare an md5 against a
+# sha256 and delete a good download as "corrupt".
+checksum_url = "{base_url}{version}/signed-hashes.txt"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+# Signing key published by Parrot and referenced from inside the signed
+# content itself. Fingerprint confirmed via gpg --verify (VALIDSIG) against
+# the untouched file, and matches the fingerprint in Parrot's own
+# hash-and-key-verification documentation.
+signing_key_url = "https://deb.parrot.sh/parrot/misc/archive.gpg"
+signing_key_fingerprint = [
+    "B711822346552E4D92DA02DF7A8286AF0E81EE4A",
+]
+
+[distros.NixOS]
+clean_name = "NixOS Minimal"
+keyword = "nixos-minimal"
+strategy = "nixos_channel"
+# base_url is a prefix: the current stable channel (e.g. 26.05) is appended,
+# giving https://channels.nixos.org/nixos-26.05, which redirects to the exact
+# releases.nixos.org directory. NixOS publishes no nixos-stable alias, so the
+# channel is resolved from the release bucket at scrape time — see
+# nixos_channel in src/download.py.
+base_url = "https://channels.nixos.org/nixos"
+# Optional pin. If set and still a real channel it wins; otherwise the newest
+# stable channel from the bucket is used. Omit to always track latest stable.
+# channel = "26.05"
+variant = "minimal"
+# ISOs and .sha256 sidecars live under releases.nixos.org, NOT the channel host
+# (channels.nixos.org serves no .sha256, which made `visync verify` fail with
+# "source unreachable" for every NixOS ISO).
+releases_base_url = "https://releases.nixos.org"
+# Sidecars sit at /nixos/<channel>/nixos-<full release>/<iso>.sha256
+checksum_url = "{release_base_url}/nixos/{version}/nixos-{release}/{iso_name}.sha256"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.NixOSGraphical]
+clean_name = "NixOS Graphical"
+keyword = "nixos-graphical"
+strategy = "nixos_channel"
+base_url = "https://channels.nixos.org/nixos"
+variant = "graphical"
+releases_base_url = "https://releases.nixos.org"
+checksum_url = "{release_base_url}/nixos/{version}/nixos-{release}/{iso_name}.sha256"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.PopOS]
+clean_name = "Pop!_OS"
+keyword = "pop"
+strategy = "popos_api"
+api_url = "https://api.pop-os.org/builds"
+variant = "generic"
+release = "24.04"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.Tails]
+clean_name = "Tails"
+keyword = "tails"
+strategy = "tails_api"
+api_url = "https://tails.net/install/v2/Tails/amd64/stable/latest.json"
+file_type = "img"
+checksum_format = "sha256sums"
+checksum_algo = "sha256"
+
+[distros.Pond]
+clean_name = "Pond"
+keyword = "pond"
+strategy = "content_disposition"
+base_url = "https://releases.butterfly.so/iso/"
+iso_regex = '^pond-installer-([0-9]+\.[0-9]+\.[0-9]+)-x86_64\.iso$'