The Server edition, built from the open tree and published with its digest. Nothing here phones home, and every artifact can be checked against the checksum beside it before it is ever booted.
The image installs Ubuntu, then installs Furcate from packages carried on the same medium and enables the node. There is no answer server and no network fetch during the install, because an installer that reaches for the internet to become itself is an installer that fails in the places this is meant to work.
Two questions are asked and not assumed: which disk to use, and who the first account belongs to. A disk is destroyed and an identity is created — answering those silently is how an installer loses trust.
This is the open distribution, so it carries the open system and nothing else. The network is installed but not joined: joining is an action, and an image that performed it on first boot would perform it without being asked. furcate setup turns it on.
A sysext is a filesystem image that merges into /usr at runtime. The base system is not modified, the extension is added and removed atomically, and on a host with a read-only root it is the only way to add software at all.
Every artifact is published with its digest. Download the checksum file and let sha256sum do the comparison, rather than reading two hex strings and deciding they look alike.
SHA256SUMS covers every artifact on this page.
The signed extension is a dm-verity image: the filesystem has a hash tree, and the root of that tree is signed. Changing one byte of the image changes the root hash, and the signature stops matching. The signing key is held in a TPM and is not exportable, so it cannot be taken from the machine that holds it — including by anyone who reaches that machine.
A machine merges a signed extension only if it already trusts the certificate. Install the certificate below, and systemd-sysext will verify the image before merging it rather than taking it on trust.
Installing a certificate into /etc/verity.d means that machine will merge any extension this key signs. That is the point of it, and it is also the risk: it is a standing decision, not a one-off. A machine that already trusts a different signing certificate will refuse this image, which is the system working correctly rather than a fault.
Write the ISO to a USB drive, or attach it as virtual media through the machine's management controller.
The installer answers itself from the medium, and stops only for the disk and the first account.
sudo furcate setup configures identity, site and keys, and asks whether to join a network. Everything derivable is looked up rather than typed.
The system extension is published in a signed form: a dm-verity image whose root hash is signed by a key held in a TPM, so the key cannot be copied off the machine that holds it. The installer ISO is not signed — verify it by its digest, over the same TLS connection that served this page.