What is Scutarius?
Scutarius is a way for an organisation to give its people its own GNU/Linux distribution: its own release channels, package archive, signing keys, installer and branding, all carrying that organisation's name. It is built on Devuan and runs sysvinit, with no systemd anywhere in it. Its archive carries essentially the whole Devuan package set alongside the organisation's own packages, so a machine running Scutarius is a general-purpose system its users can work on, not a fixed appliance image.
This page hosts the Scutarius version deployed by Harmacolindor.
Install
Installer media. Write one to a USB stick with dd, boot it, and the
installer pulls everything else from this archive:
Secure Boot (ISO images): these images boot only with Secure Boot disabled, or after you add this organisation's signing key to your firmware's Secure Boot settings. The kernel is signed with our own key, which the Microsoft-signed shim that most firmware trusts does not accept.
adam
The machine it produces tracks Harmacolindor's release from first boot, with the archive and its signing key already in place and nothing further to configure.
Network boot (PXE)
The same installer boots over the network. Copy the netboot tree of the current version into your TFTP server's root, and give the machine this DHCP boot file:
amd64UEFI:debian-installer/amd64/bootnetx64.efi; legacy BIOS:debian-installer/amd64/pxelinux.0arm64UEFI:debian-installer/arm64/bootnetaa64.efi; for firmware that trusts only this organisation's key (as on the ROCK 5B):debian-installer/arm64/org/bootnetaa64.efi
The menu offers the same entries as the ISO; the Secure Boot note above applies to network boot as well.
Use the archive from an installed system
An installed machine already has this. To add an existing machine by hand it is one source line -- the merged view: Harmacolindor's packages first, then Devuan excalibur and its security updates, minus banned packages, frozen at the last merge and signed by Harmacolindor's archive key.
deb http://scutarius.harmacolindor.com/scutarius adam main contrib non-free-firmware non-free deb-src http://scutarius.harmacolindor.com/scutarius adam main contrib non-free-firmware non-free
Keyring: scutarius-archive-keyring.asc
(ASCII-armored; install as /etc/apt/trusted.gpg.d/scutarius-harmacolindor-archive.gpg with
gpg --dearmor, or install the package scutarius-apt-config, which ships
it). Packages from Devuan and Debian are fetched via redirect from their
mirrors and verified against this index.
The role names stable, testing and unstable, and their -proposed
candidate lanes, also work in place of the codename above. A role is an alias
that moves to a new codename on release day; a codename, once published, never
changes meaning. Pin the codename for a line that must never move under you;
use the role for a line that should always track whichever release currently
holds it.
| suite | who uses it | index |
|---|---|---|
adam | stable release | dists/adam/ |
adam-proposed | stable candidates -- every upload lands here first | dists/adam-proposed/ |
abel | testing release | dists/abel/ |
abel-proposed | testing candidates -- every upload lands here first | dists/abel-proposed/ |
cain | unstable release | dists/cain/ |
Archive state
| current merged view | 20260926T164921Z (merged 2026-09-26 16:49 UTC) |
|---|---|
| all published views | 20260926T164921Z 20260921T000757Z |
| raw archive | /scutarius-archive/ -- only the packages Harmacolindor builds (reprepro), signed by the same key |
| architecture | packages | built here | borrowed from freia | installer udebs |
|---|---|---|---|---|
amd64 | 68896 | 279 | 22 | 803 |
arm64 | 68267 | 300 | 21 | 847 |
"Borrowed from freia" is a deliberate, name-listed slice of the newer Devuan
suite -- currently the gcc-15 toolchain, which the kernel is built with and
which linux-headers-* therefore depends on. Every borrowed package carries a
recorded reason, and a merge fails if the slice grows without one.
How it fits together
Source packages are built with sbuild on a native build host per
architecture, signed by the build key, and uploaded into the release's
-proposed candidate lane, from which they are promoted. Only one host holds
a key: builders build, they do not sign, and the Secure Boot signature is
applied where the key lives even when the package was assembled elsewhere.
A merge produces a stamped, signed snapshot of the whole world these machines
may see. Before anything is stamped, a dependency-closure gate checks that
every package published here can actually have its dependencies met inside
this view, and that the borrowed slice has not grown; an unmet dependency
stops the merge rather than reaching a machine. Publishing flips current,
and rollback is flipping it back. Nothing installs software onto a machine
except apt against this view.