Your guide to Debian iso downloads

Current release only: https://cdimage.debian.org/debian-cd/
All downloads: https://cdimage.debian.org/cdimage/
In particular you can find there the current release (same as above), older releases and point releases, firmware packages.

Let’s explore the current release location. There you can see a few subdirs. The ones of interest are current (installer) and current-live (installer + live system).

Live iso

Lets start with current-live, it is what most people want. Going into the dir you’ll see there is only one arch to chose from, amd64. Descend there.

Now you have a choice: either download from torrents (bt-hybrid subdir) or directly (iso-hybrid subdir). Torrents is the better choice, this way you do not contribute to bandwidth usage on Debian’s servers. In case you can’t download from torrents, consider using regional mirrors. The mirrors host the same directory structure as outlined above.

Back to the iso images. There are multiple live images which bundle different desktop environments, one per iso. To say, debian-live-12.5.0-amd64-gnome.iso evidently comes with the GNOME desktop, debian-live-12.5.0-amd64-kde.iso has KDE Plasma and so on. An exception is debian-live-12.5.0-amd64-standard.iso which is text only. So if you pick the GNOME one, you get a live GNOME environment and installer for Debian with GNOME, 2 in 1. The installer does not require a network connection.

There is an alternative installer (not a live system) with all desktops included yet of nearly the same size as those live images. Using it, at some point there will be a dialog to pick which desktop you’d like. This one does not require a network connection as well.

Installer iso

Now we descend into the current subdir. There you can see a lot of archs to choose from. We’re only interested in the amd64 one though, go there.

Here it becomes tricky: there are lots of subdirs with cryptic names. No fear, it is neat and simple.

Prefix meaning:

bt-	torrent files for iso images
iso-	iso images
jigdo-	template files to reconstruct iso images with `jidgo` tool
list-	list of debs available in corresponding images

Suffix means size of images based on media capacity:

-bd	Blu-ray
-cd	CD
-dvd	DVD
-dlbd	double layer Blu-ray
-16G	16G USB stick

Points of interest:

iso-cd

This is where the debian-12.5.0-amd64-netinst.iso netinstaller resides. The default download link on debian.org points to it. The “net” in the name does not mean it requires network to do its job. But since it is small (CD size), without network it can only install the base system. Otherwise there is a dialog to pick a desktop environment to download and install.

iso-dvd

Here you can see debian-12.5.0-amd64-DVD-1.iso. It is like the netinstaller, but with all desktops bundled. Using this image you can install Debian with GNOME, KDE etc on an offline machine.

You can notice this image is marked DVD-1. Overall there are 21 DVD images for the current 12.5.0 release. You can create the rest with jigdo (explained below).

iso-bd, iso-dlbd, iso-16G

These either don’t contain generic images or don’t exist. If you need it, you’d have to create the images with jigdo (explained below).

jigdo-X

Here you can see some files with .jigdo (gzipped text) and .template extensions. With that you can reconstruct all iso images not readily available to download.

The reason behind providing only a few iso images as-is and the rest as jigdo is most people only need an installer, not the complete set of packages. This way Debian mirrors don’t waste disk space on stuff very rarely used yet still provide an option to get those extra images.

The first image in a set contains the installer and some debs. The rest only provide debs. The images can be used as local repositories to reduce network usage or use Debian on an offline system.

Complete sets of DVD, BD and DLBD iso images contain the same set of debs, namely all Debian packages. The single 16G image is severely cut down compared to other variants.

Previously there were also sets of CD images. For example in Debian 8.11.0 it comprised of 82 iso images.

jigdo-dvd additionally provides cumulative update images for point releases. For example, using just three debian-update-12.5.0-amd64-DVD-X.iso images one can upgrade an offline machine to 12.5.0 from any state down to stock 12.0.0.

Here is how you can build an iso image with jigdo:

have jigdo-file package installed
run jigdo-lite with url to some of the .jigdo files
when asked for a Debian mirror to use, make it http://ftp.debian.org/debian/ (for out-of-support releases it should be http://archive.debian.org/debian/)

So for example to create the first five DVD images you’d run:

base=https://cdimage.debian.org/cdimage/release/12.5.0/amd64
for disk in {1..5}; do
    jigdo-lite "$base"/jigdo-dvd/debian-12.5.0-amd64-DVD-"$disk".jigdo || break
done

Another thing with jigdo is it can calculate changes between two images and create one from another only downloading the changed files. This way you can upgrade iso images between point releases using much less traffic.

Say you have downloaded debian-12.0.0-amd64-DVD-1.iso previously and want to upgrade it to 12.1.0. First, mount the existing iso somewhere. Next, run jigdo-lite with the url of debian-12.1.0-amd64-DVD-1.jigdo and when it asks if you had some older revision of the iso, feed it the mount location. Alternatively, you can use --noask and provide the mount path with the --scan option to make it non-interactive.

Notice on 404 errors in jigdo

Generic Debian mirrors do not keep obsolete packages. For example, the current version of openssh-client in Debian 10 is 7.9p1-10+deb10u2. Let’s compare that to the versions listed in jigdo files of the first DVD for 10.0.0 and 10.2.0:

source	openssh-client version
debian-10.0.0-amd64-DVD-1.jigdo	7.9p1-10
debian-10.2.0-amd64-DVD-1.jigdo	7.9p1-10+deb10u1
current	7.9p1-10+deb10u2

In the following we will use such bash function:

list_ssh_client () {
    wget -qO- "$1"/pool/main/o/openssh/ |
        grep -oP '(?<=>)openssh-client_7.9p1-10.*amd64.deb'
}

If you look into a generic mirror, you’ll only see 7.9p1-10+deb10u2 there out of the 7.9 branch:

> list_ssh_client http://ftp.debian.org/debian
openssh-client_7.9p1-10+deb10u2_amd64.deb

The trick is there are other, non-generic, mirrors mentioned in jigdo files. For example, debian-10.0.0-amd64-DVD-1.jigdo:

> zcat debian-10.0.0-amd64-DVD-1.jigdo | tail
..

[Servers]
Debian=http://us.cdimage.debian.org/cdimage/snapshot/Debian/
Debian=http://snapshot.debian.org/archive/debian/20190707T102257Z/ --try-last

The first url is a keep-everything mirror:

> list_ssh_client http://us.cdimage.debian.org/cdimage/snapshot/Debian
openssh-client_7.9p1-10+deb10u1_amd64.deb
openssh-client_7.9p1-10+deb10u2_amd64.deb
openssh-client_7.9p1-10_amd64.deb

The second url is a generic mirror snapshot dated Jul 7, 2019, the date of 10.0.0 release:

> list_ssh_client http://snapshot.debian.org/archive/debian/20190707T102257Z
openssh-client_7.9p1-10_amd64.deb

The tool compiles a list of mirrors: the one provided by you and those, listed in the Servers section. Next, it tries to fetch the files from the first mirror in the list. This is the phase when you can see a lot of 404 errors. When done with the first mirror but there are still files to get, it moves to the second mirror in the list. And so on until all files are retrieved.

To make it fast and minimize the non-generic mirrors usage, when jigdo asks you for the mirror to use, give it http://ftp.debian.org/debian/ for supported releases and http://archive.debian.org/debian/ for out-of-support ones.

Mini installer iso

There is also an extremely small installer which requires network to do its job. The image is named in versionless manner, just mini.iso.

The installer is available with text interface and GUI.

Iso validation example

Debian 12 images are signed with key 6294BE9B. You can fetch it with such command:

gpg --recv-key --keyserver keyring.debian.org 6294BE9B

With the key acquired and netinstaller downloaded, lets validate it. Go to the netinstaller’s home and fetch SHA256SUMS and SHA256SUMS.sign from there. Put all three files into the same dir. Next, in that dir we first check the signature:

gpg --verify SHA256SUMS.sign SHA256SUMS

Good response:

gpg: Signature made Sat 10 Feb 2024 20:13:13 UTC
gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Good signature from "Debian CD signing key <debian-cd@lists.debian.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B

Notice is says “Good signature” and the key used was 6294BE9B.

Now check the iso:

sha256sum -c --ignore-missing SHA256SUMS