Security concern regarding prebuilt images

TheExplorer commented

2026-08-03 16:16:30 +00:00

Following up on our conversation here and because you answered this:

butterknife doesn't use the Debian installer at all. It extracts a prebuilt system image straight to disk

I'm now really concerned about my security and would like to know the origin of these images. I have a lot of private and NDA documents on my drives.

Should I worry?

Thank you in advance!

Following up on our conversation [here](https://justaguy.dev/drew/butterknife/issues/10#issuecomment-58) and because you answered this: > butterknife doesn't use the Debian installer at all. It extracts a prebuilt system image straight to disk I'm now really concerned about my security and would like to know **the origin of these images**. I have a lot of private and NDA documents on my drives. Should I worry? Thank you in advance!

drew commented

2026-08-03 17:51:50 +00:00

Owner

Fair question. The image isn't a binary from an unknown source. It's built with build-rootfs.sh (right here in this repo), which runs Debian's debootstrap and uses the official mirrors (deb.debian.org). Every package in it is a signed, official Debian package. The script just assembles them into a tarball so the install is fast and works offline. No 3rd party packages.

If you'd rather not trust a prebuilt tarball at all, you have two options:

Build the tarball yourself: sudo bash build-rootfs.sh on any Debian system, then rebuild the ISO.
Using the debootstrap install method in butterknife (with a network connection) fetches everything directly from Debian's mirrors on your machine, skipping the bundled image entirely.

FYI, any OS installer (including official Debian ISOs) runs with full disk access, so verify what you install and keep backups. But butterknife is not that special

Fair question. The image isn't a binary from an unknown source. It's built with build-rootfs.sh (right here in this repo), which runs Debian's debootstrap and uses the official mirrors (deb.debian.org). Every package in it is a signed, official Debian package. The script just assembles them into a tarball so the install is fast and works offline. No 3rd party packages. If you'd rather not trust a prebuilt tarball at all, you have two options: 1. Build the tarball yourself: sudo bash build-rootfs.sh on any Debian system, then rebuild the ISO. 2. Using the debootstrap install method in butterknife (with a network connection) fetches everything directly from Debian's mirrors on your machine, skipping the bundled image entirely. FYI, any OS installer (including official Debian ISOs) runs with full disk access, so verify what you install and keep backups. But butterknife is not that special

👍 1

TheExplorer commented

2026-08-03 18:02:21 +00:00

Author

@drew Awesome. Thank you very much. Closing then. Cheers!

TheExplorer closed this issue

2026-08-03 18:02:21 +00:00

Rows
Columns

Security concern regarding prebuilt images #11