Verify the boot seed

When you burn a Flagship installer from the mobile app, it writes a Debian seed image we derive from the official Debian netinst — then appends your recipe as a small partition. The seed carries no personal data and is reproducible: you can rebuild it from the public Debian ISO and confirm, byte for byte, that it is exactly stock Debian plus a published, auditable change. Nothing to trust on our word.

Why a seed at all? A phone can't rewrite an 800 MB ISO in place. So we make the one structural edit — telling the installer to auto-configure from a labeled partition — once, centrally and reproducibly, and the app only writes your recipe onto that partition. Your recipe never leaves your device; the seed is the same for everyone.

What the seed changes vs. stock Debian

The default boot entry (BIOS and UEFI) auto-starts the installer with auto=true priority=critical preseed/file=/cdrom/flagship/preseed.cfg.
A generic, recipe-free preseed.cfg is added at /flagship/preseed.cfg; at install time it loads your recipe from the partition the app appends (labeled FLAGSHIP).
Nothing else. The El Torito / isohybrid boot equipment is replayed byte-for-byte, so it still boots on BIOS and UEFI.

The pinned hashes

Artifact	SHA-256
Stock base — Debian 13.6.0 amd64 netinst official Debian signed `SHA256SUMS`	`see debian.org/…/SHA256SUMS`
Flagship seed (derived from the above)	`892cf430928897afa5327a38c107271ed8ced064b5091680509ab6da256295e4`

The seed hash is re-pinned together with the stock base on each Debian point release.

Reproduce it yourself

The derivation is a single script — iso-seed/build-seed.sh — using only xorriso. Given the same stock base, it produces the exact seed hash above with the xorriso shipped in Debian 12 or 13 (newer releases lay the image out differently, so run it in a Debian container), and our CI rebuilds it under both on every change:

# 1. Download the exact stock base (url + sha are in the app's ISO manifest,
#    and pinned to Debian's official signed SHA256SUMS).
# 2. Re-derive the seed:
git clone https://github.com/ibisllc/flagship
flagship/iso-seed/build-seed.sh debian-13.6.0-amd64-netinst.iso my-seed.iso

# 3. Confirm it matches the published hash:
sha256sum my-seed.iso
# 892cf430928897afa5327a38c107271ed8ced064b5091680509ab6da256295e4

How your recipe is applied — and why it can't be swapped

The seed is generic, so it can't target any particular box. Your recipe — a Debian preseed carrying your phone's signed install blob — is written onto the appended partition. The installed system trusts your phone's signature and nothing else; flagshipserver.com is never in that trust path. The builder checks that the preseed it writes embeds your signature before it lays it down, so no server can substitute a different recipe.

The full spec

The complete design — the partition layout, the installer chain-load, the trust model, and the reproducibility guarantees — lives in the repository at docs/iso-seed-and-on-device-burn.md. Audit it, build it, verify it.