IncusOS Scripts Context

Incus version differences

Debian stable ships Incus 6.0 LTS (behind upstream). Zabbly repo (https://github.com/zabbly/incus) provides latest on Debian/Ubuntu.
macOS (Homebrew) and Arch Linux track latest upstream (currently 6.21). macOS is client-only; Arch has no client-only split package.
incus remote get-client-certificate added in 6.3+ -- does not exist in 6.0 LTS. Scripts must never depend on it as the only cert path.
Always prefer reading ~/.config/incus/client.crt from disk first.
See notes/incus-version-compatibility.md for full matrix.

Install: go install github.com/lxc/incus-os/incus-osd/cmd/flasher-tool@latest
Flags: -f/--format, -s/--seed, -c/--channel, -i/--image, -v/--version
There is NO --seed-tar flag -- it's --seed (or -s).
There is NO --arch flag -- architecture from downloaded image.
CDN index: https://images.linuxcontainers.org/os/index.json
CDN images: https://images.linuxcontainers.org/os/{version}/{arch}/IncusOS_{version}.{format}.gz

Tar archives with YAML files at root level.
Written to byte offset 2148532224 (seed partition) in the image.
External boot media labeled SEED_DATA as CD-ROM:
- ISO 9660 (genisoimage -V SEED_DATA -J -r): preferred for CD-ROM.
- FAT image: works for USB but NOT CD-ROM (kernel sr_mod doesn't expose FAT labels).
Key files: install.yaml, applications.yaml, incus.yaml, operations-center.yaml, network.yaml, update.yaml.

Stored at ~/.config/incus/client.crt and ~/.config/incus/client.key.
incus remote list triggers auto-generation if no keypair exists.
Incus seed: preseed.certificates[] (NOT preseed.server.certificates[]). InitPreseed.Server uses yaml:",inline" so fields are promoted to top level.
OC seed: trusted_client_certificates[].
OC requires at least one trusted cert or you're locked out.