TAGMEDIA(1)

📦 version 6.6, in opensuse-leap 16.0

💖 tagmedia(1) — the manual, but make it bestie 💖

okay so welcome to the tagmedia(1) page, bestie. grab a lil strawberry drink 🍓 and let's get into it, because this tool is lowkey iconic for anyone messing with installation or Live media.

🌸 NAME 🌸

tagmedia — add/remove tags to installation or Live media. that's the whole name, periodt.

✨ SYNOPSIS ✨

tagmedia [OPTIONS] IMAGE

💅 DESCRIPTION 💅

okay so picture this: Installation/Live media carry some meta data stored in a reserved area in the ISO9660 file system. very main character energy, honestly.

tagmedia can display and modify these data. yes bestie, display and modify. we love a multitasking icon.

The data are in text form, structured as key=value pairs. Most notably they include a digest (checksum) over the entire medium that can be used for verification with checkmedia(1). so if you're like "is this ISO okay??" this is the whole vibe check.

The meta data block can optionally be signed to verify its authenticity. security slay 🔥

IMAGE is an installation or Live medium; either ISO image or disk image. that's your target, your moment, your chosen file.

Meta data come in two flavors: SUSE (SLE, openSUSE) style and Red Hat (RHEL, Fedora, CentOS, AlmaLinux, Rocky, ...) style. Both variants are supported. no favoritism here, we support both fr fr.

For a detailed technical view, see file:///usr/share/doc/packages/libmediacheck6/README.html

If a digest was added, the media can be verified with checkmedia(1) (both Red Hat and SUSE style) or checkisomd5(1) (Red Hat style only). okay so that's the whole "go verify it" pipeline, iykyk.

💖 General options 💖

  • --style STYLE — Data format. STYLE can be either 'rh' or 'suse' (default: auto-detected). it literally sniffs the vibe for you unless you tell it otherwise.
  • --version — Show tagmedia version. short, sweet, gives you the numbers.
  • -v, --verbose — Show more detailed info (repeat for more). yes you can stack it, go off.
  • --help — Write this help text. the classic "pls explain" button.
  • --show — Show current tags (default if no option is given). like opening the group chat and reading receipts.
  • --add-tag FOO=BAR — Add tag FOO with value BAR. new tag just dropped.
  • --remove-tag FOO — Remove tag FOO. not me deleting the tag… block vibes only.
  • --clean — Remove all tags. full reset, clean slate, no notes.
  • --export-tags FILE — Export raw tag data to FILE. save the receipts for later, bestie.
  • --digest DIGEST — Add digest DIGEST (suse style: md5, sha1, sha224, sha256, sha384, sha512; rh style: md5). yes the SUSE girlies get more hash options, that's just the tea.
  • --fragments N — Split image into N fragments with individual digests (suse style default: 0, rh style default: 20). lil checksum pieces so you can find the problem area faster.
  • --pad N — Ignore N 2 kiB blocks of padding at image end (suse style). bye bye padding, not counted.
  • --skip N — Ignore N 2 kiB blocks at image end (rh style, default: 15). same energy, different style.
  • --check — Tell installer to run media check at startup (suse style). the installer gets a lil heads-up.
  • --supported — Set supported flag (rh style). officially supported, periodt.
  • --signature-tag — When adding a digest, check for a signature block and add a 'signature' tag if one is found (default for style suse). signature spotted? tag it.
  • --no-signature-tag — When adding a digest, do not check for a signature block (default for style rh). no scan, no tag, we move.
  • --create-signature KEYID — Sign meta data in IMAGE with gpg key KEYID. The public part of KEYID is exported to the file IMAGE.key. crypto moment, very secure of you.
  • --import-signature FILE — Import signature from FILE. bring the signature in.
  • --export-signature FILE — Export signature to FILE. send it out into the world.

💀 Legacy options 💀

  • --md5, --md5sum — Equivalent to --digest md5. old school but still valid, no cap.

🔥 DIGEST NOTES 🔥

The digest is calculated over the entire image, leaving out the meta data block and, if one exists, the signature block (unless --no-signature-tag is used). Padding blocks are also not taken into account. so it's not "everything everything" — it's the specific everything, bestie.

For SUSE style media a separate digest over the last partition is also added, if a partition table exists. If this happens to be an EFI System Partition, the last but one partition is used. yes, the last-but-one, read it again if you need to.

For Red Hat style media, the media is additionally split into parts (fragments) with separate checksums for each part to help localize where any mismatch occurs. so when something's off you can point at the fragment like "it's giving error right here".

For a description of how exactly the digests are calculated, see the detailed doc link below. no gatekeeping, the docs are right there.

🔐 SIGNING NOTES 🔐

You can add a signature of the meta data block. It can then be used to ensure the authenticity of the meta data, notably the stored digest. like a lil "trust me bestie" but cryptographically.

The signature is stored in a special 2 kiB block. The block can be anywhere in the image, usually as part of the file system. The block is identified by a magic id (see detailed doc link below). magic id?? iconic.

Note that usually this block has to be included during image creation. It does not have to be visible in the file system. so it can be sneaky like that.

tagmedia scans the image for a block with this magic id when calculating a digest and stores a reference to it in the 'signature' tag if one is found. found it? tagged it.

As an exception, if no such block had been identified, tagmedia will try to create one in the padding area, if a padding area exists. a lil backup plan, we love resourcefulness.

There are two options --signature-tag and --no-signature-tag that can be used to tell tagmedia explicitly whether to scan for a signature block or not. explicit instructions only, no guessing.

If you do not want tagmedia to run gpg directly, it is also possible to create the signature independently of tagmedia using --export-tags to store the raw meta data in a file, then sign it and import the signature using the --import-signature option. DIY crypto era, honestly kind of slay.

🌈 OPEN BUILD SERVICE 🌈

If a signature block is present the OBS will automatically sign images with the project key. automatic signing, we love to see it.

You can get the public part of the project key needed for verification with osc signkey. go get that key, bestie.

⭐ EXAMPLES ⭐

# display current meta data
tagmedia foo.iso

# create digest
tagmedia --digest sha256 foo.iso

# create digest, adding a rh-style fragment digest for early error detection
tagmedia --digest sha256 --fragments 20 foo.iso

# create signature, using gpg key id foo-key
tagmedia --create-signature foo-key foo.iso

👑 SEE ALSO 👑

checkisomd5(1), checkmedia(1), gpg(1), implantisomd5(1), osc(1).

this whole page is tagmedia 6.5, dated 2025-05-13 — mwah 💋 go tag some media, bestie.

📦 where this page comes from