CustomOS3.1 OBSIDIAN
Integrity chain
From firmware to every block read from /usr. Sample values.
Boot chain
Secure Boot
shim → GRUB → kernel · installed, amd64
Signed UKI
Not enabled
opt-in · CUSTOMOS_UKI=1 · amd64 + UEFI
Live medium
dm-verity
squashfs root hash pinned in cmdline
/usr (installed)
not read in this demo
opt-in · EROFS lz4hc · rollback slot
AIDE
not read in this demo
baseline and daily check on a default install
auditd
immutable
-e 2 · identity + exec rules
ferran@customos:~$ sudo customos-verity-block status
Sample transcript of the command, not a reading of this machine.
✓ a tampered USB/ISO squashfs (boot panics, fail-closed)
✓ offline edits to /usr (I/O error on read)
✓ a trojan initrd (only with the signed UKI opt-in)
◑ the rest of the root fs is normal ext4 inside LUKS (§3.3)
◑ local root can still disable userspace controls (§3.8)
Two independent builds of the same commit produced a byte-identical ISO, with SOURCE_DATE_EPOCH and a snapshot.debian.org pin. Verify with scripts/repro-check.sh.