Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Verify It Yourself

The InterGenOS promise is not “trust us.” It is “check us.” Security you cannot verify is a marketing claim; security you can verify is a property of your machine. Every guarantee this wiki makes is meant to be checkable — by you, on your own hardware, with a command whose output you can read.

This section gathers those checks in one place. Each page pairs a claim with the exact command that proves it and the output a healthy system shows, so you never have to take our word for anything.

In this section

  • First Checks After Install — the five-minute, run-it-in-order ritual for a fresh install: ten checks, each with the exact command, the output a healthy system shows, and what it means if yours differs. Start here.
  • Security Verification — the per-claim reference: Secure Boot, the signed boot chain, dm-verity root integrity, per-file package verification, signed-mirror trust, and kernel lockdown — each with the command that proves it.

These checks lean on two reference pages that are evidence in their own right:

  • Reproducibility & Verification — rebuild from source and confirm the result matches the published artifact, byte for byte. The strongest possible answer to “is the binary really built from this source?”
  • Package & Config Reference — the complete, generated inventory of what the system is made of: every package, tier, and the configuration behind it.

The published SBOM

InterGenOS publishes a Software Bill of Materials for the Secure Boot shim — the trust anchor the whole boot chain is verified through. It is a deterministic SPDX 2.3 JSON document, carried in the source tree under docs/sboms/ and generated by scripts/shim-sbom-gen.py, recording every input that goes into shimx64.efi: the pinned upstream source commit, the digest-pinned build image and package snapshot, the embedded InterGenOS Secure Boot CA certificate, the SBAT vendor entry, and the shim binary’s own SHA-256 and size. Because generation is deterministic, you can regenerate it from the same checkout and diff it against the published copy — the SBOM is itself a verifiable artifact, not an attestation you take on faith. Full detail: Reproducibility & Verification.

Today the published SBOM covers the shim; it is scoped deliberately to the boot chain’s trust anchor. Broader per-image SBOM coverage follows the same rule as every claim on this page: it gets listed here when it exists and verifies, not before.

If a check on your machine does not show what these pages describe, that is a real signal — see Troubleshooting, and tell us.