XFESystem

{
  "architecture": "aarch64",
  "status": "PASS",
  "checks": [
    "UEFI, isolated user shell and first-boot authentication",
    "DHCP lease",
    "read-only offline application transport and import",
    "file CRUD, pipes and redirection",
    "out-of-memory rollback, zero-filled recovery and fresh process creation",
    "ELF execution, invalid pointers and process fault isolation",
    "timer preemption, background jobs and foreground-only Ctrl-C",
    "DNS, HTTP streaming/framing, redirects and partial download preservation",
    "DNS packet-loss retry, redirect limit and stalled-body timeout",
    "text browser and relative links",
    "real guest TLS chain/intermediate and hostname/CA/expiry rejection",
    "application import and architecture validation",
    "clean shutdown and block FLUSH",
    "disk and accounts survive a full reboot",
    "logout/login supervisor and UID/file/power permissions",
    "guest HTTPS refuses unavailable trusted time",
    "guest HTTPS refuses absent secure random device",
    "TCP retransmission under delayed packets (4 repeated SYNs captured)",
    "dirty media read-only, corrupt media rejected, no disk modification",
    "real guest disk/inode exhaustion preserves files and recovers after removal",
    "corrupt accounts refuse login without default credentials"
  ],
  "version": "0.2.0-dev.4",
  "validation_phase": "Before the final requested default-blue, scroll performance and pointer theme changes; build identities below preserve the exact validated source.",
  "evidence_directory": "build/acceptance/aarch64-1791932416540014800",
  "build_info": {
    "schema": 1,
    "version": "0.2.0-dev.4",
    "architecture": "aarch64",
    "system_sha256": "0352c87f59a3a87116a87ed7d33fd4f09485e35cee9e3192de5e769f6cfc9f54",
    "kernel_sha256": "cd432abd7dcdeaf7790fd321a4a8d6ce59f50ec291c87b72db77297a5b20e881",
    "rootfs_sha256": "dc9616bc1eb9da64f6258d6a4ce9a810ead605f55432aaad8f42124cc4fb6242",
    "bootshim_sha256": "e3d2159f04ab576fc851fb54b13209c4324533baa98faa5336053bfdf8d28393"
  },
  "build_info_sha256": "c28aa5e67d64a90d59dd9b619b3ee94bdb2e5ca655ba8dcbfbd1198d4e2db26e",
  "kernel_sha256": "cd432abd7dcdeaf7790fd321a4a8d6ce59f50ec291c87b72db77297a5b20e881",
  "production_system_sha256": "0352c87f59a3a87116a87ed7d33fd4f09485e35cee9e3192de5e769f6cfc9f54",
  "production_rootfs_sha256": "dc9616bc1eb9da64f6258d6a4ce9a810ead605f55432aaad8f42124cc4fb6242",
  "bootshim_sha256": "e3d2159f04ab576fc851fb54b13209c4324533baa98faa5336053bfdf8d28393",
  "test_system_image_sha256": "b6b470330894de59d3ba4f07111935d82c5769cc70ca81a5d50fbd1213b43ef9",
  "test_rootfs_sha256": "3d4852e54bbbb1e99f96d3b50de53a8400418bb89233665bd0b847120e614bcb",
  "embedded_files_verified_from_fat": {
    "boot/xfe-kernel": {
      "sha256": "cd432abd7dcdeaf7790fd321a4a8d6ce59f50ec291c87b72db77297a5b20e881",
      "bytes": 12767192,
      "matches_current_build_info": true
    },
    "boot/rootfs.cpio": {
      "sha256": "3d4852e54bbbb1e99f96d3b50de53a8400418bb89233665bd0b847120e614bcb",
      "bytes": 1185320,
      "matches_current_build_info": false
    },
    "EFI/BOOT/BOOTAA64.EFI": {
      "sha256": "e3d2159f04ab576fc851fb54b13209c4324533baa98faa5336053bfdf8d28393",
      "bytes": 17920,
      "matches_current_build_info": true
    }
  },
  "rootfs_comparison": {
    "format": "CPIO newc (070701)",
    "path_count": 18,
    "changed_payload_paths": [
      "usr/share/xfesystem/cert.pem"
    ],
    "added_paths": [],
    "removed_paths": [],
    "all_modes_uid_gid_identical": true,
    "unchanged_payload_and_mode_entries": 17,
    "only_fixture_ca_appended_to_cert_pem": true,
    "fixture_ca_sha256": "1e54cd435efa7fd589fe33d3050e67499e1adb995b5eb1bc4e7e5f793a096525"
  },
  "rootfs_comparison_evidence": "build/acceptance/aarch64-1791932416540014800/rootfs-verification.json",
  "source_hash_verification": "Actual test GPT/FAT32 kernel and EFI shim match current final architecture build-info.json. The test newc rootfs has exactly the production path set and identical modes/UIDs/GIDs; all payloads are identical except cert.pem, which is the production bundle plus only the fixture CA. No certificate or private key material is copied into this receipt.",
  "physical_hardware_tested": false
}