XFESystem

{
  "architecture": "x86_64",
  "status": "PASS",
  "checks": [
    "UEFI, isolated user shell and first-boot authentication",
    "DHCP lease",
    "read-only offline application transport and import",
    "file CRUD, pipes and redirection",
    "out-of-memory rollback, zero-filled recovery and fresh process creation",
    "ELF execution, invalid pointers and process fault isolation",
    "timer preemption, background jobs and foreground-only Ctrl-C",
    "DNS, HTTP streaming/framing, redirects and partial download preservation",
    "DNS packet-loss retry, redirect limit and stalled-body timeout",
    "text browser and relative links",
    "real guest TLS chain/intermediate and hostname/CA/expiry rejection",
    "application import and architecture validation",
    "clean shutdown and block FLUSH",
    "disk and accounts survive a full reboot",
    "logout/login supervisor and UID/file/power permissions",
    "guest HTTPS refuses unavailable trusted time",
    "guest HTTPS refuses absent secure random device",
    "TCP retransmission under delayed packets (4 repeated SYNs captured)",
    "dirty media read-only, corrupt media rejected, no disk modification",
    "real guest disk/inode exhaustion preserves files and recovers after removal",
    "corrupt accounts refuse login without default credentials"
  ],
  "version": "0.2.0-dev.4",
  "validation_phase": "Before the final requested default-blue, scroll performance and pointer theme changes; build identities below preserve the exact validated source.",
  "evidence_directory": "build/acceptance/x86_64-1791931863002125200",
  "build_info": {
    "schema": 1,
    "version": "0.2.0-dev.4",
    "architecture": "x86_64",
    "system_sha256": "8df4801d94079e6cc4e5f27c9e6ca5cdb00767d1502cc7af3a1df990b7a38998",
    "kernel_sha256": "27880c9bdb0ec9a12105adbf740eaa5e47d5bbde8752ba2aee7642507ed735f7",
    "rootfs_sha256": "87f2d1e93f0f46031d1ab5eff3e00e0147ccb642819823f75401c00de9996c9c",
    "bootshim_sha256": "a25ba5b73d992f392ff7486f9feafbc3bcf80e1649abb8d826ffa5e6aa4b8428"
  },
  "build_info_sha256": "2df38a4c551e65586f17a42bbf03ba1f5ce5974d39860c5c8b9669046356942f",
  "kernel_sha256": "27880c9bdb0ec9a12105adbf740eaa5e47d5bbde8752ba2aee7642507ed735f7",
  "production_system_sha256": "8df4801d94079e6cc4e5f27c9e6ca5cdb00767d1502cc7af3a1df990b7a38998",
  "production_rootfs_sha256": "87f2d1e93f0f46031d1ab5eff3e00e0147ccb642819823f75401c00de9996c9c",
  "bootshim_sha256": "a25ba5b73d992f392ff7486f9feafbc3bcf80e1649abb8d826ffa5e6aa4b8428",
  "test_system_image_sha256": "da55ded15d3eea8c188e3b99beeaf319b1928b58b032b437cd98fd53d269ab5d",
  "test_rootfs_sha256": "0d3e38eda83b4d2e87bb19a5487aa725eda1c209786a9c6d1e33b420bc779abe",
  "embedded_files_verified_from_fat": {
    "boot/xfe-kernel": {
      "sha256": "27880c9bdb0ec9a12105adbf740eaa5e47d5bbde8752ba2aee7642507ed735f7",
      "bytes": 12331480,
      "matches_current_build_info": true
    },
    "boot/rootfs.cpio": {
      "sha256": "0d3e38eda83b4d2e87bb19a5487aa725eda1c209786a9c6d1e33b420bc779abe",
      "bytes": 720032,
      "matches_current_build_info": false
    },
    "EFI/BOOT/BOOTX64.EFI": {
      "sha256": "a25ba5b73d992f392ff7486f9feafbc3bcf80e1649abb8d826ffa5e6aa4b8428",
      "bytes": 18944,
      "matches_current_build_info": true
    }
  },
  "rootfs_comparison": {
    "format": "CPIO newc (070701)",
    "path_count": 18,
    "changed_payload_paths": [
      "usr/share/xfesystem/cert.pem"
    ],
    "added_paths": [],
    "removed_paths": [],
    "all_modes_uid_gid_identical": true,
    "unchanged_payload_and_mode_entries": 17,
    "only_fixture_ca_appended_to_cert_pem": true,
    "fixture_ca_sha256": "e0bc09d1a9f904faf6d72a4ab45025fa191a8e4d4261528cf390061082d368e9"
  },
  "rootfs_comparison_evidence": "build/acceptance/x86_64-1791931863002125200/rootfs-verification.json",
  "source_hash_verification": "Actual test GPT/FAT32 kernel and EFI shim match current final architecture build-info.json. The test newc rootfs has exactly the production path set and identical modes/UIDs/GIDs; all payloads are identical except cert.pem, which is the production bundle plus only the fixture CA. No certificate or private key material is copied into this receipt.",
  "physical_hardware_tested": false
}