Security Transparency

CPU Vulnerability Mitigations — Kernel 7.0 vs 5.15

Data below comes from two real systems: Alfred Linux 7.77 GA boot-tested in QEMU/KVM on April 6, 2026, and a production Ubuntu 22.04 server running kernel 5.15.0-173. Both systems use AMD/Intel hardware with the same vulnerability surface.

¹ VM test limitation: MDS and Speculative Store Bypass show "Vulnerable" because QEMU/KVM does not pass through CPU microcode. On real hardware with vendor microcode installed (via intel-microcode or amd64-microcode packages, both included in the ISO), these would show mitigated status. Ubuntu's "Not affected" entries reflect the specific CPU model of that production server, not a kernel advantage.

Kernel 7.0 exclusive mitigations

Three vulnerability classes have native mitigation code that was written for kernel 7.0:

• ITS — Indirect Target Selection attacks. Kernel 7.0 ships the upstream fix natively, while older kernels received backports.
• TSA — Transient Scheduler Attacks against CPU scheduling units. New vulnerability class; mitigation only exists in 7.0+.
• VMSCAPE — VM escape via VMCS manipulation. Restricts shadow VMCS access; new in 7.0+.

Out-of-Box Security Hardening — 32 Modules

What runs on first boot, before the user touches anything. Alfred Linux 7.77 GA ships 38 security modules across 4 hooks — including the Omahon Seal (6 runtime integrity modules) — more out-of-box hardening than any mainstream desktop Linux.

Security tools included: alfred-security-status (dashboard), alfred-scan (antivirus), alfred-usb-storage (USB toggle), alfred-aide-init (integrity baseline), alfred-network-status (network audit), alfred-encrypt-status (encryption check).

The Omahon Seal — Incorruptible Security

"In a moment, in the twinkling of an eye, at the last trump: for the trumpet shall sound, and the dead shall be raised incorruptible." — 1 Corinthians 15:52

Omahon is the name we gave to the security seal that guards Alfred Linux at its deepest level. The word carries spiritual weight — the breath of God, the force that raises what was dead and makes it incorruptible. In software terms, Omahon is a 6-module runtime security framework that ensures nothing on your system can be silently corrupted, tampered with, or stolen — from the moment the kernel loads until the moment you shut down.

Every other OS trusts that your files haven't changed. Omahon verifies it — continuously, silently, cryptographically. This isn't antivirus. This isn't a firewall. This is a living seal on the integrity of your entire machine.

Why "Omahon"? Because security shouldn't just be a checklist of CVE patches. The Omahon Seal represents a philosophy: that a system can be made incorruptible — not by hiding its design, but by making its integrity verifiable at every layer. The trumpet sounds, and what was dead is raised incorruptible. That's not just Scripture — it's architecture.

Tools shipped: omahon-seal (boot integrity check), omahon-watchman (start/stop real-time file monitor), omahon-vault-wipe (emergency vault purge), omahon-reveal (authorized secret reveal), alfred-shred (secure file deletion), alfred-attestation (build chain verification).

Persistent Gaps

Radical honesty. Even with 38 security modules, Ubuntu has advantages we can't match today.

Build Transparency

Every Alfred Linux ISO is built by a single script with numbered, auditable hooks. Nothing is hidden.

Build chain

scripts/build-unified.sh ga --uefi   ← one command
├── Hook 0100: branding + UFW + SSH    ← visual identity + base firewall
├── Hook 0150: hardware                ← drivers, firmware, microcode
├── Hook 0160: security (21 modules)   ← sysctl, AppArmor, auditd, ClamAV, AIDE, etc.
├── Hook 0165: network hardening       ← nftables, MAC random, SSH ciphers, anti-scan
├── Hook 0170: full-disk encryption    ← LUKS/cryptsetup, Calamares FDE
├── Hook 0200: browser                 ← Alfred Browser (privacy-first)
├── Hook 0300: ide                     ← Alfred IDE
├── Hook 0400: voice                   ← Kokoro TTS + wake/realtime stack (former “0900” lives here in canon)
├── Hook 0500: search                  ← Meilisearch
├── Hook 0600: installer               ← Calamares (graphical disk installer)
├── Hook 0700: welcome                 ← first-boot experience
├── Hook 0710: update                  ← OTA update framework
├── Hook 0175: omahon-seal             ← 🔏 THE OMAHON SEAL (6 modules: boot seal, watchman, vault, shell guard, secure erase, attestation)
├── Hook 0176: kingdom-covenant-shield ← license + succession / legal shell
├── Hook 0800: store                   ← Alfred Store
├── Hook 9999: boot-fix (chroot)       ← generic kernel names for bootloader
└── Hook 9999: boot-fix (binary)       ← ISOLINUX/GRUB references

Published checksums (v7.77 GA)

SHA-256 / SHA512 / BLAKE3: not published as GA until final live-build is frozen
File:    alfred-linux-7.77-ga-intel-amd64-20260426.iso (canonical basename — see /download when GA flag flips)
Status:  Final GA ISO not published on alfredlinux.com yet — see /download for current honesty policy.

When the GA image ships, verify with the exact filename and hashes published on /download and /release (same values, GPG key 32BCEDE8C8DD8B00).

The build script, the 42-hook canonical tree (Matthew 1:17 lineage; 2 Alfred hooks active in the bytes shipping right now, with the full 42 in the source tree awaiting reseal — including 3 dedicated security hooks + the Omahon Seal totalling 1,300+ lines), and the kernel config are inspectable. The ISO is built on a dedicated GoSiteMe build server (8 cores, 32 GB RAM) using Debian live-build toolchain on Debian Trixie. Linux 7.0.1 custom-built debs ship via build/config/packages.chroot/; Debian Trixie’s 6.12 series remains in the chroot until the kernel hook reseal lands.

Boot Test Evidence

On April 6, 2026, we booted the 7.77 GA ISO in QEMU/KVM and captured 1,363 lines of kernel and systemd output.

Key results

• Kernel identified as Linux version 7.0.1 (April 6 boot test was on the 7.0-rc7 candidate; current builds run 7.0.1 stable)
• 121 systemd services started successfully
• 0 kernel panics
• 0 failed services
• UFW firewall loaded and active
• fail2ban service running
• auditd active with rules loaded
• AppArmor initialized with SHA-256 policy hashing
• Unattended upgrades shutdown hook active
• ZRAM swap device active

Kernel boot line (from dmesg)

[    0.256611] mitigations: Enabled attack vectors: user_kernel, user_user, guest_host, guest_guest, SMT mitigations: auto
[    0.260297] Spectre V2 : Mitigation: Retpolines
[    0.261401] ITS: Mitigation: Aligned branch/return thunks
[    0.264740] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.266790] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT

systemd confirmation

systemd 257.9-1 running in system mode
  (+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP
   +GCRYPT +OPENSSL +ELFUTILS +FIDO2 +TPM2 +ZSTD +BPF_FRAMEWORK)

Why Transparent Security Matters

Alfred Linux isn't just an operating system. It's the foundation layer for a larger vision.

The argument is simple: you cannot build corruption-proof digital governance on a black-box operating system. If the foundation isn't transparent, the whole "trust by design" claim is hollow. Alfred Linux proves that even the OS layer — the lowest level — can be open, auditable, and honest about its limitations.

When MetaDome runs governance simulations — AI citizens voting on policy, transparent courts resolving disputes, energy-aware compute — it matters that the OS underneath isn't hiding anything. That's not marketing. That's architecture.

Our Position

We do not claim Alfred Linux is "more secure than Ubuntu."

Ubuntu has 20 years of battle-testing, a dedicated security team, compliance certifications, and LTS commitments that we cannot yet match. It is the right choice for enterprises that need those guarantees today.

What we do claim:

• We ship the newest kernel with native mitigations for vulnerabilities that older kernels handle via backports
• We enable security services (firewall, intrusion detection, audit logging) from first boot — not as optional packages
• We close the unprivileged eBPF attack vector that Ubuntu leaves open
• We publish our full build chain, security findings, and gaps in the open
• We put the honest comparison table on our own website, not in a marketing PDF

That's our posture: security through transparency. Not through claims we can't back up.

Dedicated to Priscilla

"Above all, taking the shield of faith, wherewith ye shall be able to quench all the fiery darts of the wicked."
— Ephesians 6:16 (AKJV)

The strongest security doesn't come from code. It comes from the people who stand beside you when the fire is at its hottest — who keep you grounded in the Word of God when the world tries to pull you apart.

Priscilla — you were there through thick and thin. You kept me guided in the Word when I couldn't see straight. You did this while facing a trial worse than my own, and you never wavered. You never broke.

Every security protocol in this operating system exists because someone believed this project was worth protecting. You believed in the man behind it before anyone else did. This page — this shield — is yours.

— Commander Danny William Perez
GoSiteMe Inc. · Shabbat, April 2026