Their GitHub
We watch official secureblue issues. Every ticket we shipped first stays on this page. Open ones stay until they ship. When they ship, the card moves and says they shipped after us. If we later copy their better patch, that is written here on purpose.
[FEAT] is a request, not a release. On their tracker that prefix means “please add this.” An open ticket means they have not shipped it. We already did. Closed after our date means they shipped later. Not affiliated. We do not auto-copy their patch.
Open [FEAT] tickets on their GitHub. That means requested, not shipped. Defaults here until they close the ticket.
Not shipped on stock
Disk
Opened 2024-08-23 as a request. We shipped 2026-08-29. They had been asking for 24 months. Still open there, so they have not shipped it. This card stays until they do.
/boot is mode 700. ostree /usr is not chmod'd at runtime.
Revert ujust set-boot-perm off
Not shipped on stock
Memory
Opened 2024-12-19 as a request. We shipped 2026-08-29. They had been asking for 20 months. Still open there, so they have not shipped it. This card stays until they do.
noexec,nosuid,nodev on /dev/shm, /tmp, and /var/tmp. Payloads in RAM or persistent temp cannot exec.
Revert ujust set-ramdisk-exec on
Not shipped on stock
Trust
Opened 2025-02-28 as a request. We shipped 2026-08-29. They had been asking for 18 months. Still open there, so they have not shipped it. This card stays until they do.
ujust audit-unwoke warns if Flatpak session-bus, system-bus, or org.freedesktop.Flatpak is allowed.
Revert Hygiene, not a lock.
Not shipped on stock
USB install
Opened 2025-07-16 as a request. We shipped 2026-08-29. They had been asking for 13 months. Still open there, so they have not shipped it. This card stays until they do.
Chrony NTS (time.cloudflare.com, nts.ntp.se) on the live ISO and the installed OS. Independent of dns-selector.
Revert ujust set-nts off
Not shipped on stock
CPU
Opened 2025-08-29 as a request. We shipped 2026-08-29. They had been asking for 12 months. Still open there, so they have not shipped it. This card stays until they do.
glibc SHSTK and IBT tunables default on (x86_64). Stock still asks for a toggle.
Revert ujust set-cet off
Not shipped on stock
Network
Opened 2025-11-03 as a request. We shipped 2026-08-29. They had been asking for 10 months. Still open there, so they have not shipped it. This card stays until they do.
RFC 7844 leftovers: dhcp-send-release and dhcp-iaid=mac, plus hostname off we already shipped.
Revert ujust set-dhcp-hostname on
Not shipped on stock
TLS
Opened 2025-11-14 as a request. We shipped 2026-08-29. They had been asking for 9 months. Still open there, so they have not shipped it. This card stays until they do.
Blocklist Fedora roots that are not Mozilla website-trusted. Some gov/old CAs fail.
Revert ujust set-extra-cas on
Not shipped on stock
Apps
Opened 2026-01-30 as a request. We shipped 2026-08-29. They had been asking for 7 months. Still open there, so they have not shipped it. This card stays until they do.
Extra xdg folders plus host-root cut by default. Not host-os (hardened_malloc needs host-os:ro).
Revert ujust set-flatpak-lockdown off
Not shipped on stock
Apps
Opened 2026-04-23 as a request. We shipped 2026-08-29. They had been asking for 4 months. Still open there, so they have not shipped it. This card stays until they do.
Pulse and PipeWire capture blocked for Flatpaks, independent of folder lockdown. Native speakers stay.
Revert ujust set-flatpak-record off
Not shipped on stock
Network
Opened 2026-06-15 as a request. We shipped 2026-08-29. They had been asking for 2 months. Still open there, so they have not shipped it. This card stays until they do.
NFS and CIFS client modules blacklisted. Stock already masks the NFS server; we never unmask the server.
Revert ujust set-network-fs on
Not shipped on stock
USB install
Opened 2026-07-14 as a request. We shipped 2026-08-29. They had been asking for 2 months. Still open there, so they have not shipped it. This card stays until they do.
Empty-disk Anaconda starts with LUKS on. You can still untick Encrypt.
Revert Untick Encrypt in Anaconda
Not shipped on stock
Trust
Opened 2026-08-13 as a request. We shipped 2026-08-29. They had been asking for 16 days. Still open there, so they have not shipped it. This card stays until they do.
ujust audit-unwoke warns if a Flatpak web browser is installed, and fails on browserless.
Revert Hygiene, not a lock. Uninstall the Flatpak if it should not be there.
Not shipped on stock
USB install
Opened 2026-08-21 as a request. We shipped 2026-08-29. They had been asking for 8 days. Still open there, so they have not shipped it. This card stays until they do.
Argon2id memory cost 2 GiB (RFC 9106) on the live ISO and /usr/etc/cryptsetup.conf.
Revert Weaker if you format LUKS yourself without that conf
They closed the ticket after our ship date. The card stays. Review their PR; copy only if it is better.
None yet. When they close a ticket we already shipped, the factory moves it here automatically and opens a review issue. Tickets are never dropped.
Human decision after review. We were first. We later copied their better patch and say so here.
None yet. If you copy their better patch, set adopted.on / note / commit in stock-feats.json. The factory will not copy it for you.
You cannot copyright “please default LUKS on.” Those sentences were already on their tracker. You can make a silent copy obvious. This mark is default-on, like the other overlay locks: bake fails if it is missing.
main and this page. If they ship later, the card says after us.UNWOKE-SHIPPED-FIRST plus the MIT copyright line. Compose stamps a forgotten file. Inspect and the PR gate fail if git is unmarked. Live Chromium/Brave/Trivalent managed policies do not get that string (no extra unrecognized policy, no extra browser uniqueness)./usr/share/unwoke/SHIPPED-FIRST.txt is the dated ledger. /usr/share/unwoke/NOTICE is the MIT reminder. Copy the overlay tree and those strings come along. Reimplement from scratch and they do not — then the dates still stand.receipt attaches the same ledger next to cosign.pub. Not the OS. Not the USB.Plain text: SHIPPED-FIRST.txt.
We do not ship every request on their tracker. UKI, ARM, server images, kernel modules, TPM, and SELinux policy need their signed base — an overlay cannot honestly claim those. We also skip FEATs that would weaken the box (Safe Browsing off, unloading all audio, default system Flatpaks). Bugs that hit this overlay belong on Workarounds, not here.