Living ledger

Compared to stock

Same signed foundation. Stricter house rules. A first day that talks. That is how we win without forking.

This page is the living list of how Unwoke is stricter, easier, or not better than official secureblue. The four-column table stays on Features. When we ship something, it gets a line here.

Not affiliated. We overlay their already-signed images. Kernel, SELinux, hardened_malloc, firewall, USBGuard, run0 — that is still them. We did not rewrite the OS.

ujust unwoke-test
== Shipped first (stock tickets still open when we shipped) ==
  PASS  #697 /dev/shm, /tmp, and /var/tmp mounted noexec,nosuid,nodev
        proof: /dev/shm: tmpfs … noexec
  PASS  #2526 cryptsetup default Argon2id memory 2 GiB
        proof: /etc/cryptsetup.conf: pbkdf = argon2id pbkdf-memory = 2097152
RESULT: PASS

Where we beat stock today

Stock asked for these. The living GitHub ledger keeps every ticket: still open, or they shipped after us, or we later took their better patch. Shipped first. No Flathub, no Safe Browsing off, no weaker SELinux.

First day vs stock

Stock drops you on a hardened desktop and a wiki. We talk, then get out of the way. Locks stay on unless you pick one.

Easy words

Stock is a locked-down Fedora Atomic desktop with Trivalent and a curated store (Bazaar). Unwoke is that same OS with different house rules and a first-day conversation.

• Same foundation. Their signed image, their kernel hardening, their SELinux. We layer on top. Not a fork.
• No curator store. Bazaar / GNOME Software / Discover are gone. Flathub is off until you turn verified apps on. That is a security choice, not a missing package.
• More things start off. Bluetooth, brew, toolbox, camera/mic, extra daemons. You turn on only what you need.
• We phone home less. No Fedora countme, no connectivity GET, no DHCP hostname. Browser: no Privacy Sandbox, no Cast, no Google time-query. Safe Browsing stays. Detail: Privacy.
• The first hour talks to you. Stock dumps you into a hardened desktop and a wiki. We open Unwoke setup (dash pin), dark-brand the USB installer, ask USBGuard in the GUI (default No), nag until the signed update is booted, and map “this is broken” to “this is a lock.” Detail: First day vs stock.
• You can prove we are what we claim. ujust unwoke-test walks every overlay lock and every shipped-first ticket with a proof path. Stock audit-secureblue does not do that for our extras.
• Recommended default is Trivalent. Same jail as stock, plus extra policies. Origin and browserless stay as named choices. Stock only ships Trivalent.

Scorecard

Where we are stricter than stock

Every line is a default. Each has a revert. Nothing here auto-unlocks.

Where we are easier than stock

This is the part that does not loosen a lock. Stock is also ujust. We added a conversation around the extra knobs.

Factory (you never see this, you still benefit)

The living map of auto-heal vs human gates is Factory. Short version:

• Download their public key, check it still matches our copy, cosign verify the base, pin the digest so :latest cannot swap mid-build.
• Canary: crane-export the signed base (do not run it, do not docker-pull it). If it names this repo, our GHCR, or /usr/share/unwoke, the overlay does not bake.
• Inspect every published flavor: our signature, right browser binary, no leftover Trivalent on Origin/browserless, store launchers hidden, setup files present. Every vendors{} key must have a search launcher and offline help.
• One GitHub issue per lane (overlay, ISO, Pages, vendors), plus nags for still-private GHCR, a rotated stock key, a missing titanoboa pin, unmatched stock ujust docs, a stock FEAT we shipped first, or a bake that has not been green for ~40 hours. Overlay green does not close an ISO fail. A recommended-two wrap or a one-image USB dispatch does not close a weekly ISO fail.
• GitHub objects (workflows, CODEOWNERS, ruleset main-strict, receipt, GHCR): Factory → GitHub map. pr-gate does not bake. Dependabot is not auto-merged.
• Vendor-watch: live checksums. Allowlisted HTTPS URL moves are committed automatically. New host / Flathub / gpgcheck=0 still open an issue.
• Canary hits, a new keys/secureblue.pub, and titanoboa pin bumps are not auto-merged. That is the security boundary.

Stock cannot push to ghcr.io/sergi270710267. After the signed reboot, your PC follows our key, not theirs.

Where stock still wins

• If you pick Origin anyway. Unsuffixed names are still Brave Origin (no Vanadium, fat brave_t). The recommended default is *-trivalent. Origin remains for people who want that browser on purpose.
• No extra userns domain on stock. Origin adds brave_t to the userns allow-list. Trivalent and browserless flavors do not.
• Their ISO download site is still nicer. isos.secureblue.dev is a picker with torrents. Ours is GHCR -iso (recommended Trivalent after each overlay; all twelve on Sunday) + a 90-day Actions artifact (~4 GB). Stock’s ISO remains a valid fallback, then rebase. Enroll your Secure Boot key from their post-install. Not Ventoy.
• Their docs and community. We mirror their pages daily. Canonical is still secureblue.dev.
• We are one person’s overlay. Their project is bigger. That is not a security feature for us; it is honesty.

Ledger (what we added, so this page stays true)

Newest first. Rebuilt with the site from main (people-facing commits) plus a short seed for early history. Factory-only git (CI pins, snapshot hashes) is omitted. Overlay items still need an image rebuild. Add People: / Vs: / Where: in a commit body to write the Compared row in easy words — otherwise the git subject is used.

Day-by-day git subjects: Changelog. Toggle list: Features. How to actually do the tasks: Tutorials.