published digest
What was
verified.
Every published digest carries the checks it passed and the ones it did not. This page is generated from the public evidence index; there is no hand-written claim to drift from the record.
sha256:649aff753ce166f299995f1235f616a151d249a94217e546a2ae624536f93af5
01 Identity
One digest, one build.
| Image | quay.io/deskos/deskos-core-centos-stream-10@sha256:649aff753ce166f299995f1235f616a151d249a94217e546a2ae624536f93af5 |
|---|---|
| Digest | sha256:649aff753ce166f299995f1235f616a151d249a94217e546a2ae624536f93af5 |
| Commit | 2936009d4bba0119025de519a8bb141f2735ec13 |
| Platform | centos-stream-10 |
| Workstation | deskos-core-centos-stream-10 |
| Built by | supply-chain run 40407632381 |
02 Checks
The machine, not the files.
Three checks ran on the image before it was published: the disk booted, a session came up, and the first-boot wizard appeared with no account. Each result below is the check's own report.
| Check | Result | What it observed |
|---|---|---|
| Boot | pass | splash 13.2 s · graphical 19.9 s · shutdown 1.7 s |
| Session | pass | wayland · GNOME Shell 49.5 · 37 checks passed, no failed check |
| First boot | pass | wizard: 4 process(es) |
none left out in the session check. AVC denials: 13.
03 Session detail
Every check, named.
The session check fails closed: a required check that cannot be measured is a failure, not a pass.
| Check | Result | Detail |
|---|---|---|
| session results reported | pass | session_type=wayland |
| user extensions allowed | pass | disable-user-extensions=false |
| plan binary /usr/bin/deskos | pass | sha256 eead05aebf12d8dc32d48e35865039fb1e6b021490eb3a66dafd811a204f9b47, mode 755, as the plan declares |
| extension loads (appindicatorsupport@rgcjonas.gmail.com) | pass | Enabled/State=Yes/ACTIVE |
| extension loads (dash-to-dock@micxgx.gmail.com) | pass | Enabled/State=Yes/ACTIVE |
| tray watcher serves the session bus | pass | tray_watcher=present |
| tray watcher accepts a registration | pass | tray_register=accepted |
| wallpaper as planned | pass | got 'file:///usr/share/deskos/backgrounds/deskos-light.svg' want 'file:///usr/share/deskos/backgrounds/deskos-light.svg' |
| login logo file exists | pass | logo=/usr/share/deskos/branding/deskos-login-logo.svg file=present |
| screen locks on request | pass | screen_locked=true |
| deskos report names the installed workstation | pass | got deskos-core-centos-stream-10 (exit=0) |
| deskos check runs on the booted image | pass | exit=0 |
| declared system Flatpaks are installed | pass | missing=none |
| the guest says whether Firefox is installed | pass | firefox_present=yes |
| Firefox runs headless | pass | exit=0 screenshot=yes |
| Firefox fetches the harness page | pass | fetch=ok content=ok requests=1 screenshot=yes |
| plan default /org/gnome/desktop/background/picture-uri | pass | the image's distro database carries 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares; the session sees 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares |
| plan default /org/gnome/desktop/background/picture-uri-dark | pass | the image's distro database carries 'file:///usr/share/deskos/backgrounds/deskos-dark.svg', as the plan declares; the session sees 'file:///usr/share/deskos/backgrounds/deskos-dark.svg', as the plan declares |
| plan default /org/gnome/desktop/screensaver/lock-delay | pass | the image's distro database carries uint32 0, as the plan declares; the session sees uint32 0, as the plan declares |
| plan default /org/gnome/desktop/screensaver/lock-enabled | pass | the image's distro database carries true, as the plan declares; the session sees true, as the plan declares |
| plan default /org/gnome/desktop/screensaver/picture-uri | pass | the image's distro database carries 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares; the session sees 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares |
| plan default /org/gnome/desktop/session/idle-delay | pass | the image's distro database carries uint32 600, as the plan declares; the session sees uint32 600, as the plan declares |
| plan default /org/gnome/desktop/wm/preferences/button-layout | pass | the image's distro database carries ':minimize,maximize,close', as the plan declares; the session sees ':minimize,maximize,close', as the plan declares |
| plan default /org/gnome/login-screen/logo | pass | the image's distro database carries '/usr/share/deskos/branding/deskos-login-logo.svg', as the plan declares; the session sees '/usr/share/deskos/branding/deskos-login-logo.svg', as the plan declares |
| plan default /org/gnome/shell/enabled-extensions | pass | the image's distro database carries ['background-logo@fedorahosted.org', 'appindicatorsupport@rgcjonas.gmail.com', 'dash-to-dock@micxgx.gmail.com'], as the plan declares; the session sees ['background-logo@fedorahosted.org', 'appindicatorsupport@rgcjonas.gmail.com', 'dash-to-dock@micxgx.gmail.com'], as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/autohide | pass | the image's distro database carries true, as the plan declares; the session sees true, as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/dash-max-icon-size | pass | the image's distro database carries 40, as the plan declares; the session sees 40, as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/dock-fixed | pass | the image's distro database carries false, as the plan declares; the session sees false, as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/dock-position | pass | the image's distro database carries 'BOTTOM', as the plan declares; the session sees 'BOTTOM', as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/intellihide | pass | the image's distro database carries true, as the plan declares; the session sees true, as the plan declares |
| plan default /org/gnome/shell/extensions/dash-to-dock/show-trash | pass | the image's distro database carries false, as the plan declares; the session sees false, as the plan declares |
| plan default /org/gnome/software/allow-updates | pass | the image's distro database carries true, as the plan declares; the session sees true, as the plan declares |
| plan default /org/gnome/software/download-updates | pass | the image's distro database carries false, as the plan declares; the session sees false, as the plan declares |
| plan vendor default org.gnome.desktop.background picture-uri | pass | the compiled schema default carries 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares; the session sees 'file:///usr/share/deskos/backgrounds/deskos-light.svg', as the plan declares |
| plan vendor default org.gnome.desktop.background picture-uri-dark | pass | the compiled schema default carries 'file:///usr/share/deskos/backgrounds/deskos-dark.svg', as the plan declares; the session sees 'file:///usr/share/deskos/backgrounds/deskos-dark.svg', as the plan declares |
| no unexpected failed system units | pass | failed=mcelog.service; known non-blocking: mcelog.service (see Platform diagnostics) |
| no failed user units | pass | failed= |
04 Evidence
The objects behind the claims.
The index is the entry point; every object is addressed by the same digest and was fetched back and verified after publication.
- bootcheck.summary.json
- commit.txt
- cosign-verify.txt
- cves.json
- declared.sbom.cdx.json
- digest.txt
- effective-exceptions.json
- firstboot.json
- gate.grype.yaml
- generated-manifest.json
- grype.txt
- identity.json
- image.txt
- installed.sbom.cdx.json
- plan.json
- session.json
Signature and attestations: cosign-verify.txt.
05 Limits
What this does not prove.
An honest record names its edges:
- It is not hardware validation. Suspend, radios, audio, ports and the rest are field evidence for one model, not a compatibility claim.
- It is not accessibility E2E. The session check exercises the desktop through the session, not through assistive APIs.
- It is not bit-for-bit reproducible. The plan and the Containerfile are deterministic; the image build is not yet.
- It says nothing about RHEL. RHEL-derived images are built privately and never published.
06 Verify
Do not trust this page.
Read the record and check the signature yourself:
$ cosign verify quay.io/deskos/deskos-core-centos-stream-10@sha256:649aff753ce166f299995f1235f616a151d249a94217e546a2ae624536f93af5 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity \ 'https://github.com/deskosproject/deskos-core/.github/workflows/supply-chain.yml@refs/heads/main' $ curl -fsS https://evidence.deskos.org/deskos/deskos-core-centos-stream-10/sha256/649aff753ce166f299995f1235f616a151d249a94217e546a2ae624536f93af5/index.json | jq .digest
Generated by tools/build-evidence.py from the public index. Do not edit this page by hand.