Security Transparency

CPU Vulnerability Mitigations — Kernel 7.0 vs 5.15

Data below comes from two real systems: Alfred Linux RC8 boot-tested in QEMU/KVM on April 6, 2026, and a production Ubuntu 22.04 server running kernel 5.15.0-173. Both systems use AMD/Intel hardware with the same vulnerability surface.

¹ VM test limitation: MDS and Speculative Store Bypass show "Vulnerable" because QEMU/KVM does not pass through CPU microcode. On real hardware with vendor microcode installed (via intel-microcode or amd64-microcode packages, both included in the ISO), these would show mitigated status. Ubuntu's "Not affected" entries reflect the specific CPU model of that production server, not a kernel advantage.

Kernel 7.0 exclusive mitigations

Three vulnerability classes have native mitigation code that was written for kernel 7.0:

• ITS — Indirect Target Selection attacks. Kernel 7.0 ships the upstream fix natively, while older kernels received backports.
• TSA — Transient Scheduler Attacks against CPU scheduling units. New vulnerability class; mitigation only exists in 7.0+.
• VMSCAPE — VM escape via VMCS manipulation. Restricts shadow VMCS access; new in 7.0+.

Out-of-Box Security Hardening — 32 Modules

What runs on first boot, before the user touches anything. Alfred Linux RC8 ships 32 security modules across 3 hooks — more out-of-box hardening than any mainstream desktop Linux.

Security tools included: alfred-security-status (dashboard), alfred-scan (antivirus), alfred-usb-storage (USB toggle), alfred-aide-init (integrity baseline), alfred-network-status (network audit), alfred-encrypt-status (encryption check).

Persistent Gaps

Radical honesty. Even with 32 security modules, Ubuntu has advantages we can't match today.

Build Transparency

Every Alfred Linux ISO is built by a single script with numbered, auditable hooks. Nothing is hidden.

Build chain

scripts/build-unified.sh rc8 --uefi   ← one command
├── Hook 0100: branding + UFW + SSH    ← visual identity + base firewall
├── Hook 0150: hardware                ← drivers, firmware, microcode
├── Hook 0160: security (21 modules)   ← sysctl, AppArmor, auditd, ClamAV, AIDE, etc.
├── Hook 0165: network hardening       ← nftables, MAC random, SSH ciphers, anti-scan
├── Hook 0170: full-disk encryption    ← LUKS/cryptsetup, Calamares FDE
├── Hook 0200: browser                 ← Alfred Browser (privacy-first)
├── Hook 0300: ide                     ← Alfred IDE
├── Hook 0400: voice                   ← Kokoro TTS engine
├── Hook 0500: search                  ← Meilisearch
├── Hook 0600: installer               ← Calamares (graphical disk installer)
├── Hook 0700: welcome                 ← first-boot experience
├── Hook 0710: update                  ← OTA update framework
├── Hook 0800: store                   ← Alfred Store
├── Hook 0900: voice-v2                ← advanced voice engine
├── Hook 9999: boot-fix (chroot)       ← generic kernel names for bootloader
└── Hook 9999: boot-fix (binary)       ← ISOLINUX/GRUB references

Published checksums

SHA-256: 7d49ef3cfb957cb9854bd3f451ef99ec8255afd68069a89ed0cf5a847d5d79bf
BLAKE3:  e021d2024599aa918972d9e6b9fd9c1d97d226ac69da035913fd7a462dbef47d
File:    alfred-linux-4.0-rc8-amd64.iso
Size:    2.4 GB

Verify yourself: sha256sum alfred-linux-4.0-rc8-amd64.iso · b3sum alfred-linux-4.0-rc8-amd64.iso

The build script, all 16 hooks (including 3 dedicated security hooks totalling 800+ lines), and the kernel config are inspectable. The ISO is built on a dedicated GoSiteMe build server (8 cores, 32 GB RAM) using Debian live-build toolchain on Debian Trixie. The compiled kernel produced 44,028 lines of build output with zero errors.

Boot Test Evidence

On April 6, 2026, we booted the RC8 ISO in QEMU/KVM and captured 1,363 lines of kernel and systemd output.

Key results

• Kernel identified as Linux version 7.0.0-rc7-alfred
• 121 systemd services started successfully
• 0 kernel panics
• 0 failed services
• UFW firewall loaded and active
• fail2ban service running
• auditd active with rules loaded
• AppArmor initialized with SHA-256 policy hashing
• Unattended upgrades shutdown hook active
• ZRAM swap device active

Kernel boot line (from dmesg)

[    0.256611] mitigations: Enabled attack vectors: user_kernel, user_user, guest_host, guest_guest, SMT mitigations: auto
[    0.260297] Spectre V2 : Mitigation: Retpolines
[    0.261401] ITS: Mitigation: Aligned branch/return thunks
[    0.264740] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.266790] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT

systemd confirmation

systemd 257.9-1 running in system mode
  (+PAM +AUDIT +SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP
   +GCRYPT +OPENSSL +ELFUTILS +FIDO2 +TPM2 +ZSTD +BPF_FRAMEWORK)

Why Transparent Security Matters

Alfred Linux isn't just an operating system. It's the foundation layer for a larger vision.

The argument is simple: you cannot build corruption-proof digital governance on a black-box operating system. If the foundation isn't transparent, the whole "trust by design" claim is hollow. Alfred Linux proves that even the OS layer — the lowest level — can be open, auditable, and honest about its limitations.

When MetaDome runs governance simulations — AI citizens voting on policy, transparent courts resolving disputes, energy-aware compute — it matters that the OS underneath isn't hiding anything. That's not marketing. That's architecture.

Our Position

We do not claim Alfred Linux is "more secure than Ubuntu."

Ubuntu has 20 years of battle-testing, a dedicated security team, compliance certifications, and LTS commitments that we cannot yet match. It is the right choice for enterprises that need those guarantees today.

What we do claim:

• We ship the newest kernel with native mitigations for vulnerabilities that older kernels handle via backports
• We enable security services (firewall, intrusion detection, audit logging) from first boot — not as optional packages
• We close the unprivileged eBPF attack vector that Ubuntu leaves open
• We publish our full build chain, security findings, and gaps in the open
• We put the honest comparison table on our own website, not in a marketing PDF

That's our posture: security through transparency. Not through claims we can't back up.