# InterGenOS R001.2 — Provenance Index

**What this document is.** An index of where every published piece of InterGenOS
R001.2 comes from, and how to check that claim yourself. Every row states a measured
value and the exact command that produces it. Nothing here asks you to take the
project's word for anything: each entry is either something you can recompute, or it
is marked as a limit of what this release can prove.

**How the values were measured.** Every number below was produced by running the
stated command against the published artifacts over the public network, on
2026-09-03. If you run the same command and get a different answer, the divergence is
the finding — not this document. Section 6 is where that covenant was exercised
against this release's own bill of materials, and it found two entries that differ,
for a reason stated there.

---

## 1. The source of record

The tree R001.2 was built from is a single commit on `master`, and that commit is
signed by an annotated tag.

| Item | Value |
|---|---|
| Repository | `https://github.com/InterGenJLU/intergenos.git` |
| Signed tag | `R001.2` |
| Tag object | `35d42f6f1d57d42ce1bccf6bb9824ef6c2d782d0` |
| Tagged commit | `0ca4650224d1b83afc70fb7f8af46b19cee1905b` |
| Tag signature | Good, by signing subkey `D7AA641D81ACD690C5AD865E7276E14DD8886BFE` |
| Signature made | 2026-09-03 17:23:33 CDT |
| Signing primary key | `5597A3E0587B253006D0DD7B8C50826182083050` |
| `packages/` tree object | `0b875b4f86d4ab125eaac45d79d3120bc775f279` |
| Preceding release tag | `R001.1`, at commit `f21545b5fe8df389626a7cd14809c691c915d8f7` |
| Preceding major release tag | `R001`, at commit `7716421faea22c9e65eaf63207706d4bc717c02a` |

**Verify the tag:**

```sh
git clone https://github.com/InterGenJLU/intergenos.git && cd intergenos
curl -sS https://repo.intergenos.org/keys/intergenos-release-key.asc | gpg --import
git tag -v R001.2
git ls-remote --tags https://github.com/InterGenJLU/intergenos R001.2
```

**Verify that the package definitions you are reading are the ones this release was
built from.** The `packages/` tree object is the thing to compare, because it is
unchanged by commits that touch documentation only:

```sh
git rev-parse R001.2:packages
git rev-parse master:packages
```

Both print `0b875b4f86d4ab125eaac45d79d3120bc775f279`. Every count in section 6 was
derived against that exact tree object.

**A note on what the tagged tree contains.** The tagged commit is the tree the
published packages and the image were built from, plus the two releases published
after the image was assembled (the package manager at release 73 and the installer
at release 241, section 6) and the release's documentation. No package definition on
the tag differs from what the mirror serves.

**A limit, stated plainly.** The tag pins the source tree; it does not attest the
machine that compiled it. See section 7.

---

## 2. The installation image

| Item | Value |
|---|---|
| URL | `https://repo.intergenos.org/iso/intergenos-r001.2.iso` |
| Size | 10,431,324,160 bytes |
| SHA-256 | `37b0d8fe4a48e56a6c6a4182d1f9a812cb123ed03ae5dfe934f3676f2d6fa6ff` |
| Checksum file | `https://repo.intergenos.org/iso/intergenos-r001.2.iso.sha256` |
| Checksum file SHA-256 | `c3531cfb7762eaf87e3b00265fe09d99976064261683585de1fbbc8f22d08154` |
| Signature over the checksum file | `https://repo.intergenos.org/iso/intergenos-r001.2.iso.sha256.asc` |
| Signature SHA-256 | `36f9302f575b5bac6b9c6e7e860ba4cb203fb61101cf407c9ebdeae52f7070a1` |
| Signature made | 2026-09-03 16:42:24 CDT, by subkey `D7AA641D…` |
| Server `Last-Modified` (image) | Thu, 03 Sep 2026 15:20:05 GMT |

**Verify, signature first:**

```sh
curl -O https://repo.intergenos.org/iso/intergenos-r001.2.iso
curl -O https://repo.intergenos.org/iso/intergenos-r001.2.iso.sha256
curl -O https://repo.intergenos.org/iso/intergenos-r001.2.iso.sha256.asc

gpg --export 5597A3E0587B253006D0DD7B8C50826182083050 > release-key.gpg
gpgv --keyring ./release-key.gpg \
     intergenos-r001.2.iso.sha256.asc intergenos-r001.2.iso.sha256   # Good signature
sha256sum -c intergenos-r001.2.iso.sha256                            # OK
```

The signature over the served checksum file was fetched and verified against the
release key for this index; the byte count in the table equals the `Content-Length`
the server advertises for the image.

**A second, independent attestation of the same digest.** The image-assembly step
writes a provenance manifest recording the SHA-256 of every input artifact it
consumed — the signed bootloader and the three signed unified kernel images, and the
squashfs — together with the SHA-256 of the image it produced. That manifest records
the output digest — SHA-256 `37b0d8fe4a48e56a6c6a4182d1f9a812cb123ed03ae5dfe934f3676f2d6fa6ff` — as the same value the published checksum file carries. The two were produced by different steps at
different times: one by the assembler as it wrote the image, one by the publish path
as it staged it.

**A limit, stated plainly.** The signature attests the checksum file, not your copy
of the image. Verifying it proves the checksum you are about to compare against is
the project's; comparing the image to that checksum is a separate step you have to
run, and it is the one that catches a truncated download or a substituted image.
Neither step says anything about the machine that built the image — see section 7.

---

## 3. The signed package index

The mirror's index is a signed manifest of the entire repository. One signature
covers every package entry, and each entry carries that package's own SHA-256 — so
verifying one signature transitively attests the bytes of every published package.

| Item | Value |
|---|---|
| Index URL | `https://repo.intergenos.org/x86_64/current/InterGenOS.db` |
| Signature URL | `https://repo.intergenos.org/x86_64/current/InterGenOS.db.sig` |
| Index SHA-256 | `011a1d238df4661ab7c7a7e63f2a442a5eaa7bf0938b13b82847ed1eef9e5cdb` |
| Signature SHA-256 | `1aec68caf23b550e953d130353a9700f921c65953aea5241412a042de7dd4afa` |
| Signature made | 2026-09-03 16:25:23 CDT, by subkey `D7AA641D…` |
| Index generated | 2026-09-03T21:25:23Z (from the index's own `generated` field) |
| Packages in index | 1,126 |
| Entries carrying a SHA-256 | 1,126 of 1,126 |
| Format | gzip-compressed JSON |

**Verify the signature:**

```sh
curl -O https://repo.intergenos.org/x86_64/current/InterGenOS.db
curl -O https://repo.intergenos.org/x86_64/current/InterGenOS.db.sig
gpg --export 5597A3E0587B253006D0DD7B8C50826182083050 > release-key.gpg
gpgv --keyring ./release-key.gpg InterGenOS.db.sig InterGenOS.db
```

Expect `Good signature from "InterGenOS Project Signing Key (primary)"`.

**The index describes the bytes the mirror actually serves.** That was checked rather
than assumed, by downloading a published archive and hashing it:

```sh
curl -O https://repo.intergenos.org/x86_64/current/acl-2.3.2.igos.tar.gz
sha256sum acl-2.3.2.igos.tar.gz
# sha256 1ed571ba5da9641fba9a859f41cdf7f35b71a2e1eb07adf2154ab48954c69ddc
gzip -dc InterGenOS.db | python3 -c '
import json,sys; print(json.load(sys.stdin)["packages"]["acl"]["sha256"])'
# sha256 1ed571ba5da9641fba9a859f41cdf7f35b71a2e1eb07adf2154ab48954c69ddc
```

The two agree. Section 6 records the same comparison run across the whole shipped
set.

---

## 4. The source-archive corpus

| Measurement | Value |
|---|---|
| Source archives published | 1,134 |
| Published binaries in the signed index | 1,126 |
| Binaries with a name-and-version-matching source archive | 1,086 |
| Binaries with no matching source archive | 40 |
| Source archives with no corresponding published binary | 48 |

**Reproduce these counts:**

```sh
curl -sS https://repo.intergenos.org/x86_64/current/sources/ \
  | grep -o 'href="[^"]*\.igos\.src\.tar\.gz"' | sed 's/href="//;s/"//' | sort > sources.txt
wc -l sources.txt                      # 1134

curl -sS -O https://repo.intergenos.org/x86_64/current/InterGenOS.db
gzip -dc InterGenOS.db | python3 -c '
import json,sys
db = json.load(sys.stdin)["packages"]
want = {"%s-%s-%s.igos.src.tar.gz" % (n, e["version"], e["release"]) for n, e in db.items()}
have = set(open("sources.txt").read().split())
print("binaries          :", len(db))
print("matched           :", len(want & have))
print("binary, no source :", len(want - have))
print("source, no binary :", len(have - want))'
```

**What the 40 are.** Packages that declare no upstream source, so there is nothing to
publish: the project's own configuration, branding, font and theme packages, the
meta-packages whose whole content is a dependency list, and the helper recipes that
fetch a proprietary application from its vendor at install time rather than building
it. The publish pipeline enforces the correspondence rule and derives this exemption
set from the package definitions themselves at publish time, printing every exempted
name rather than consulting a hidden allowlist.

**What the 48 are.** Build-stage intermediates — 46 with names ending `-pass1`,
`-pass2`, `-core`, `-tmp` or `-bootstrap`, plus the toolchain's two staging
definitions `libstdcpp` and `linux-headers`. A from-source bootstrap builds some
packages more than once, at different stages, with different capabilities available.
Their source is published; their built binaries deliberately are not, because a build
intermediate is not a package a user installs.

**A limit, stated plainly.** The signed index covers binary archives. Source archives
are not listed in it and are therefore not covered by its signature. Verifying a
source archive is a checksum comparison against the pins inside it and in the recipe,
not a signature check.

---

## 5. The release key and where it is served

R001.2 is signed by the same key as R001 and R001.1. One primary key, served from
three independent places. All three serve the same key material; the ASCII-armored
bytes differ between them because each keyserver normalises packet order and strips
third-party certifications differently, which is why the fingerprint — not the file
hash — is the thing to compare.

| Location | URL or command |
|---|---|
| Project mirror | `https://repo.intergenos.org/keys/intergenos-release-key.asc` |
| keys.openpgp.org | `gpg --keyserver keys.openpgp.org --recv-keys 5597A3E0587B253006D0DD7B8C50826182083050` |
| keyserver.ubuntu.com | `gpg --keyserver keyserver.ubuntu.com --recv-keys 5597A3E0587B253006D0DD7B8C50826182083050` |

| Key component | Fingerprint | Role |
|---|---|---|
| Primary | `5597A3E0587B253006D0DD7B8C50826182083050` | Certification and signing; **this is the fingerprint to compare** |
| Subkey | `D7AA641D81ACD690C5AD865E7276E14DD8886BFE` | Signed this release's image checksum, package index and `R001.2` tag |

The copy served from the project mirror at the time of measurement has SHA-256 `18b15b6fb975f0ab55dc3fd7cc0dc85087619c39354732a90db1c20cb51e7da6`,
unchanged since R001.1. Do not treat that value as the thing to check — compare the
fingerprint, for the reason given above.

**A limit, stated plainly.** Three sources agreeing raises the cost of substituting a
key; it does not by itself prove the key belongs to this project. That is what key
certification is for, and it is your decision to make, not something a release
document can settle on your behalf.

---

## 6. The software bill of materials

| Item | Value |
|---|---|
| File | `intergenos-r001.2.sbom.spdx.json` |
| SHA-256 | `fa43069c9e62acf4f2e3f2edc107470e1c5efc1aaec51d06e7f0ec7774b1d29f` |
| Format | SPDX 2.3, JSON |
| Created | 2026-09-03T12:08:15Z (from the document's own `creationInfo`) |
| Total entries | 863 |
| — components carrying an archive SHA-256 | 862 |
| — the image record, which carries no archive checksum by design | 1 |
| Generated by | `scripts/iso-sbom-gen.py`, from the tree the image was assembled from |

**The shipped set is derived, not curated.** The generator imports the same parser
the build pipeline uses and reads each package's resolved `iso_include` value, so the
set in the bill of materials and the set the build ships are the same computation and
cannot drift apart. A package that cannot be identified is a loud refusal naming it,
and no document is written at all.

**The checksums in this bill of materials against the signed index.** Measured
against the served index for this document:

| Result | Count |
|---|---|
| Component checksum equal to the signed index | 841 |
| Component checksum differing | 2 |
| Component absent from the index — never-published build intermediates | 19 |
| Entries with no archive checksum — the image record | 1 |

**Reproduce it:**

```sh
gzip -dc InterGenOS.db > db.json
python3 -c '
import json
sbom = json.load(open("intergenos-r001.2.sbom.spdx.json"))
idx  = json.load(open("db.json"))["packages"]
same = diff = absent = nohash = 0
for p in sbom["packages"]:
    ck = [c["checksumValue"] for c in p.get("checksums", []) if c["algorithm"] == "SHA256"]
    if not ck: nohash += 1; continue
    e = idx.get(p["name"])
    if e is None: absent += 1; continue
    same += ck[0] == e["sha256"]; diff += ck[0] != e["sha256"]
print("equal:", same, " differ:", diff, " absent:", absent, " no checksum:", nohash)'
```

**The two that differ, and why.** The bill of materials describes the image as
assembled on the morning of 2026-09-03, with the package manager `pkm` at release
71 and the installer `forge` at release 240. Evaluation of that image on real
hardware the same day found that upgrading a download-helper package (the CUDA
toolkit's installer) deleted the application it had installed. The fix was made on
the mirror rather than by assembling a new image: `pkm` release 73 and `forge`
release 241 were built, published and proven on the same machine before this
release was announced, and the signed index carries them. An installed system
reaches those releases with its first `pkm upgrade`; the image's own copies are the
ones the bill of materials names. The 841 other components inherit the index
signature's attestation exactly as in R001.1.

**Licenses in the bill of materials.** Every component entry carries a
`licenseDeclared` value taken from the package definition — 72 distinct SPDX
identifiers across the set. Every entry's `licenseConcluded` is `NOASSERTION`, which
is the honest SPDX encoding: "declared" is what the package states, "concluded" is
what an analyst determined, and no analyst pass was run. That is a statement of what
was not done, not a gap discovered.

---

## 7. What this release does not prove

Stated here rather than left for you to discover.

- **The image checksum is signed, but the signature covers the checksum file and not
  your copy of the image.** Verifying it and then hashing the image are two separate
  steps, and only running both establishes that the file on your disk is the released
  image. See section 2.
- **Source archives are not covered by the index signature.** See section 4.
- **The bill of materials describes the package set the image ships, derived from the
  package definitions — not an inventory taken by opening the image's filesystem.**
  Those two answer the same question from different directions, and only the first is
  claimed here.
- **Two shipped packages are newer on the mirror than on the image.** See section 6.
  The image is what the bill of materials attests; the mirror is what an installed
  system runs after its first upgrade.
- **This index does not attest the build environment.** It records what was published
  and how to check it. A formal attestation of the machine and toolchain that
  produced the artifacts is a separate mechanism and is not part of R001.2.