-
Notifications
You must be signed in to change notification settings - Fork 1
Home
Paul Asadoorian edited this page Aug 12, 2026
·
3 revisions
in fine fettle — in good working order.
This wiki is the reference manual: every action, every flag, every config key, and the reasoning behind the defaults. What fettle is, which distros it supports, and how to install it live in the README.
Current release: 1.0.0. The web interface (fettle web) is experimental.
| Page | What's in it |
|---|---|
| Maintenance actions | Reading fettle's output, the full action table per distro family, and what -u -c -o -d -r -O -k -f -x -C actually run. Includes --everything and how to preview an upgrade. |
| Remote maintenance | Running any action over SSH against one host or a named group, with no install on the far side. |
| Configuration & reporting | The full config.toml, reports and run logs under ~/.fettle/, the fettle report HTML dashboard, and the experimental web UI. |
| Reference | Common options, exit codes, how elevation works, the code layout, and how to develop and test fettle. |
Each answers a different question, and each is read-only.
| Page | Question it answers |
|---|---|
| Package supply-chain | Where did this software come from, and do the installed files still match the package? (pkg-audit, pkg-integrity, aur-audit, aur-precheck) |
| System hardening audit | Is this machine configured safely? Seven independent axes. (hardening-audit / -H) |
| System supply-chain | Is the firmware and boot chain sound? Secure Boot, TPM, microcode, SPI/BIOS, storage firmware. (sys-audit / -S) |
| Security advisories | Is what I have installed known-vulnerable — including with no fix released yet? (advisory-check) |
| Compromise indicators | Is something already here? Boot persistence, loader and kernel integrity, running processes, boot chain. (compromise-check / -M) |
| Page | |
|---|---|
| AI upgrade check | Ask Claude what's risky about the pending upgrade set, locally or over SSH. (upgrade-check / -U) |
The one invariant behind all of it: a check that cannot look never renders like a clean result. Every audit distinguishes "found nothing wrong" from "could not tell", and says which it means.