you do not need to type sudo, and bpftool needs root anyway The usage block told the reader to run 'sudo fettle -M'. compromise-check is classified read-only AND needs-root, so a plain run elevates itself the way sys-audit does — the only invocation that stays unprivileged is --dry-run, which is why that is the one listing blind spots. Adds the per-distro install commands for bpftool and the fact that matters more than the package name: it exits 255 for an ordinary user, so installing it only helps a run that elevates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bpftool ships in the 'bpf' package on Arch, not 'bpftool' There is no package called bpftool in the Arch repos or the AUR — pacman -Fx bin/bpftool$ gives extra/bpf, part of the linux-tools group. Debian, Ubuntu and the RHEL family each have a bpftool package of their own, which is where the wrong assumption came from. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
describe the one-table layout on both audit pages The renderer changed at v1.7.0: one table across every axis or group, ranked worst first, with a GROUP column and per-group coverage lines above it. The hardening page still described the table-per-axis layout it replaced, and the compromise page did not show the output at all. Also records the two behaviours a reader is most likely to be surprised by: subjects truncate in the middle rather than the end, and width follows the terminal up to 120 but is fixed at 80 when piped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
compromise-check: the manual page, and the five cross-links it needs A new page for the sixth feature family, plus the edits that make it findable and correctly situated: Home and the sidebar list it among the security audits (now five, not four); Maintenance-actions gains the -M row and the --everything ordering rationale; Reference gains its exit-status row and the reason that status turns on severity rather than on findings existing. Two cross-links are the point rather than decoration. Package-supply-chain says pkg-audit tells you a package you installed was in the June 2026 AUR wave and compromise-check tells you whether the implant is still here — two halves of one incident. System-supply-chain names the Secure Boot seam: sys-audit judges that posture, compromise-check only states it, and neither boot result should be read without the other. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>