a selinux axis: what mode, and does the machine agree with itself (fettle v1.19.0)
AppArmor axis: enabled is not the same as confining (fettle v1.18.0)
hardening-audit elevates since v1.17.0; --user opts out
read-only does not mean unprivileged: inside -a every action is root (fettle v1.13.0-1.16.0)
a stopped snapd no longer hangs the run (fettle v1.16.0)
per-user stores are asked as the user: podman and flatpak (fettle v1.15.0)
every pkg-audit provider states what it examined (fettle v1.14.0)
GNOME extensions are read from a login session, not the machine (fettle v1.13.0)
clean refuses on a held pacman lock; the dashboard card no longer keeps fixed findings (fettle v1.8.0-1.12.0)
a package verifier that failed is not a verifier that found nothing (fettle v1.11.0)
an upgrade will not run from lists it could not refresh (fettle v1.10.0)
you do not need to type sudo, and bpftool needs root anyway The usage block told the reader to run 'sudo fettle -M'. compromise-check is classified read-only AND needs-root, so a plain run elevates itself the way sys-audit does — the only invocation that stays unprivileged is --dry-run, which is why that is the one listing blind spots. Adds the per-distro install commands for bpftool and the fact that matters more than the package name: it exits 255 for an ordinary user, so installing it only helps a run that elevates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bpftool ships in the 'bpf' package on Arch, not 'bpftool' There is no package called bpftool in the Arch repos or the AUR — pacman -Fx bin/bpftool$ gives extra/bpf, part of the linux-tools group. Debian, Ubuntu and the RHEL family each have a bpftool package of their own, which is where the wrong assumption came from. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
describe the one-table layout on both audit pages The renderer changed at v1.7.0: one table across every axis or group, ranked worst first, with a GROUP column and per-group coverage lines above it. The hardening page still described the table-per-axis layout it replaced, and the compromise page did not show the output at all. Also records the two behaviours a reader is most likely to be surprised by: subjects truncate in the middle rather than the end, and width follows the terminal up to 120 but is fixed at 80 when piped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
compromise-check: the manual page, and the five cross-links it needs A new page for the sixth feature family, plus the edits that make it findable and correctly situated: Home and the sidebar list it among the security audits (now five, not four); Maintenance-actions gains the -M row and the --everything ordering rationale; Reference gains its exit-status row and the reason that status turns on severity rather than on findings existing. Two cross-links are the point rather than decoration. Package-supply-chain says pkg-audit tells you a package you installed was in the June 2026 AUR wave and compromise-check tells you whether the implant is still here — two halves of one incident. System-supply-chain names the Secure Boot seam: sys-audit judges that posture, compromise-check only states it, and neither boot result should be read without the other. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fettle 1.0.1 manual — the nine pages split out of the README The README was 2204 lines. It now keeps what a front page is for — what fettle is, whether it runs on your machine, how to install it — and hands the reference material here, verbatim, in pages that follow the sections it already had. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Initial Home page