HSCL1 0.1.8-alpha.0

HSCL1 0.1.8-alpha.0

A pre-alpha live/installer image. Not a v1 release: physical hardware, USB boot, Secure Boot
acceptance, TPM unlocking and release signing are not verified.

This release fixes the installer's intermittent startup crash. It was the single defect that had
survived every previous probe, and it is now found, fixed and verified on the built media.

• ISO: HSCL1-0.1.8-alpha.0-amd64.iso
• SHA-256: def7f190a061811970f6a053d2dfbe1e2e9e797926c62c2b12a28952fcd8c84d
• Size: 5 027 201 024 bytes (split into 3 parts, each below 1900 MiB)
• Built from: commit 91c8acbeff461e733d60452eecd2c608cbd13de0 on main, clean tree, xz
• Base: Kubuntu 26.04.1 desktop amd64 (Ubuntu resolute), KDE Plasma 6.6 LTS
• Languages: English, German, French

The installer crash: cause and fix

Since 0.1.4 the installer died at startup in roughly one start in six, with no core dump and an unhelpful
crash dialog. Three earlier readings of its log were wrong; getting a core is what settled it.

The trick was chmod -x /usr/lib/x86_64-linux-gnu/libexec/drkonqi: with no crash reporter to find, KCrash
does what its source says it does and re-raises the signal, so the kernel writes a core. Every core has the
same stack:

QListView::paintEvent
 -> QStyledItemDelegate::initStyleOption
 -> Calamares::ViewManager::data
 -> NotesQmlViewStep::prettyName()
 -> Calamares::Locale::TranslatedString::get(QLocale const&)
 -> SIGSEGV in libcalamares.so.3.3

The crash was in the notesqml step - an HSCL1 addition - while the progress tree painted that step's
name. In the live guest: with the step wired, 2 deaths in 8 starts; with the sequence line removed, 0 in 10.

On this artifact: /etc/calamares/settings.conf contains no notesqml line, and 20 of 20 sequential
installer starts survive with drkonqi disabled and a core pattern set - zero crashes, zero cores. The image
gate now asserts that the step stays disabled, and a unit test stops the hook from silently re-adding it.

The notes page's QML, its German/French translations and its module config stay in the package, so the step
can be re-enabled once upstream makes prettyName() safe. The disk-encryption explanation it carried is still
covered by the handbook and by the installer's own "your /boot is not encrypted" message.

What changed since 0.1.7-alpha.0

• the installer startup crash (above)
• scripts/dev/bump_version.py reads the current version from VERSION instead of hardcoding it, so a
  release bump cannot silently skip a file (0.1.6 shipped from a branch that was never merged precisely
  because of a version drift)

Verified on this artifact

• UEFI boot at 4 GB (QEMU 9.2.0, WHPX): desktop reached, scripts/qa_report.py exits 0 (9 checks ok, one
  info line about Secure Boot). Evidence: artifacts/boot-0.1.8.
• Image gates: every check passed on the built tree, including installer notes step stays disabled (Q-68).
• Installer start: 20 of 20 starts survive, no core (artifacts/boot-0.1.8/hscl1-report.txt).
• Workshop stays inert: workshop_default: disabled in the ISO manifest.

Not verified in this release

• physical hardware, USB boot and TPM unlocking are not tested
• the ISO is unsigned: no release signature exists yet
• Secure Boot acceptance is not demonstrated - the test firmware runs with Secure Boot off, although the
  image carries the signed Canonical/Microsoft boot components
• no encrypted install was re-run on this exact artifact; the LUKS2 evidence is from the 0.1.4/0.1.5 line
• the SBOM is CLI-scoped (hscl-cli, 99 packages); there is no ISO package-list SBOM
• the empty-ESP cause is still unknown; the install is guarded and fails visibly instead (Q-66)

Verify your download

$ gh release download v0.1.8-alpha.0 --repo timfromhcs/HSCL1
$ git clone https://github.com/timfromhcs/HSCL1 ../HSCL1-src
$ bash ../HSCL1-src/scripts/release-join.sh . --verify-only
$ bash ../HSCL1-src/scripts/release-join.sh .

SHA256SUMS is LF-only, so sha256sum -c SHA256SUMS works on Linux; the join script checks the three parts
and the rejoined image.

See docs/KNOWN_LIMITATIONS.md, docs/CLAIMS.md and docs/BUILD_LOG.md for the full, dated evidence.

HSCL1 0.1.7-alpha.0

HSCL1 0.1.7-alpha.0

A pre-alpha live/installer image. Not a v1 release: physical hardware, USB boot, Secure Boot
acceptance, TPM unlocking and release signing are not verified, and the installer still has an
unidentified startup crash that the wrapper retries (see Not verified).

• ISO: HSCL1-0.1.7-alpha.0-amd64.iso
• SHA-256: 400fb9d7aca53ef4f2b4926fb26732e0cd987b6363fc0f9800e2591d8e951df0
• Size: 5 027 201 024 bytes (split into 3 parts, each below 1900 MiB)
• Built from: commit 88f0fbec1ed1c0e254475c2adeab72568731f924 on main, clean tree, xz
• Base: Kubuntu 26.04.1 desktop amd64 (Ubuntu resolute), KDE Plasma 6.6 LTS
• Languages: English, German, French

Verified on this artifact

• UEFI boot at 4 GB (QEMU 9.2.0, WHPX): desktop reached in 192 s, scripts/qa_report.py exits 0
  (9 checks ok, one info line: this firmware has Secure Boot off). Evidence: artifacts/boot-0.1.7-uefi.
• Image gates: distro/live/verify-image.sh passed every check on the built tree, including the two
  new locale checks and the ESP guard's wiring.
• Workshop stays inert: workshop_default: disabled in the ISO manifest.

What changed since 0.1.6-alpha.0

• The installer's SIGKILL has a named sender. An audit rule on kill(2) during 12 sequential starts
  recorded sender drkonqi (pid 5919, ppid 5841) kill(pid=5841, SIGKILL) success=yes -> victim calamares:
  Calamares crashes, KCrash forks drkonqi from inside it, and drkonqi kills its own parent before
  collecting a backtrace. That explains the exit status 137 and the missing core dump. The crash itself is
  still unidentified (queue row Q-68).
• A mitigation claim was corrected. KCRASH_DUMP_ONLY=1 does not stop the fault: 6 starts with it
  produced 2 exit-137 deaths against 1 in 6 without it, and kernel.core_pattern plus ulimit -c unlimited
  produced zero cores either way. The restart loop is the mitigation, not the variable.
• The live locale fix never worked and now does. LANG="en_US.UTF-8" was only appended when no LANG=
  line existed, but the base image already sets LANG=C.UTF-8 - so nothing changed. The hook now replaces
  the value and generates the locale, and the image gate proves the locale exists, not just the variable.
• The ESP guard explains itself and no longer breaks a legacy install. On failure it prints the mount
  state, /boot/grub contents and the installer log tail; a target that carries BIOS GRUB is passed
  instead of being failed for having no ESP by design.
• docs/CLAIMS.md is machine-checked. Four rows had no artifact or a broken table (one had four cells);
  tests/unit/test_claims_table.py now fails the build on a lost cell or a claim without evidence.
• The installer logo is not stretched (measured: rendered ink ratio 5.381 against artwork 5.333,
  +0.9 %). The audit entry that said otherwise is corrected.

Not verified in this release

• physical hardware, USB boot and TPM unlocking are not tested
• the ISO is unsigned: no release signature exists yet
• Secure Boot acceptance is not demonstrated - the test firmware runs with Secure Boot off, although
  the image carries the signed Canonical/Microsoft boot components
• the installer still crashes at startup in roughly one start in six and is restarted by the wrapper (Q-68)
• the empty-ESP cause is unknown; the install is guarded and now fails visibly instead (Q-66)
• no encrypted install was re-run on this exact artifact; the LUKS2 evidence is from the 0.1.4/0.1.5 line
• the SBOM is CLI-scoped (hscl-cli, 99 packages); there is no ISO package-list SBOM

Verify your download

$ gh release download v0.1.7-alpha.0 --repo timfromhcs/HSCL1
$ git clone https://github.com/timfromhcs/HSCL1 ../HSCL1-src
$ bash ../HSCL1-src/scripts/release-join.sh . --verify-only
$ bash ../HSCL1-src/scripts/release-join.sh .

SHA256SUMS is LF-only, so sha256sum -c SHA256SUMS works on Linux; the join script checks the three parts
and the rejoined image.

See docs/KNOWN_LIMITATIONS.md, docs/CLAIMS.md and docs/BUILD_LOG.md for the full, dated evidence.

HSCL1 0.1.6-alpha.0

HSCL1 0.1.6-alpha.0 (local pre-release set)

Preview assembly does not certify boot or installation. See the supplied evidence and gaps.

• Live/installer ISO: HSCL1-0.1.6-alpha.0-amd64.iso (sha256 a916540c44d27529107c599ff58dbad95fb3292270814b7832d06ef5ebe5e94d)
• No disk image in this set: the VM image is optional (AGENTS.md 7.1) and was not built.
• Evidence recorded for this set: in-guest-qa-report, uefi-boot-result, uefi-desktop-capture

Not verified in this set

• Physical hardware, USB media boot, TPM-backed encryption and a Tor-routed privacy session are not verified.
• Releases are unsigned: integrity is SHA-256 only.
• Secure Boot: signed components are in the image, but every test ran with Secure Boot off (no positive SB boot).
• The installer is still killed in roughly one start in 6-12 within its first seconds (Q-61); the shipped launcher retries up to three times.
• Desktop labels are upright and no longer carry the untrusted emblem on this artifact (Q-52, Q-63); the label-centre measurement is -0.9 px (Q-60).

Not signed. Published as a prerelease on 2026-11-11: tag �0.1.6-alpha.0 at 13c3215, assets uploaded and digest-verified. See docs/KNOWN_LIMITATIONS.md for what is not verified.

HSCL1 0.1.5-alpha.0

HSCL1 0.1.5-alpha.0 (local pre-release set)

Preview assembly does not certify boot or installation. See the supplied evidence and gaps.

• Live/installer ISO: HSCL1-0.1.5-alpha.0-amd64.iso (sha256 c3ae31a6311f767187f57d4811a762159e76ce4ae29372e9567b7174b28c1ae3)
• No disk image in this set: the VM image is optional (AGENTS.md 7.1) and was not built.
• Evidence recorded for this set: in-guest-qa-report, uefi-boot-result, uefi-desktop-capture

Not verified in this set

• Physical hardware, USB media boot, TPM-backed encryption and a Tor-routed privacy session are not verified.
• Releases are unsigned: integrity is SHA-256 only.
• Secure Boot: the signed boot components are in the image, but the test firmware ran with Secure Boot off (no positive SB boot).
• The desktop icon font renders oblique (Q-52); the wallpaper presets grid/rain could not be distinguished in captures (Q-57).

Not signed, not tagged, not uploaded. See docs/KNOWN_LIMITATIONS.md for what is not verified.

HSCL1 0.1.4-alpha.0

HSCL1 0.1.4-alpha.0 (pre-release, unsigned, VM-tested only)

HSCL1 = Hypercharged Supreme Computing Layout 1. Live/installer ISO built from commit b904112 on main, base: Kubuntu 26.04.1 amd64 with KDE Plasma 6.6 LTS.
Made with love by hcsmedia. Not an official Ubuntu, Kubuntu, Kali or Tails product; no anonymity claim. See docs/CLAIMS.md and docs/KNOWN_LIMITATIONS.md.

What changed since 0.1.3-alpha.0

• Language Subcommand & Multi-Language Support (hscl language):
  • Implemented hscl language status, list, and set with --dry-run and --json support.
  • Native support for Tier-1 languages: English (en), German (de), and French (fr).
  • Added MCP tools hscl_language_status, hscl_language_list, and hscl_language_set.
  • In-guest verified via live serial Workshop RPC (scripts/dev/verify_in_guest_tracks.py).
• Shortcuts & Desktop Ergonomics (hscl-shortcuts):
  • Added hscl-shortcuts dual-mode helper (ASCII terminal table + graphical offline handbook).
  • Configured global shortcuts in /etc/xdg/kglobalshortcutsrc (Meta+Tab, Meta+Shift+Tab, Alt+F1 launcher activation).
  • In-guest verified keyboard bindings and zero hotkey collisions.
• Privacy Session & Ephemeral Memory Isolation:
  • Enforced ephemeral memory layout with RAM overlay (/cow, /cdrom) and zero host disk automounts.
  • Compressed RAM swap priority 100 via zram-generator, and fs.suid_dumpable = 0 to prevent unencrypted disk leaks.
  • In-guest verified mount and sysctl status.
• Security Lab Container Architecture:
  • Podman isolation confirmed absent from base host by default (per threat model).
  • hscl lab status verified and operational.
• Image Remaster & First-Boot Verification:
  • Candidate ISO HSCL1-0.1.4-alpha.0-amd64.iso (5,488,312,320 bytes, SHA-256 a7e055a7e9192b6007e4295a396bc5d771e3676877943de67fc313e4254d1f6f).
  • Booted in QEMU WHPX and verified live desktop and in-guest test suite across all 4 tracks.
  • Split into 3 parts (<1900 MiB each) and verified with release-join.sh --verify-only.

Verified (QEMU/WHPX, UEFI, disposable disks, on this exact image)

• Boot to live desktop and in-guest test hooks executed cleanly across Tracks B, C, K, and L.
• Split parts integrity: 3 parts match SHA256SUMS and join back to the byte-exact original ISO.

Not verified / limits

• Not tested on physical hardware. Not signed (checksums only).
• Security Lab Kali containers require manual podman initialization if used offline.
• Full Tails equivalence or anonymity is explicitly not claimed.
• See docs/KNOWN_LIMITATIONS.md for full disclosure.

Download and verify

The ISO is split into 3 parts of 1900 MiB (GitHub allows 2 GiB per file).

gh release download v0.1.4-alpha.0 -R timfromhcs/HSCL1
bash scripts/release-join.sh . --verify-only   # checks parts and whole image
bash scripts/release-join.sh .                 # joins to HSCL1-0.1.4-alpha.0-amd64.iso

A one-file ISO is also produced by the Bundle one-file ISO job of the "Verify release assets" workflow (Actions artifact HSCL1-v0.1.4-alpha.0-iso, kept 90 days).

Whole-image SHA256: a7e055a7e9192b6007e4295a396bc5d771e3676877943de67fc313e4254d1f6f (5488312320 bytes)

HSCL1 0.1.3-alpha.0

HSCL1 0.1.3-alpha.0 (pre-release, unsigned, VM-tested only)

HSCL1 = Hypercharged Supreme Computing Layout 1. Live/installer ISO built from commit 0ef918a / f5ed1ed on branch codex/unified-self-healing-master, base: Kubuntu 26.04.1 amd64 with KDE Plasma 6.6.
Made with love by hcsmedia. Not an official Ubuntu, Kubuntu, Kali or Tails product; no anonymity claim. See docs/CLAIMS.md and docs/KNOWN_LIMITATIONS.md.

What changed since 0.1.2-alpha.0

• Security Lab CLI Integration (hscl lab):
  • Added run, install, commit, and destroy subcommands to cli/hscl/src/main.rs.
  • Enforced mandatory --yes="I am authorized to test this target" preflight attestation.
  • Rootless Podman execution verified on the builder host with official Kali rolling container digest (kalilinux/kali-rolling@sha256:8aa57c0f...).
  • Documented in docs/CLI.md and docs/SECURITY_LAB.md.
• Developer Lifecycle & MCP Tooling:
  • Added scripts/dev/mcp_selftest.py exercising line-delimited stdio JSON-RPC MCP handshake, tool listing (14 tools), and structured error handling.
  • Added scripts/dev/wsl-cycle.sh bridging the Windows workspace with high-performance WSL2 Linux builds.
• Image Remaster & First-Boot Verification:
  • Candidate ISO HSCL1-0.1.3-alpha.0-amd64.iso (5,488,246,784 bytes, SHA-256 2e30b750a741fdbcf8ea3ffd0efe15a7ab36b9bcb559bb0defc1906ec7129fc3).
  • First-boot smoke test in Windows native QEMU 9.2.0 with WHPX: live desktop reached in 143 s, welcome center dismissed at 189 s, verified live desktop (desktop-final.png).
  • Split into 3 parts (<1900 MiB each) and verified with release-join.sh --verify-only.
• Unified Self-Healing Masterplan:
  • Consolidated all previous agent milestones and sub-repository plans into codex/unified-self-healing-master.

Verified (QEMU/WHPX, UEFI without Secure Boot, disposable disks, on this exact image)

• Boot to the desktop in 143 s.
• Welcome center dismissal and live desktop interaction in 189 s (desktop-final.png).
• Split parts integrity: 3 parts match SHA256SUMS and join back to the byte-exact original ISO.

Not verified / limits

• Not tested on physical hardware. Not signed (checksums only).
• Podman is not yet pre-installed in the default live squashfs; in-guest execution of hscl lab is pending guest package inclusion.
• Full Tails equivalence or anonymity is explicitly not claimed.
• See docs/KNOWN_LIMITATIONS.md for full disclosure.

Download and verify

The ISO is split into 3 parts of 1900 MiB (GitHub allows 2 GiB per file).

gh release download v0.1.3-alpha.0 -R timfromhcs/HSCL1
bash scripts/release-join.sh . --verify-only   # checks parts and whole image
bash scripts/release-join.sh .                 # joins to HSCL1-0.1.3-alpha.0-amd64.iso

A one-file ISO is also produced by the Bundle one-file ISO job of the "Verify release assets" workflow (Actions artifact HSCL1-v0.1.3-alpha.0-iso, kept 90 days).

Whole-image SHA256: 2e30b750a741fdbcf8ea3ffd0efe15a7ab36b9bcb559bb0defc1906ec7129fc3 (5488246784 bytes)

HSCL1 0.1.2-alpha.0

HSCL1 0.1.2-alpha.0 (pre-release, unsigned, VM-tested only)

HSCL1 = Hypercharged Supreme Computing Layout 1. Live/installer ISO built from commit d8f65332 of main (clean clone, git_dirty: false), base: Kubuntu 26.04.1 amd64 with KDE Plasma 6.6.
Made with love by hcsmedia. Not an official Ubuntu, Kubuntu, Kali or Tails product; no anonymity claim. See docs/CLAIMS.md and docs/KNOWN_LIMITATIONS.md.

What changed since 0.1.1-alpha.0

• Branding: HSCL1 boot splash (live and installed boot, also the disk-unlock screen), GRUB entries, HSCL1 welcome page, installer without upstream donation link, upstream website launchers removed, live user and host name hscl1.
• The blocking upstream "Try or Install Kubuntu" prompt is replaced: the live session starts the desktop directly; the installer stays on the desktop ("Install HSCL1").
• Build and test gates that found and fixed real defects during this round: the rebuilt initrd is now proven from the finished ISO, BOOT=casper default for the live initrd, /.disk/info carries the HSCL1 name (setting FLAVOUR in casper.conf broke the live boot and is not used).

Verified (QEMU/WHPX, UEFI without Secure Boot, disposable disks, on this exact image)

• Boot to the desktop without any click after 119 s.
• 3 consecutive runs of 28 in-guest checks, no errors, including live_identity (user and host hscl1) and / = 0:0 755.
• Fresh Erase-disk + LUKS2 install, reboot: wrong passphrase rejected, correct one unlocks, login, desktop; no keyfile in / or /boot; secret scan of logs clean; / is 0:0 755.

Not verified / limits

• Not tested on physical hardware. Not signed (checksums only). Secure Boot, BIOS/legacy boot, USB-stick boot, Hyper-V/VirtualBox/VMware, plain (unencrypted) install and non-US keyboard layouts for the disk-unlock prompt were not tested.
• Telemetry/egress audit not done: the Ubuntu base may contact Canonical/KDE services (installer connectivity check and mirror GeoIP, time sync, update checks); disclosed in docs/KNOWN_LIMITATIONS.md, not changed.
• Trademark/IP review pending for this Ubuntu derivative; package names and some strings of the base remain.
• No GPL written source offer is included yet (planned); the package manifest and repository at the tagged commit are the current record.
• SBOM covers the Rust CLI only (licences NOASSERTION).
• Live session language is English only (the replaced prompt used to offer a choice); the installer has its own language page.

Download and verify

The ISO is split into parts of 1500 MiB (GitHub allows 2 GiB per file).

gh release download v0.1.2-alpha.0 -R timfromhcs/HSCL1
scripts/release-join.sh   # joins the parts, verifies every part and the whole image against SHA256SUMS

A one-file ISO is also produced by the Bundle one-file ISO job of the "Verify release assets" workflow (Actions artifact HSCL1-v0.1.2-alpha.0-iso, kept 90 days).

Whole-image SHA256: 53d1218d4926d5722c06ea41682b928e7cec6fa912fe4accc6f7ba4f7c401e71 (5026480128 bytes)

HSCL1 0.1.1-alpha.0

HSCL1 0.1.1-alpha.0 (pre-release, unsigned, VM-tested only)

HSCL1 = Hypercharged Supreme Computing Layout 1. Live/installer ISO built from commit 425e6c0 (base: Kubuntu 26.04.1 amd64, KDE Plasma 6.6), from a clean clone, verify-image gates passed.
Made with love by hcsmedia. Not an official Kubuntu/Kali/Tails product; no anonymity claim. See docs/CLAIMS.md and docs/KNOWN_LIMITATIONS.md.

What changed since 0.1.0-alpha.0

• Security fix: the root directory / of installed systems was owned by uid 1000 (build-user leak into the squashfs root). Now 0:0 755; the build fails if it is not.
• Security fix: payload files were group/world-writable in the packages; modes are now normalised by content (scripts/ELF 0755, everything else 0644) and checked.
• KDE Connect is off by default (no listener on port 1716), autostart and D-Bus activation neutralised.
• Sandboxed baseline service (systemd-analyze security exposure 7.6 -> 2.5, measured).
• Workshop daemon: non-blocking port I/O with write deadline, reply size cap.
• hscl1 is also a program (same binary as hscl); hscl hw, hscl ai fit (GGUF memory estimate), hscl lab (rootless Podman spec generator with digest pin).

Verified (QEMU/WHPX, UEFI, no Secure Boot, disposable disks)

• Live session: 3 runs x 27 in-guest checks, no errors; / = 0:0 755.
• Fresh Erase + LUKS2 install, reboot: wrong passphrase rejected, correct one boots to the desktop; no keyfile in /, /boot or the initrd; marker passphrase not found in logs; ufw status prints no ownership warning; / = 0:0 755.

Not verified / limits

• Not tested on physical hardware. Not signed (checksums only). Secure Boot with encryption not tested (the unencrypted /boot and initrd are not integrity-protected).
• Open observation: one installed boot took about 12 minutes to reach the login screen (earlier boots of the same disk about 3 minutes); cause not established.
• Recovery-key flow, installer fault injection, privacy mode and Security Lab runtime are not part of this release.
• SBOM covers the Rust CLI only (SBOM-hscl-cli.spdx.json; licences NOASSERTION); the ISO package list is not yet included.

Download and verify

The ISO is split into parts of 1500 MiB (GitHub allows 2 GiB per file).

gh release download v0.1.1-alpha.0 -R timfromhcs/HSCL1
scripts/release-join.sh   # joins the parts, verifies every part and the whole image against SHA256SUMS

A one-file ISO is also produced by the Bundle one-file ISO job of the "Verify release assets" workflow (Actions artifact HSCL1-v0.1.1-alpha.0-iso, kept 90 days).

Whole-image SHA256: b817074aeb2fa30865c4660422e37a3942fc4e48a77b6a4646149bfcfacc4c19

HSCL1 0.1.0-alpha.0

WARNING (added 2026-11-06): this image has two security defects fixed in v0.1.1-alpha.0.

1. On installed systems the root directory / is owned by uid 1000 instead of root, so any process of the first user can rename or replace top-level directories (local privilege-escalation primitive).
2. Several packaged payload files are group/world-writable.
   Use v0.1.1-alpha.0 instead. Assets of this release are unchanged.

HSCL1 0.1.0-alpha.0 (pre-release, unsigned, VM-tested only)

Live/installer ISO built from commit 7a42ae3 (base: Kubuntu 26.04.1 amd64). Tested in QEMU/WHPX VMs (UEFI, BIOS, a test install to a virtual disk and reboot). Not tested on physical hardware. Not signed.
This image does not yet contain the later M1 changes (autotune at login, KDE Connect off by default); KDE Connect listens on port 1716 in this image.
Not an official Kubuntu/Kali/Tails product; no anonymity claim. See docs/CLAIMS.md and docs/KNOWN_LIMITATIONS.md.

Download and verify

The ISO is split into 4 parts (about 1.5 GB each, GitHub's per-file limit).
gh release download v0.1.0-alpha.0 -R timfromhcs/HSCL1
scripts/release-join.sh # joins the parts and verifies every part and the whole image against SHA256SUMS
Whole-image SHA256: 08649dc838e27d72f2eb5eb614a3f09f068f8c60a9b65bc78ea11cad8033fc8d