# Spare-laptop validation checklist

Run after installing a fresh veilor-os ISO. Each item should pass
before the build is considered green.

## Install flow

- [ ] Anaconda **only** prompts for LUKS passphrase — no account wizard,
      no initial-setup screen
- [ ] Install completes without `%post` errors (check `/var/log/veilor-install.log`)
- [ ] Reboot succeeds, USB removed cleanly

## First boot

- [ ] LUKS prompt appears at boot
- [ ] TTY1 shows veilor-os banner + password prompt
- [ ] Password rejection on weak input (try `password123` — should fail)
- [ ] Password set succeeds with strong input
- [ ] SDDM starts after password set
- [ ] `admin@veilor-os` shell prompt visible after first login
- [ ] `veilor-firstboot.service` shows `inactive (dead)` and `disabled`
      after first run

## Identity

- [ ] `passwd -S root` reports `L` (locked)
- [ ] `getent passwd | wc -l` shows base + admin only
- [ ] `id admin` shows `groups=...,wheel`

## Branding

- [ ] `hostnamectl` reports `veilor-os`
- [ ] `cat /etc/os-release` shows `NAME="veilor-os"` and `ID=veilor`
- [ ] `grep -ri onyx /etc /usr/local /usr/share/fonts` returns zero
- [ ] `grep -ri '192\.168\.0\.\|admin@gmail\|fedora\.local' /etc /usr/local` returns zero

## Theme

- [ ] KDE color scheme shows `veilor-black` in System Settings
- [ ] Konsole renders in DuckSans (`fc-match sans-serif` returns
      `DuckSans` if the font was vendored)
- [ ] Background is pure black (#000000), not Breeze dark grey

## Power

- [ ] `veilor-power status` runs without sudo, shows current profile
- [ ] `veilor-power save` switches to `veilor-powersave`
- [ ] `veilor-power perf` switches to `veilor-performance`
- [ ] Unplugging AC auto-switches to `veilor-powersave` (udev rule)
- [ ] Plugging AC auto-switches to `veilor-performance`

## Hardening — services

- [ ] `systemctl is-active fail2ban` → active
- [ ] `systemctl is-active usbguard` → active
- [ ] `systemctl is-active auditd` → active
- [ ] `systemctl is-active firewalld` → active
- [ ] `systemctl is-active tuned` → active
- [ ] `systemctl is-active chronyd` → active
- [ ] `systemctl is-active sshd` → active
- [ ] `systemctl is-active cups` → inactive / not-found
- [ ] `systemctl is-active avahi-daemon` → inactive / not-found
- [ ] `systemctl is-active bluetooth` → inactive
- [ ] `systemctl is-active veilor-modules-lock` (after 30s) → active

## Hardening — kernel/sysctl

- [ ] `getenforce` → `Enforcing`
- [ ] `mokutil --sb-state` → `SecureBoot enabled`
- [ ] `sysctl kernel.yama.ptrace_scope` → `2`
- [ ] `sysctl kernel.kptr_restrict` → `2`
- [ ] `sysctl fs.suid_dumpable` → `0`
- [ ] `sysctl dev.tty.ldisc_autoload` → `0`
- [ ] `sysctl kernel.modules_disabled` (after 30s post graphical) → `1`

## Hardening — network

- [ ] `firewall-cmd --get-default-zone` → `drop`
- [ ] `firewall-cmd --zone=drop --list-services` → `ssh`
- [ ] `resolvectl status` shows DNSSEC + DoT, LLMNR off
- [ ] `chronyc sources -v` shows NTS-authenticated peers

## Hardening — SSH

- [ ] `sshd -T | grep -E 'permitrootlogin|passwordauth|allowusers|x11forwarding'`
      shows: `permitrootlogin no`, `passwordauthentication no`,
      `allowusers admin`, `x11forwarding no`

## Disk

- [ ] `lsblk -f` shows LUKS2 on the main partition
- [ ] `cryptsetup luksDump /dev/...` shows argon2id, aes-xts-plain64
- [ ] `swapon` shows `zram` device, no disk swap

## SELinux module

- [ ] `semodule -l | grep veilor-systemd` → present
- [ ] No SELinux denials in `ausearch -m AVC -ts boot` related to
      `systemd_modules_load_t`

## USBGuard

- [ ] `systemctl status usbguard` → active
- [ ] `wc -l /etc/usbguard/rules.conf` → 0 (empty allowlist by design)
- [ ] After `sudo usbguard generate-policy > /etc/usbguard/rules.conf`
      and restart, all currently-connected USB devices remain
      functional

## Findings

Log issues and fixes here:

| Date | Item | Issue | Fix in kickstart? |
|------|------|-------|-------------------|
|      |      |       |                   |