1. Overview
Small, auditable operating system whose configuration lives in plain-text files.
Category: OS & Infra.
2. Version and scope assessed
Version assessed: Pinned evidence d962f40cd0b4b974405c3cac59ec7417040c0533.
3. Overall determination
Computing determination
4. Principle profile
| Order | Principle | Finding |
|---|---|---|
| I | Sovereignty | Not assessed |
| II | Longevity | Not assessed |
| III | Locality | ✓ Meets |
| IV | Transparency and Control | Not assessed |
5. Fundamental requirements
| Requirement | Status |
|---|---|
| E1 Independent access to essential information | ✓ Pass |
| E2 Practicable exit and migration | ? Not Verified |
| E3 Independent interpretation and recovery | ? Not Verified |
| E4 Continuing authority and custody over already-created work | ✓ Pass |
| E5 Governability of consequential actions | ? Not Verified |
6. Evidence and verification
- E1: OpenBSD documents system configuration, install media, root-partition backup, and package inventory procedures. (source), confidence high
- E2: Configuration files, package lists, and install sets support rebuilding a system, but full application-data migration was not tested. (source), confidence medium
- E3: The pinned restore manual specifies a level-0 base followed by the necessary incremental backups, and a pristine filesystem for full -r recovery. It restores ownership/time/mode where possible and warns that active-filesystem incremental dumps may confuse restore. This is a concrete archive-chain dependency, not an /etc-only recovery method. (source), confidence medium
- E4: The operating system and its configuration are controlled locally by the operator. (source), confidence high
- E5: The manual distinguishes -t listing, selective extraction and full -r rebuilding, explicitly warning that -r is hazardous if used carelessly. Inspecting an archive listing therefore precedes a materially different rebuild operation; no blanket confirmation or automatic rollback is established. (source), confidence medium
- sovereignty: A positive Sovereignty finding requires established E1, E2 and E4 in the declared scope. The existing access/exit/custody record for OpenBSD does not establish all three minimums. The prior positive finding is withdrawn; recorded storage and portability strengths remain facts, not a verified failure. (source), confidence medium
- longevity: E3 is not established for OpenBSD's existing essential-record scope. The previous Longevity finding is replaced by Not assessed, not a verified failure or a positive placeholder. (source), confidence medium
- locality: The system runs locally and can be installed and upgraded from local media. (source), confidence high
- transparency: The positive control observations above do not yet establish whole-scope E5. The methodology requires that minimum before a positive Transparency and Control finding; the previous positive finding is therefore withdrawn to Not assessed, not changed to Does not meet. (source), confidence medium
- E3: The restore manual specifies full/incremental archive-chain requirements, pristine targets and possible active-filesystem inconsistencies. No complete archive/keydisk/application-data restoration with verified ownership/times/permissions is recorded for the declared system scope. (source), confidence medium
- E5: Listing, selective extraction and full rebuilding have different risk and authority requirements; the manual warns about hazardous full restore. Those descriptions do not establish effective target/privilege authorization, upgrade reversal or recourse after overwritten system/user state. (source), confidence medium
7. Migration and recovery
Native storage format: Plain-text configuration files in /etc.
Synchronization or runtime model: Local filesystem / Git.
Example export or inspection command (not verified against any particular version or data set): tar czf etc-backup.tgz /etc
8. Architectural strengths
Established strengths and their scope are recorded in the evidence and assessment findings on this page.
9. Architectural limitations
- Source/retained-input inspection only; no installation or application restore performed.
- An actual dump/restore chain, keydisk recovery, upgrade reversal and filesystem/metadata comparison remain untested.
10. Assessment findings and remaining work
Verification scenario: Recover configuration, package inventory, keys, services, and data on a clean host; verify offline operation and permission policies.
What may invalidate an overconfident claim: An archive of /etc alone is not a complete system or user-data recovery.
Documentation starting point: https://www.openbsd.org/faq/
Evidence update: 23 October 2026
- Resolved: The pinned restore manual specifies a level-0 base followed by the necessary incremental backups, and a pristine filesystem for full -r recovery. It restores ownership/time/mode where possible and warns that active-filesystem incremental dumps may confuse restore. This is a concrete archive-chain dependency, not an /etc-only recovery method. Source.
- Resolved: The manual distinguishes -t listing, selective extraction and full -r rebuilding, explicitly warning that -r is hazardous if used carelessly. Inspecting an archive listing therefore precedes a materially different rebuild operation; no blanket confirmation or automatic rollback is established. Source.
- Open: An actual dump/restore chain, keydisk recovery, upgrade reversal and filesystem/metadata comparison remain untested. E5 needs target/privilege and upgrade/restore authority, inspectable planned changes and appropriate independent backups/recourse.
Assessment follow-up: These bounded findings are incorporated into the evidence above. Eligibility and principle ratings are deliberately unchanged; their reconciliation and any blank-status fixes are deferred to the next pass. Reproduction details and retained inputs are in evidence/third-pass/batch-9/.
Human-readable criteria: Can an administrator reproduce, inspect, recover, and operate the system from user-controlled configuration and packages without a vendor-controlled permission path?
Rating reconciliation: 24 October 2026
E3 and E5 remain Not Verified for the existing declared scope. Longevity and Transparency and Control are Not assessed pending their required minimums. Sovereignty is also Not assessed because the required access/exit/custody minimums are not all established. This is a targeted evidence decision, not a finding that the product fails. Existing E1, E4 and Locality findings were not re-certified.
Remaining: An actual dump/restore chain, keydisk recovery, upgrade reversal and filesystem/metadata comparison remain untested. E5 needs target/privilege and upgrade/restore authority, inspectable planned changes and appropriate independent backups/recourse.
Next without installing locally: Inspect an externally generated synthetic dump/incremental/keydisk packet with expected files/metadata and precise version/hardware assumptions; seek same-version restore/upgrade-control and recovery records.
The individual decision and provenance are retained in evidence/rating-reconciliation/batch-9/. Overall: Insufficient evidence.
Contribute verification evidence for OpenBSD
Have you tested clean-machine restoration, format migration, or failure rollback for OpenBSD? We welcome reproducible laboratory logs, synthetic test fixtures, and independent assessments to resolve open findings.
Read the evaluation protocol · Submit verification records on GitHub
Individually reconciled in rating batch 9 on 24 October 2026. E3/E5 remain Not Verified for explicit missing coverage; dependent unsupported findings corrected. Previously resolved questions are retained, not counted again. E1/E4/Locality were not re-certified by this targeted review. The assessment procedure is described in the methodology.