Which Linux platforms Pavois has actually proved
9 of 9 supported systems have been through a full clean-VM campaign against the rule base as it stands today. Every row is generated from those campaigns by the same check that gates a release: a system nobody proved cannot appear as proved.
| Platform | State | Last campaign | Grade before → after | Pavois |
|---|---|---|---|---|
| Debian 12debian 12.15 | VERIFIED | 2026-09-210 days ago · workstation | E→D509/542 (94%) | dev |
| Debian 13debian 13.7 | VERIFIED | 2026-09-210 days ago · workstation | E→D512/544 (94%) | dev |
| Ubuntu 22.04ubuntu 22.04 | VERIFIED | 2026-09-210 days ago · workstation | E→D488/526 (93%) | dev |
| Ubuntu 24.04ubuntu 24.04 | VERIFIED | 2026-09-210 days ago · workstation | E→D532/567 (94%) | dev |
| Ubuntu 26.04ubuntu 26.04 | VERIFIED | 2026-09-210 days ago · workstation | E→E534/570 (94%) | dev |
| RHEL 8 / Rocky 8 / AlmaLinux 8almalinux 8.10 | VERIFIED | 2026-09-210 days ago · workstation | E→E535/600 (89%) | dev |
| RHEL 9 / Rocky 9 / AlmaLinux 9almalinux 9.8 | VERIFIED | 2026-09-210 days ago · workstation | E→D580/626 (93%) | dev |
| RHEL 10 / Rocky 10 / AlmaLinux 10almalinux 10.2 | VERIFIED | 2026-09-210 days ago · workstation | E→E549/605 (91%) | dev |
| Fedorafedora 43 | VERIFIED | 2026-09-210 days ago · workstation | E→E569/622 (91%) | dev |
Freshness window: 30 days. Past it, a passing campaign turns STALE even when the rule base has not moved: the target’s own packages and kernel have, and no digest of ours can see that.
The Fedora corpus targets no release number: the norms reference records that no CIS benchmark exists for Fedora and that its mappings are inherited from RHEL 9. A verdict there covers the version actually measured, the one named under the label, not the distribution as a whole.
What each state means
The last campaign passed, on this exact rule base, inside the freshness window.
The last campaign ran and a required stage failed. An older green run does not override it.
It passed, but on a different rule base, or longer ago than the freshness window allows.
A campaign exists and does not say what it proved: interrupted, or silent about which rule base it measured.
The rule corpus exists, curated and statically validated. No clean-VM campaign has ever run. Not a weaker pass: a different claim.
Nothing to go on. Missing evidence never reads as a pass.
Why this page exists
For a hardening tool, release velocity is a poor maturity signal. A good one is what the campaigns have actually demonstrated, machine by machine, and what nobody has demonstrated yet. Both are published here.
A campaign is a clean VM created for it: scan the stock machine, plan, apply, reboot, a second pass re-planned from the current state, reboot, scan again, diff, then an evidence bundle that is verified. A container cannot stand in for it: 259 of the controls are meaningless without a kernel of your own.
The raw data behind this page is served as is, with machine identity removed: platform-matrix.json.