Proof: NULLos is an operating system of its own

For anyone who has doubts: NULLos is not a renamed Linux and not a customised distribution. This page explains how to check that yourself, what we have checked – and where the limits of such a proof lie.

1. Check the download yourself available

A Linux gives itself away immediately: the kernel contains “Linux version …”, programs carry identifiers of glibc or musl, kernel modules their GPL licence. With freely available tools (mtools, strings, binwalk, syft) anyone can examine the image from the download themselves. The commands for macOS and Linux:

# 1. Download the image and checksums from nullos.de/#download, verify the checksum
shasum -a 256 -c SHA256SUMS --ignore-missing      # Linux: sha256sum -c --ignore-missing SHA256SUMS

# 2. Extract the bootloader, kernel and program archive from the partition (mtools)
export MTOOLS_SKIP_CHECK=1
I=nullos-0.3.5-x86_64.img@@1048576
mcopy -i $I ::/EFI/BOOT/BOOTX64.EFI BOOTX64.EFI
mcopy -i $I ::/nullos/nk.elf nk.elf
mcopy -i $I ::/nullos/init.img init.img
file BOOTX64.EFI nk.elf init.img
mkdir init && tar -xf init.img -C init

# 3. Search for identifiers of Linux, GNU, glibc, musl, BusyBox, systemd, GRUB and compilers
{ strings -a nk.elf BOOTX64.EFI; find init -type f -exec strings -a {} +; } | grep -E -c \
  'Linux version [0-9]|GLIBC_|GNU C Library|musl libc|BusyBox v|GCC: \(|clang version|license=|__ksymtab|systemd [0-9]{3}|GNU GRUB'

# 4. Search for embedded foreign formats and known software packages
binwalk nk.elf BOOTX64.EFI
syft dir:init

Our output for 0.3.5: file reports PE32+ (UEFI), ELF 64-bit static and tar; the search in step 3 returns 0; binwalk finds only the ELF program, or a SHA-256 table in the bootloader; syft reports “No packages discovered”. For comparison: on a Linux kernel, step 3 immediately finds the text “Linux version”.

2. Timestamp on the source code in preparation, from 0.4

For every release, a checksum (SHA-256) is computed over the entire source tree and anchored in the Bitcoin blockchain with OpenTimestamps. The code itself stays secret. If it is disclosed later, anyone can prove that exactly this code already existed at that time. This proves “existed back then” – not that the image was built from it bit for bit, because the images are not (yet) built reproducibly.

3. Spot check on request not at present

The idea: a sceptic picks any location in the kernel, NULLos discloses exactly that function, and when compiled it yields the same bytes. That is not possible today: the images deliberately contain no symbols (protection against decompilation), a symbol map would make attacks easier, and the result would only be bit-identical with exactly the same toolchain.

4. Proof within the system itself not at present

NULLos has its own C compiler, which compiles itself. Putting parts of the sources into the image so that they can be recompiled in NULLos and compared is possible – but it contradicts the decision not to ship a public SDK or a compiler in the image.

5. Independent auditor conceivable

An independent party – such as a university or an expert assessor – sees the entire source code under confidentiality and confirms: own code, no GPL. This has not been agreed yet.

6. Outlook: compiling with proof of origin research

Researchers are working on running the compiler in a verifiable environment that also delivers a mathematical proof of which source code a program was built from (e.g. arXiv 2602.11887, February 2026). This is not yet ready for practical use.

What does not come from NULLos itself – honestly

• Build tools: the kernel and programs are currently compiled on the Mac with LLVM clang/lld. NULLos has its own C compiler; it compiles itself, but does not yet build the release images.
• Fonts: Inter, JetBrains Mono, Fredoka, Chakra Petch and Bangers under the SIL Open Font License 1.1, converted into our own font format; the licence texts are included.
• Root certificates: the 117 certificates of the Mozilla list (/sys/ssl/cert.pem) – data, not program code.
• Data tables in the Flitz browser from public standards and lists, such as the HTML entities; later versions will add more tables (Brotli dictionary, Public Suffix List, Unicode and CJK data).
• Two standard names in the kernel: “Microsoft Windows NT” (the name that firmware queries via ACPI) and “linux,phandle” (the name of a device tree property) – names from standards, not code.
• Some hardware will later need driver firmware or third-party packages (such as Wi-Fi). These will come as loadable packages, not in the image.

No third-party program code under the GPL is known.

Incidentally, every program in NULLos carries its own section .nullos.ausweis: its ID card, which defines what it is allowed to do. No Linux program has anything like that.