hekate/microsoft-systemd-findings-public

hekate 5850d38f9a Public release, findings

2026-03-23 06:01:08 +00:00

4.4 KiB

Raw Permalink Blame History

Linux Distribution Responses to Age Verification

Compliance Tracker (as of March 2026)

Upstream: systemd

Status: MERGED (birthDate field in userdb)
PR #40954: Luca Boccassi (Microsoft) merged it on March 18, 2026
Revert PR #41179: Lennart Poettering (Amutable) closed it on March 19, 2026
Cites: AB-1043, CO SB26-051, Brazil Lei 15.211/2025

xdg-desktop-portal

Status: Draft PR open (PR #1922 by David Edmundson, KDE)
Related spec proposal: freedesktop.org CLOSED it (March 10, 2026)
Approach: Age range portal - apps submit thresholds, receive brackets (not exact dates)
Modeled after: Apple's DeclaredAgeRange API

Distributions: Implementing or Considering

Ubuntu / Canonical

Status: WATCHING - "reviewing internally with legal counsel"
VP Jon Seager publicly distanced the company: "no concrete plans"
PRs submitted by Taylor: #1338, #1339 to ubuntu-desktop-provision (Draft, not merged)
Canonical is the most likely major distro to implement due to commercial exposure in US/California

Fedora / Red Hat

Status: EXPLORING
Proposed approach: local configuration file, local D-Bus API, no telemetry
No mechanism formally adopted
Red Hat has commercial customers with compliance requirements

Distributions: Actively Resisting

Artix Linux

Status: REFUSED
Statement: "We'll NEVER require any verification or identification from the user"
Artix is a systemd-free distribution (uses OpenRC/runit/s6)

System76 / Pop!_OS

Status: OPPOSED
CEO published blog opposing mandates as technically ineffective
Actively lobbying Colorado legislators to exclude open source software from SB26-051
Jeremy from System76 raised jurisdictional concerns in the systemd PR

GrapheneOS

Status: REFUSED
Statement: remaining usable without personal information or accounts

Ageless Linux

Status: ACTIVE RESISTANCE
Purpose-built to counter age verification infrastructure
Registered as OS under AB-1043 in "knowing, intentional noncompliance"
Provides tools: drop-in replacement daemons returning "age unknown," installer preseeds skipping age collection, post-install removal scripts, and one-command reversion across all affected distributions
Tracks all distro compliance status at agelesslinux.org/distros.html
Tracks state laws at agelesslinux.org/map.html

Omarchy Linux

Status: REFUSED - rejected compliance outright

Adenix GNU/Linux

Status: REFUSED - will not implement age checks

Distributions: Excluding Jurisdictions

Arch Linux 32

Status: Blocked access from Brazilian and California IP addresses (March 17, 2026)
Modified COPYRIGHT to exclude affected jurisdictions

MidnightBSD

Status: Blocking California IP addresses
Modified copyright to exclude affected jurisdictions

DB48X (calculator OS)

Legal notice: "DB48X is probably an operating system under these laws. However, it does not, cannot and will not implement age verification."

Distributions: Undecided / Silent

Debian

Active mailing list discussion (debian-devel, March 2026)
No official position
As upstream for Ubuntu/Mint/Pop!_OS, Debian's decision will cascade to those distributions

Arch Linux

PR #4290 (archinstall): Maintainer Torxed locked it
Awaiting official organizational stance and legal counsel
No centralized mechanisms for enforcement

NixOS

No official response (Dylan Taylor is a NixOS org member)

SteamOS / Valve

No public position

Gentoo

No official response

Key Dynamic

Distributions face four options:

Implement - adds surveillance infrastructure, satisfies contested law
Refuse - risk $2,500-$7,500 per "affected child" penalties (if enforceable)
Exclude jurisdictions - IP blocking or copyright restrictions
Wait for legal challenges - CCIA has successfully blocked similar laws in Texas and Utah

Most distributions are choosing option 4 (wait) while a few small distros are choosing options 2-3 as statements of principle.

Sources