[cperciva]

There are some systems (generally speaking, ones which were installed in the past few weeks) for which we know exactly what files should be installed and what their SHA256 hashes are. Thoroughly audited means "every single bit is correct".

[0x0]

Thanks for clarifying.

I assume if they had root though, they could theoretically install a rootkit in the MBR. Did you SHA256 verify the MBR too? :)

[cperciva]

I didn't (I'm not involved in cluster management) but I suspect that it was done by someone.