Proposal: OGC attestation profile as an integration target for anti-cheat vendors

[Dagnasty13]

Opening this as a discussion rather than an issue because it's a scoping question. tldr: would OGC consider publishing a formal attestation profile that anti-cheat vendors could target as an alternative to kernel-level anti-cheat on Linux?

OGC already provides what no individual distro could: a single signed kernel baseline used across Bazzite, Nobara, ChimeraOS, PikaOS, Playtron, and others. That's the missing piece for trust-establishing protocols like TPM remote attestation.

Microsoft shipped exactly this pattern for BO7's anti-cheat in late 2025 (verifying boot state via Azure Attestation). Andrew Moore's writeup last August showed the same architecture is achievable in Linux userspace with TPM2_Quote against PCR banks.

What OGC could ship:

1. An attestation profile: a spec defining which PCRs are measured, what's in the event log, and what guarantees an OGC-attested boot provides (signed kernel from registered keys, no unsigned modules loaded, IMA policies enforced, etc.).
2. A reference verification library: so anti-cheat vendors don't have to implement TCG cryptographic operations from scratch.
3. Coordinated vendor outreach: a pitch to Riot, BattlEye, EAC: "here is the integration target."

Why it's high-leverage?:
This shifts the negotiating position. Right now individual Linux users get told "we'd have to support 500 distros." OGC reframes that to "here's one signed target with cryptographic verification." The macOS embedded Vanguard precedent shows Riot is willing to trust an alternative kernel-security model when the platform provides cryptographic guarantees, OGC could be that platform on Linux.

Questions

• Is this within OGC's intended scope, or is the focus strictly the upstream kernel / gamescope / input stack?
• If in scope, is anyone already working on it? I haven't found it in the repos.
• If not in scope, would it be welcome as a separate community project that builds on OGC as a foundation?

Happy to be told this is out of scope or premature. Mostly want to make sure it's been considered.

[pastaq]

It's definitely something on the radar. Right now the kernel is in a fairly immature state. Before we take on anything of that caliber we're going to need to get to a stable target and begin shipping on all of our member project distros I think. Once we have that we'll be in a better position to build out a framework and begin working on relationships with vendors.