diff options
| author | stefan <stefan@i3mint.local> | 2026-02-24 20:36:44 +0100 |
|---|---|---|
| committer | stefan <stefan@i3mint.local> | 2026-02-24 20:36:44 +0100 |
| commit | 2993aae60e019804e249de3f56e48eca365723df (patch) | |
| tree | b894165e436a60faf4c70db44a9eb483c6fa557b | |
| parent | 130b63ade620f4a2619233feb3e5e4ea56d58983 (diff) | |
Risk/Security Overlay im Business/Motivation Layer angefangen
14 files changed, 240 insertions, 2 deletions
diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png Binary files differindex fb17d9f..7270246 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png Binary files differindex 66befaa..6ef113d 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png Binary files differindex c5a7dac..ca49d75 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png Binary files differindex daac44f..87b48d4 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png Binary files differindex fb7b8c4..8efef97 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png Binary files differnew file mode 100644 index 0000000..c550c51 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.puml new file mode 100644 index 0000000..f183b2a --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.puml @@ -0,0 +1,135 @@ +@startuml +!include <archimate/Archimate> + +left to right direction +skinparam rectangle { + BackgroundColor #FFF6F6 + BorderColor #550000 +} +skinparam note { + BackgroundColor #FFFFCC +} + +' makes Rel_ green +skinparam ArrowFontColor<<greenRel>> green + + +' Anchor as SVG sprite +sprite $anchor <svg viewBox="0 0 204.851 204.851"> + <path fill="#000000" d="M139.518,128.595l16.834,16.336c0,0-20.644,29.877-42.725,30.473 + c0.479,0,0.117-84.092,0.039-104.472c14.694-4.797,25.402-18.182,25.402-34.117 + c0-20.009-16.697-36.218-37.273-36.218c-20.615,0-37.312,16.209-37.312,36.208 + c0,15.671,10.376,28.929,24.748,33.961l0.098,104.277c-26.643-1.837-42.061-27.474-42.061-27.474 + l17.997-17.41L0,120.505l9.887,63.301l17.362-16.795c15.036,12.105,32.017,37.244,72.876,37.244 + c51.332-1.309,63.184-28.939,76.344-39.804l18.993,18.514l9.389-63.907L139.518,128.595z + M82.558,36.208c0-10.298,8.608-18.661,19.218-18.661s19.257,8.363,19.257,18.661 + c0,10.327-8.647,18.681-19.257,18.681S82.558,46.535,82.558,36.208z"/> +</svg> + + + + +right header += Threat Model - Reproducible Builds according to SLSA Level 4 +using independent GnuPG signatures and keys +as well as Reproducible Builds according to SLSA Level 4 +corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD += %date("yyyy-MM-dd hh:mm") +endheader + +right footer += Advantages: +* Consistency between source code and binaries through Reproducible Builds +* No single trust anchor -> at least 2 independent builders +* Subsequent manipulation detectable through checksums in the Git Transparency Log +* Insider attacks made more difficult through multiple signatures +* Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps +* Each box is a trust boarder +endfooter + + + +caption += Threat Model - Reproducible Builds according to SLSA Level 4 +endcaption + +actor "Downloader\n(Verifier)" as User #Green +actor "Internet\n(Insecure)" as Net +actor "NTP Server 1" as NTP1 +actor "NTP Server 2 " as NTP2 +actor "Attacker\n(Insider / External)" as Attacker #Red +'actor "Trusted Commiter 1" as Committer1 +'actor "Trusted Commiter 2" as Committer2 + +actor "Keyserver 1" as Keyserver1 +actor "Keyserver 2" as Keyserver2 + + +rectangle "Maintainer" { + rectangle "Source Code\n(in Git) <$anchor{scale=0.1,color=green}>" as Source + rectangle "Git Release Tag\n(GnuPG-signed) <$anchor{scale=0.1,color=green}>" as Tag +} + +rectangle "Independent build pipelines\n(at least 2)" { + rectangle "Pipe A <$anchor{scale=0.1,color=lightgreen}>b1" as B1 + rectangle "Pipe B <$anchor{scale=0.1,color=lightgreen}>b2" as B2 +} + +Motivation_Goal(TAb, "combined Trust") +' Rel_Aggregation(TAb, B1, "combines", $lineColor="green", $textColor="green") +TAb o-- B1 : <color:green>combines TA</color> +TAb o-- B2 : <color:green>combines TA</color> + + + + + + +rectangle "Download artefacts" { + rectangle "Artefact A\n(Checksum)" as A1 + rectangle "Artefact B\n(Checksum)" as A2 +} + +rectangle "Git Transparency Log\n(tamper-hardened) <$anchor{scale=0.1,color=green}>" as Log +rectangle "Distributed ledger with\n Merkle Tree records\n (Blockchain) <$anchor{scale=0.1,color=green}>" as Ledger + +rectangle "Operational environment\n(of the downloader)" { + rectangle "Known public signing keys\n(obtained from at least\n 2 independent trust paths)" as Keys + rectangle "Rebuild pipeline\n(Reproducible)" as Rebuild + rectangle "Verification policy\n (organisational measure\n from BSI TR)" as Policy +} + +NTP1 --> Log : Time +NTP2 --> Log : Time + +Keyserver1 --> Keys : retrieves +Keyserver2 --> Keys : retrieves + +Source --> B1 +Source --> B2 + +B1 --> A1 +B2 --> A2 + +A1 --> Log : Checksum +A2 --> Log : Checksum + +A1 --> Ledger : Checksum +A2 --> Ledger : Checksum + +Tag --> Source + +Net --> User +Attacker -[#Red]-> B1 : compromises +Attacker -[#Red]-> Net : controls +Attacker -[#Red]-> Tag : compromises private key +'// Commiter1 --> Tag : generates valid signature +'// Commiter2 --> Tag : generates valid signature + + +User --> Rebuild +User --> Log +Keys --> Policy +Rebuild --> Policy +Policy --> User : ACCEPT / REJECT +@enduml diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg new file mode 100644 index 0000000..a1071dc --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg @@ -0,0 +1 @@ +<?plantuml 1.2026.1?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" data-diagram-type="DESCRIPTION" height="854px" preserveAspectRatio="none" style="width:1654px;height:854px;background:#FFFFFF;" version="1.1" viewBox="0 0 1654 854" width="1654px" zoomAndPan="magnify"><defs/><g><g class="header" data-source-line="31"><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="422.9104" x="1217.4175" y="14.9659">Threat Model - Reproducible Builds according to SLSA Level 4</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="220.4198" x="1419.9081" y="29.7579">using independent GnuPG signatures and keys</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="262.5298" x="1377.7982" y="43.3779">as well as Reproducible Builds according to SLSA Level 4</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="414.2194" x="1226.1085" y="56.9979">corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD</text><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="112.6295" x="1527.6984" y="74.8938">2026-02-24 12:20</text></g><!--cluster Maintainer--><g class="cluster" data-qualified-name="Maintainer" data-source-line="67" id="ent0009"><rect fill="#FFF6F6" height="107" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="468.73" x="306.8284" y="472.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="66.2045" x="508.0911" y="487.8239">Maintainer</text></g><!--cluster Independent build pipelines\n(at least 2)--><g class="cluster" data-qualified-name="Independent build pipelines.n.at least 2." data-source-line="72" id="ent0012"><rect fill="#FFF6F6" height="179" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="183" x="904.6384" y="512.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="167.9652" x="912.1558" y="527.8239">Independent build pipelines</text><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="62.7964" x="964.7401" y="544.168">(at least 2)</text></g><!--cluster Download artefacts--><g class="cluster" data-qualified-name="Download artefacts" data-source-line="87" id="ent0018"><rect fill="#FFF6F6" height="191" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="172" x="1217.9884" y="521.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="117.5048" x="1245.236" y="536.8239">Download artefacts</text></g><!--cluster Operational environment\n(of the downloader)--><g class="cluster" data-qualified-name="Operational environment.n.of the downloader." data-source-line="95" id="ent0023"><rect fill="#FFF6F6" height="224" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="505.16" x="586.8284" y="86.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="152.7131" x="763.0518" y="101.8239">Operational environment</text><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="118.2248" x="780.296" y="118.168">(of the downloader)</text></g><!--entity Source--><g class="entity" data-qualified-name="Maintainer.Source" data-source-line="68" id="ent0010"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="619.5584" y="508.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.7483" x="654.1281" y="531.2339">Source</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="692.8764" y="531.2339"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="28.9922" x="695.9964" y="531.2339">Code</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.1121" x="656.9648" y="550.0647">(in</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="671.0769" y="550.0647"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="19.7641" x="674.1969" y="550.0647">Git)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="9.3601" x="693.9611" y="550.0647">   </text><path d="M716.1997,546.6202 L717.7536,548.1282 C717.7536,548.1282 715.848,550.886 713.8098,550.941 C713.854,550.941 713.8206,543.1787 713.8134,541.2975 C715.1698,540.8547 716.1582,539.6191 716.1582,538.1482 C716.1582,536.3012 714.6169,534.805 712.7176,534.805 C710.8147,534.805 709.2734,536.3012 709.2734,538.1473 C709.2734,539.5938 710.2312,540.8177 711.5579,541.2822 L711.5669,550.9077 C709.1075,550.7382 707.6843,548.3717 707.6843,548.3717 L709.3456,546.7646 L703.3211,545.8734 L704.2338,551.7166 L705.8364,550.1663 C707.2244,551.2837 708.7919,553.6042 712.5635,553.6042 C717.3018,553.4834 718.3958,550.9329 719.6106,549.93 L721.3638,551.639 L722.2305,545.7399 L716.1997,546.6202 M710.9419,538.0922 C710.9419,537.1416 711.7365,536.3696 712.7159,536.3696 C713.6952,536.3696 714.4934,537.1416 714.4934,538.0922 C714.4934,539.0454 713.6952,539.8166 712.7159,539.8166 C711.7365,539.8166 710.9419,539.0454 710.9419,538.0922" fill="#007F00"/></g><!--entity Tag--><g class="entity" data-qualified-name="Maintainer.Tag" data-source-line="69" id="ent0011"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="322.8284" y="508.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="16.1641" x="349.562" y="531.2339">Git</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="365.7262" y="531.2339"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.3443" x="368.8462" y="531.2339">Release</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="412.1905" y="531.2339"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="20.7841" x="415.3105" y="531.2339">Tag</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="88.4166" x="334.5246" y="550.0647">(GnuPG-signed)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="9.3601" x="422.9413" y="550.0647">   </text><path d="M445.1799,546.6202 L446.7338,548.1282 C446.7338,548.1282 444.8282,550.886 442.79,550.941 C442.8342,550.941 442.8008,543.1787 442.7936,541.2975 C444.1499,540.8547 445.1384,539.6191 445.1384,538.1482 C445.1384,536.3012 443.5971,534.805 441.6978,534.805 C439.7949,534.805 438.2536,536.3012 438.2536,538.1473 C438.2536,539.5938 439.2114,540.8177 440.538,541.2822 L440.5471,550.9077 C438.0877,550.7382 436.6645,548.3717 436.6645,548.3717 L438.3258,546.7646 L432.3013,545.8734 L433.214,551.7166 L434.8166,550.1663 C436.2046,551.2837 437.772,553.6042 441.5436,553.6042 C446.282,553.4834 447.376,550.9329 448.5908,549.93 L450.344,551.639 L451.2107,545.7399 L445.1799,546.6202 M439.9221,538.0922 C439.9221,537.1416 440.7167,536.3696 441.696,536.3696 C442.6754,536.3696 443.4736,537.1416 443.4736,538.0922 C443.4736,539.0454 442.6754,539.8166 441.696,539.8166 C440.7167,539.8166 439.9221,539.0454 439.9221,538.0922" fill="#007F00"/></g><!--entity B1--><g class="entity" data-qualified-name="Independent build pipelines.n.at least 2..B1" data-source-line="73" id="ent0013"><rect fill="#FFF6F6" height="38.8308" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="925.6384" y="637.5758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.5042" x="958.3348" y="662.8905">Pipe</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="982.839" y="662.8905"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.6681" x="985.959" y="662.8905">A</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="993.627" y="662.8905">  </text><path d="M1012.7457,659.4461 L1014.2996,660.954 C1014.2996,660.954 1012.394,663.7119 1010.3557,663.7669 C1010.4,663.7669 1010.3665,656.0046 1010.3593,654.1234 C1011.7157,653.6806 1012.7041,652.445 1012.7041,650.9741 C1012.7041,649.1271 1011.1629,647.6309 1009.2636,647.6309 C1007.3606,647.6309 1005.8194,649.1271 1005.8194,650.9732 C1005.8194,652.4197 1006.7772,653.6436 1008.1038,654.108 L1008.1128,663.7336 C1005.6535,663.564 1004.2303,661.1976 1004.2303,661.1976 L1005.8916,659.5905 L999.8671,658.6993 L1000.7797,664.5425 L1002.3824,662.9922 C1003.7703,664.1096 1005.3378,666.4301 1009.1094,666.4301 C1013.8477,666.3093 1014.9418,663.7588 1016.1565,662.7559 L1017.9097,664.4649 L1018.7764,658.5658 L1012.7457,659.4461 M1007.4878,650.9181 C1007.4878,649.9675 1008.2824,649.1955 1009.2618,649.1955 C1010.2412,649.1955 1011.0394,649.9675 1011.0394,650.9181 C1011.0394,651.8713 1010.2412,652.6425 1009.2618,652.6425 C1008.2824,652.6425 1007.4878,651.8713 1007.4878,650.9181" fill="#8FED8F"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.2441" x="1018.6979" y="662.8905">b1</text></g><!--entity B2--><g class="entity" data-qualified-name="Independent build pipelines.n.at least 2..B2" data-source-line="74" id="ent0014"><rect fill="#FFF6F6" height="38.8308" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="925.6384" y="563.5758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.5042" x="958.2688" y="588.8905">Pipe</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="982.773" y="588.8905"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.8" x="985.893" y="588.8905">B</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="993.693" y="588.8905">  </text><path d="M1012.8117,585.4461 L1014.3656,586.954 C1014.3656,586.954 1012.46,589.7119 1010.4217,589.7669 C1010.4659,589.7669 1010.4325,582.0046 1010.4253,580.1234 C1011.7817,579.6806 1012.7701,578.445 1012.7701,576.9741 C1012.7701,575.1271 1011.2289,573.6309 1009.3295,573.6309 C1007.4266,573.6309 1005.8854,575.1271 1005.8854,576.9732 C1005.8854,578.4197 1006.8431,579.6436 1008.1698,580.108 L1008.1788,589.7336 C1005.7195,589.564 1004.2963,587.1976 1004.2963,587.1976 L1005.9575,585.5905 L999.9331,584.6993 L1000.8457,590.5425 L1002.4484,588.9922 C1003.8363,590.1096 1005.4038,592.4301 1009.1754,592.4301 C1013.9137,592.3093 1015.0078,589.7588 1016.2225,588.7559 L1017.9757,590.4649 L1018.8424,584.5658 L1012.8117,585.4461 M1007.5538,576.9181 C1007.5538,575.9675 1008.3484,575.1955 1009.3278,575.1955 C1010.3072,575.1955 1011.1054,575.9675 1011.1054,576.9181 C1011.1054,577.8713 1010.3072,578.6425 1009.3278,578.6425 C1008.3484,578.6425 1007.5538,577.8713 1007.5538,576.9181" fill="#8FED8F"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.2441" x="1018.7639" y="588.8905">b2</text></g><!--entity A1--><g class="entity" data-qualified-name="Download artefacts.A1" data-source-line="88" id="ent0019"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="1233.9884" y="644.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="44.6763" x="1276.2562" y="667.4839">Artefact</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1320.9325" y="667.4839"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.6681" x="1324.0525" y="667.4839">A</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="65.5205" x="1271.2281" y="683.828">(Checksum)</text></g><!--entity A2--><g class="entity" data-qualified-name="Download artefacts.A2" data-source-line="89" id="ent0020"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="1233.9884" y="556.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="44.6763" x="1276.1902" y="579.4839">Artefact</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1320.8665" y="579.4839"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.8" x="1323.9865" y="579.4839">B</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="65.5205" x="1271.2281" y="595.828">(Checksum)</text></g><!--entity Keys--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Keys" data-source-line="96" id="ent0024"><rect fill="#FFF6F6" height="69.0323" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="173.4571" x="602.8284" y="138.4758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.9523" x="615.0484" y="161.3039">Known</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="654.0006" y="161.3039"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="34.1282" x="657.1207" y="161.3039">public</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="691.2489" y="161.3039"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="41.5323" x="694.3689" y="161.3039">signing</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="735.9012" y="161.3039"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.0442" x="739.0212" y="161.3039">keys</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="53.9644" x="625.2424" y="177.648">(obtained</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="679.2068" y="177.648"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.5642" x="682.3268" y="177.648">from</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="709.891" y="177.648"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="11.0641" x="713.0111" y="177.648">at</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="724.0751" y="177.648"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="26.6762" x="727.1952" y="177.648">least</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="612.8284" y="193.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="615.9484" y="193.9921">2</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="622.8124" y="193.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="72.1205" x="625.9325" y="193.9921">independent</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="698.053" y="193.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="26.7842" x="701.173" y="193.9921">trust</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="727.9572" y="193.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="35.2082" x="731.0772" y="193.9921">paths)</text></g><!--entity Rebuild--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Rebuild" data-source-line="97" id="ent0025"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="619.5584" y="242.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="42.6003" x="644.198" y="265.4839">Rebuild</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="686.7983" y="265.4839"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="45.0003" x="689.9184" y="265.4839">pipeline</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="81.9246" x="648.5961" y="281.828">(Reproducible)</text></g><!--entity Policy--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Policy" data-source-line="98" id="ent0026"><rect fill="#FFF6F6" height="69.0323" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="160.701" x="915.2884" y="146.4758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="63.8405" x="945.8025" y="169.3039">Verification</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1009.643" y="169.3039"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="32.7122" x="1012.763" y="169.3039">policy</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="925.2884" y="185.648"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="84.8526" x="928.4084" y="185.648">(organisational</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1013.261" y="185.648"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.6084" x="1016.381" y="185.648">measure</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="959.0806" y="201.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.5642" x="962.2006" y="201.9921">from</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="989.7648" y="201.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="18.4561" x="992.8849" y="201.9921">BSI</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1011.341" y="201.9921"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="17.7361" x="1014.461" y="201.9921">TR)</text></g><!--entity User--><g class="entity" data-qualified-name="User" data-source-line="55" id="ent0002"><ellipse cx="1303.9884" cy="199.1558" fill="#008000" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,207.1558 L1303.9884,234.1558 M1290.9884,215.1558 L1316.9884,215.1558 M1303.9884,234.1558 L1290.9884,249.1558 M1303.9884,234.1558 L1316.9884,249.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="69.0605" x="1269.4581" y="263.4839">Downloader</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="48.1684" x="1279.9042" y="279.828">(Verifier)</text></g><!--entity Net--><g class="entity" data-qualified-name="Net" data-source-line="56" id="ent0003"><ellipse cx="392.8284" cy="361.1558" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,369.1558 L392.8284,396.1558 M379.8284,377.1558 L405.8284,377.1558 M392.8284,396.1558 L379.8284,411.1558 M392.8284,396.1558 L405.8284,411.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="46.0563" x="369.8002" y="425.4839">Internet</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="56.1004" x="364.7782" y="441.828">(Insecure)</text></g><!--entity NTP1--><g class="entity" data-qualified-name="NTP1" data-source-line="57" id="ent0004"><ellipse cx="1303.9884" cy="327.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,335.3258 L1303.9884,362.3258 M1290.9884,343.3258 L1316.9884,343.3258 M1303.9884,362.3258 L1290.9884,377.3258 M1303.9884,362.3258 L1316.9884,377.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="23.0522" x="1267.8441" y="391.6539">NTP</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1290.8963" y="391.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.1323" x="1294.0163" y="391.6539">Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1330.1486" y="391.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="1333.2686" y="391.6539">1</text></g><!--entity NTP2--><g class="entity" data-qualified-name="NTP2" data-source-line="58" id="ent0005"><ellipse cx="1303.9884" cy="438.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,446.3258 L1303.9884,473.3258 M1290.9884,454.3258 L1316.9884,454.3258 M1303.9884,473.3258 L1290.9884,488.3258 M1303.9884,473.3258 L1316.9884,488.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="23.0522" x="1267.8441" y="502.6539">NTP</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1290.8963" y="502.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.1323" x="1294.0163" y="502.6539">Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1330.1486" y="502.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="1333.2686" y="502.6539">2</text></g><!--entity Attacker--><g class="entity" data-qualified-name="Attacker" data-source-line="59" id="ent0006"><ellipse cx="57.8284" cy="498.1558" fill="#FF0000" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M57.8284,506.1558 L57.8284,533.1558 M44.8284,514.1558 L70.8284,514.1558 M57.8284,533.1558 L44.8284,548.1558 M57.8284,533.1558 L70.8284,548.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="46.9563" x="34.3502" y="562.4839">Attacker</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.0323" x="6" y="578.828">(Insider</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="49.0323" y="578.828"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="4.464" x="52.1523" y="578.828">/</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="56.6164" y="578.828"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.9203" x="59.7364" y="578.828">External)</text></g><!--entity Keyserver1--><g class="entity" data-qualified-name="Keyserver1" data-source-line="63" id="ent0007"><ellipse cx="392.8284" cy="215.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,223.3258 L392.8284,250.3258 M379.8284,231.3258 L405.8284,231.3258 M392.8284,250.3258 L379.8284,265.3258 M392.8284,250.3258 L405.8284,265.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="55.6084" x="360.0321" y="279.6539">Keyserver</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="415.6405" y="279.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="418.7606" y="279.6539">1</text></g><!--entity Keyserver2--><g class="entity" data-qualified-name="Keyserver2" data-source-line="64" id="ent0008"><ellipse cx="392.8284" cy="104.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,112.3258 L392.8284,139.3258 M379.8284,120.3258 L405.8284,120.3258 M392.8284,139.3258 L379.8284,154.3258 M392.8284,139.3258 L405.8284,154.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="55.6084" x="360.0321" y="168.6539">Keyserver</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="415.6405" y="168.6539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="418.7606" y="168.6539">2</text></g><!--entity TAb--><g class="entity" data-qualified-name="TAb" data-source-line="280" id="ent0015"><path d="M631.5584,611.3258 L747.5584,611.3258 L759.5584,623.3258 L759.5584,654.6699 L747.5584,666.6699 L631.5584,666.6699 L619.5584,654.6699 L619.5584,623.3258 L631.5584,611.3258" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M740.5834,625.0798 A0.5,0.5 0 0 0 740.5622,625.0896 A0.5,0.5 0 0 0 740.5425,625.0818 C737.1233,625.1283 734.3765,627.9458 734.4173,631.3651 C734.4581,634.7844 737.2694,637.5346 740.6888,637.4996 C744.1082,637.4646 746.8649,634.6574 746.8357,631.238 C746.8066,627.8186 744.0029,625.0563 740.5834,625.0797 M740.5818,626.0699 A0.5,0.5 0 0 0 740.5911,626.0797 C743.4708,626.06 745.8112,628.3662 745.8357,631.2458 C745.8602,634.1254 743.559,636.4703 740.6794,636.4997 C737.7998,636.5292 735.452,634.2328 735.4177,631.3532 C735.3833,628.4737 737.6764,626.1209 740.5559,626.0817 A0.5,0.5 0 0 0 740.5817,626.0698 M740.5735,627.4218 C738.4451,627.4508 736.7318,629.2073 736.7572,631.3358 C736.7825,633.4643 738.537,635.1816 740.6655,635.1599 C742.794,635.1382 744.5139,633.3864 744.4958,631.2578 C744.4776,629.1293 742.728,627.4073 740.5994,627.4219 A0.5,0.5 0 0 0 740.5875,627.4333 A0.5,0.5 0 0 0 740.5735,627.4219 M740.6009,628.4156 A0.5,0.5 0 0 0 740.6071,628.4218 C742.1958,628.4109 743.4823,629.6768 743.4958,631.2656 C743.5093,632.8543 742.2444,634.1438 740.6557,634.16 C739.067,634.1762 737.7761,632.9127 737.7572,631.324 C737.7382,629.7353 738.9989,628.4435 740.5875,628.4219 A0.5,0.5 0 0 0 740.6009,628.4157 M740.603,629.6031 C739.6837,629.6156 738.9281,630.3912 738.939,631.3105 C738.9499,632.2298 739.7249,632.9875 740.6443,632.9781 C741.5636,632.9687 742.3218,632.1947 742.314,631.2754 C742.3062,630.356 741.5342,629.5969 740.6149,629.6032 A0.959,0.959 0 0 0 740.6087,629.6094 A0.959,0.959 0 0 0 740.603,629.6032" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="56.2804" x="645.296" y="653.1539">combined</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="701.5764" y="653.1539"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="29.1242" x="704.6965" y="653.1539">Trust</text></g><!--entity Log--><g class="entity" data-qualified-name="Log" data-source-line="92" id="ent0021"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="152.3396" x="1495.9884" y="426.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="16.1641" x="1512.1637" y="449.2339">Git</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1528.3278" y="449.2339"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.6565" x="1531.4479" y="449.2339">Transparency</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1608.1044" y="449.2339"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="20.9281" x="1611.2244" y="449.2339">Log</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="107.2687" x="1505.9884" y="468.0647">(tamper-hardened)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="1613.2571" y="468.0647">  </text><path d="M1632.3757,464.6202 L1633.9296,466.1282 C1633.9296,466.1282 1632.024,468.886 1629.9858,468.941 C1630.03,468.941 1629.9966,461.1787 1629.9894,459.2975 C1631.3458,458.8547 1632.3342,457.6191 1632.3342,456.1482 C1632.3342,454.3012 1630.7929,452.805 1628.8936,452.805 C1626.9907,452.805 1625.4494,454.3012 1625.4494,456.1473 C1625.4494,457.5938 1626.4072,458.8177 1627.7339,459.2822 L1627.7429,468.9077 C1625.2836,468.7382 1623.8604,466.3717 1623.8604,466.3717 L1625.5216,464.7646 L1619.4972,463.8734 L1620.4098,469.7166 L1622.0124,468.1663 C1623.4004,469.2837 1624.9679,471.6042 1628.7395,471.6042 C1633.4778,471.4834 1634.5718,468.9329 1635.7866,467.93 L1637.5398,469.639 L1638.4065,463.7399 L1632.3757,464.6202 M1627.1179,456.0922 C1627.1179,455.1416 1627.9125,454.3696 1628.8919,454.3696 C1629.8712,454.3696 1630.6694,455.1416 1630.6694,456.0922 C1630.6694,457.0454 1629.8712,457.8166 1628.8919,457.8166 C1627.9125,457.8166 1627.1179,457.0454 1627.1179,456.0922" fill="#007F00"/></g><!--entity Ledger--><g class="entity" data-qualified-name="Ledger" data-source-line="93" id="ent0022"><rect fill="#FFF6F6" height="71.519" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="150.1289" x="1497.0884" y="621.2358"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="63.2645" x="1507.0884" y="644.0639">Distributed</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1570.3528" y="644.0639"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.3483" x="1573.4728" y="644.0639">ledger</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1609.8211" y="644.0639"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.2762" x="1612.9411" y="644.0639">with</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1514.0364" y="660.408"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.8803" x="1517.1564" y="660.408">Merkle</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1556.0367" y="660.408"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.1642" x="1559.1567" y="660.408">Tree</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1584.3209" y="660.408"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="42.8283" x="1587.4409" y="660.408">records</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1524.0852" y="679.2388"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="67.9445" x="1527.2052" y="679.2388">(Blockchain)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="1595.1497" y="679.2388">  </text><path d="M1614.2683,675.7943 L1615.8222,677.3023 C1615.8222,677.3023 1613.9166,680.0601 1611.8784,680.1152 C1611.9226,680.1152 1611.8892,672.3528 1611.882,670.4716 C1613.2383,670.0288 1614.2268,668.7933 1614.2268,667.3223 C1614.2268,665.4753 1612.6855,663.9791 1610.7862,663.9791 C1608.8833,663.9791 1607.342,665.4753 1607.342,667.3214 C1607.342,668.768 1608.2998,669.9918 1609.6264,670.4563 L1609.6355,680.0818 C1607.1761,679.9123 1605.7529,677.5458 1605.7529,677.5458 L1607.4142,675.9387 L1601.3897,675.0476 L1602.3024,680.8907 L1603.905,679.3404 C1605.2929,680.4578 1606.8604,682.7783 1610.632,682.7783 C1615.3704,682.6575 1616.4644,680.107 1617.6792,679.1041 L1619.4324,680.8131 L1620.299,674.914 L1614.2683,675.7943 M1609.0105,667.2663 C1609.0105,666.3157 1609.805,665.5437 1610.7844,665.5437 C1611.7638,665.5437 1612.562,666.3157 1612.562,667.2663 C1612.562,668.2196 1611.7638,668.9907 1610.7844,668.9907 C1609.805,668.9907 1609.0105,668.2196 1609.0105,667.2663" fill="#007F00"/></g><!--reverse link TAb to B1--><g class="link" data-entity-1="ent0015" data-entity-2="ent0013" data-link-type="aggregation" data-source-line="79" id="lnk16"><path d="M771.541,665.2931 C786.641,669.3831 791.0784,669.8658 806.2884,671.9958 C845.5984,677.4958 889.8184,674.4358 925.5384,669.6958" fill="none" id="TAb-backto-B1" style="stroke:#000000;stroke-width:1;"/><polygon fill="none" points="759.9584,662.1558,764.7039,667.5853,771.541,665.2931,766.7954,659.8636,759.9584,662.1558" style="stroke:#000000;stroke-width:1;"/><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6484" x="807.2884" y="667.8239">combines</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="861.9368" y="667.8239"> </text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.3401" x="865.0568" y="667.8239">TA</text></g><!--reverse link TAb to B2--><g class="link" data-entity-1="ent0015" data-entity-2="ent0014" data-link-type="aggregation" data-source-line="80" id="lnk17"><path d="M771.7399,624.0423 C821.2599,614.9223 875.7784,604.8858 925.2884,595.7658" fill="none" id="TAb-backto-B2" style="stroke:#000000;stroke-width:1;"/><polygon fill="none" points="759.9384,626.2158,766.5636,629.0629,771.7399,624.0423,765.1146,621.1952,759.9384,626.2158" style="stroke:#000000;stroke-width:1;"/><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6484" x="807.2884" y="600.1639">combines</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="861.9368" y="600.1639"> </text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.3401" x="865.0568" y="600.1639">TA</text></g><!--link NTP1 to Log--><g class="link" data-entity-1="ent0004" data-entity-2="ent0021" data-link-type="dependency" data-source-line="101" id="lnk27"><path d="M1364.3884,378.6458 C1403.1484,392.7658 1448.4613,409.2807 1490.0713,424.4507" fill="none" id="NTP1-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1495.7084,426.5058,1488.6229,419.6651,1491.0108,424.7932,1485.8827,427.1811,1495.7084,426.5058" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.7562" x="1422.4884" y="389.7839">Time</text></g><!--link NTP2 to Log--><g class="link" data-entity-1="ent0005" data-entity-2="ent0021" data-link-type="dependency" data-source-line="102" id="lnk28"><path d="M1364.3884,464.8758 C1403.1484,462.8358 1448.1067,460.4711 1489.7167,458.2811" fill="none" id="NTP2-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1495.7084,457.9658,1486.5106,454.4444,1490.7153,458.2286,1486.931,462.4333,1495.7084,457.9658" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.7562" x="1422.4884" y="455.5739">Time</text></g><!--link Keyserver1 to Keys--><g class="link" data-entity-1="ent0007" data-entity-2="ent0024" data-link-type="dependency" data-source-line="104" id="lnk29"><path d="M453.1184,230.5158 C495.9784,220.0358 548.7199,207.1601 596.7199,195.4301" fill="none" id="Keyserver1-to-Keys" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="602.5484,194.0058,592.8561,192.2566,597.6913,195.1927,594.7552,200.028,602.5484,194.0058" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.4884" x="507.3284" y="198.3739">retrieves</text></g><!--link Keyserver2 to Keys--><g class="link" data-entity-1="ent0008" data-entity-2="ent0024" data-link-type="dependency" data-source-line="105" id="lnk30"><path d="M453.1184,141.8458 C495.9784,147.5158 548.6002,154.4789 596.6002,160.8289" fill="none" id="Keyserver2-to-Keys" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="602.5484,161.6158,594.1507,156.47,597.5915,160.9601,593.1015,164.4009,602.5484,161.6158" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.4884" x="507.3284" y="143.5539">retrieves</text></g><!--link Source to B1--><g class="link" data-entity-1="ent0010" data-entity-2="ent0013" data-link-type="dependency" data-source-line="107" id="lnk31"><path d="M735.3384,563.9058 C764.5884,581.9858 798.6984,602.7558 806.2884,605.9958 C844.4384,622.3158 883.3652,633.3328 919.6752,641.8028" fill="none" id="Source-to-B1" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="925.5184,643.1658,917.6623,637.2258,920.6491,642.0299,915.845,645.0167,925.5184,643.1658" style="stroke:#000000;stroke-width:1;"/></g><!--link Source to B2--><g class="link" data-entity-1="ent0010" data-entity-2="ent0014" data-link-type="dependency" data-source-line="108" id="lnk32"><path d="M759.9084,538.2458 C796.0184,540.2358 840.7584,543.9758 880.2884,550.9958 C897.2384,554.0058 909.5088,556.8442 926.1488,561.4842" fill="none" id="Source-to-B2" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="931.9284,563.0958,924.3335,556.8254,927.1121,561.7528,922.1847,564.5314,931.9284,563.0958" style="stroke:#000000;stroke-width:1;"/></g><!--link B1 to A1--><g class="link" data-entity-1="ent0013" data-entity-2="ent0019" data-link-type="dependency" data-source-line="110" id="lnk33"><path d="M1065.7684,660.1558 C1115.8884,662.4458 1177.3947,665.2511 1227.5847,667.5511" fill="none" id="B1-to-A1" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1233.5784,667.8258,1224.7709,663.418,1228.5836,667.5969,1224.4047,671.4096,1233.5784,667.8258" style="stroke:#000000;stroke-width:1;"/></g><!--link B2 to A2--><g class="link" data-entity-1="ent0014" data-entity-2="ent0020" data-link-type="dependency" data-source-line="111" id="lnk34"><path d="M1065.7684,582.9958 C1115.8884,582.9958 1177.3884,582.9958 1227.5784,582.9958" fill="none" id="B2-to-A2" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1233.5784,582.9958,1224.5784,578.9958,1228.5784,582.9958,1224.5784,586.9958,1233.5784,582.9958" style="stroke:#000000;stroke-width:1;"/></g><!--link A1 to Log--><g class="link" data-entity-1="ent0019" data-entity-2="ent0021" data-link-type="dependency" data-source-line="113" id="lnk35"><path d="M1374.2584,645.2158 C1382.9184,640.0658 1391.1184,634.0258 1397.9884,626.9958 C1404.0984,620.7358 1400.6784,615.9558 1405.9884,608.9958 C1426.8784,581.6358 1440.4984,583.1358 1465.9884,559.9958 C1494.0084,534.5558 1520.1393,507.9995 1540.9693,486.1395" fill="none" id="A1-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1545.1084,481.7958,1536.0039,485.552,1541.6591,485.4156,1541.7956,491.0708,1545.1084,481.7958" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="555.8239">Checksum</text></g><!--link A2 to Log--><g class="link" data-entity-1="ent0020" data-entity-2="ent0021" data-link-type="dependency" data-source-line="114" id="lnk36"><path d="M1360.1384,556.2658 C1404.9084,534.5658 1462.439,506.6824 1507.919,484.6424" fill="none" id="A2-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1513.3184,482.0258,1503.4749,482.3511,1508.8189,484.2063,1506.9637,489.5503,1513.3184,482.0258" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="502.7739">Checksum</text></g><!--link A1 to Ledger--><g class="link" data-entity-1="ent0019" data-entity-2="ent0022" data-link-type="dependency" data-source-line="116" id="lnk37"><path d="M1374.4684,686.6258 C1402.8984,690.9858 1436.0784,693.4458 1465.9884,688.9958 C1476.0884,687.4958 1480.7507,686.7329 1491.0007,684.0729" fill="none" id="A1-to-Ledger" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1496.8084,682.5658,1487.0922,680.9548,1491.9687,683.8218,1489.1017,688.6983,1496.8084,682.5658" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="684.8239">Checksum</text></g><!--link A2 to Ledger--><g class="link" data-entity-1="ent0020" data-entity-2="ent0022" data-link-type="dependency" data-source-line="117" id="lnk38"><path d="M1362.1284,609.7958 C1374.0084,615.4258 1386.4184,621.3658 1397.9884,626.9958 C1401.5584,628.7358 1402.1984,629.7858 1405.9884,630.9958 C1435.0184,640.2858 1462.0725,645.5315 1490.9025,649.4315" fill="none" id="A2-to-Ledger" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1496.8484,650.2358,1488.4658,645.0654,1491.8935,649.5655,1487.3934,652.9932,1496.8484,650.2358" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="626.8239">Checksum</text></g><!--link Tag to Source--><g class="link" data-entity-1="ent0011" data-entity-2="ent0010" data-link-type="dependency" data-source-line="119" id="lnk39"><path d="M463.2984,535.9958 C510.3584,535.9958 566.2884,535.9958 613.2984,535.9958" fill="none" id="Tag-to-Source" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="619.2984,535.9958,610.2984,531.9958,614.2984,535.9958,610.2984,539.9958,619.2984,535.9958" style="stroke:#000000;stroke-width:1;"/></g><!--link Net to User--><g class="link" data-entity-1="ent0003" data-entity-2="ent0002" data-link-type="dependency" data-source-line="121" id="lnk40"><path d="M453.2284,396.1158 C575.7084,389.2058 864.5984,367.7958 1099.9884,310.9958 C1149.5784,299.0258 1198.2113,281.1584 1238.1213,264.9084" fill="none" id="Net-to-User" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1243.6784,262.6458,1233.8344,262.3351,1239.0475,264.5313,1236.8512,269.7444,1243.6784,262.6458" style="stroke:#000000;stroke-width:1;"/></g><!--link Attacker to B1--><g class="link" data-entity-1="ent0006" data-entity-2="ent0013" data-link-type="dependency" data-source-line="122" id="lnk41"><path d="M118.1084,558.7258 C213.4484,593.9358 407.5484,660.0958 578.8284,683.9958 C668.9484,696.5658 692.5684,684.4658 783.5584,683.9958 C826.5484,683.7758 837.5884,688.0158 880.2884,682.9958 C894.9484,681.2758 904.6035,679.7119 919.3335,676.5319" fill="none" id="Attacker-to-B1" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="925.1984,675.2658,915.5569,673.2551,920.311,676.3209,917.2451,681.0749,925.1984,675.2658" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.4166" x="493.8284" y="665.3739">compromises</text></g><!--link Attacker to Net--><g class="link" data-entity-1="ent0006" data-entity-2="ent0003" data-link-type="dependency" data-source-line="123" id="lnk42"><path d="M117.9784,511.6658 C178.4384,486.7858 266.2696,450.6487 326.8396,425.7287" fill="none" id="Attacker-to-Net" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="332.3884,423.4458,322.5433,423.171,327.7644,425.3482,325.5872,430.5693,332.3884,423.4458" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="45.8283" x="196.8284" y="439.1339">controls</text></g><!--link Attacker to Tag--><g class="link" data-entity-1="ent0006" data-entity-2="ent0011" data-link-type="dependency" data-source-line="124" id="lnk43"><path d="M117.9784,535.9958 C175.2584,535.9958 256.0984,535.9958 316.5784,535.9958" fill="none" id="Attacker-to-Tag" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="322.5784,535.9958,313.5784,531.9958,317.5784,535.9958,313.5784,539.9958,322.5784,535.9958" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.4166" x="148.8284" y="531.8239">compromises</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="225.2449" y="531.8239"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.3603" x="228.365" y="531.8239">private</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="267.7252" y="531.8239"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="19.2961" x="270.8453" y="531.8239">key</text></g><!--link User to Rebuild--><g class="link" data-entity-1="ent0002" data-entity-2="ent0025" data-link-type="dependency" data-source-line="129" id="lnk44"><path d="M1243.7984,240.0858 C1130.0084,246.0358 887.2602,258.7227 765.9102,265.0627" fill="none" id="User-to-Rebuild" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="759.9184,265.3758,769.1148,268.9008,764.9116,265.1149,768.6974,260.9117,759.9184,265.3758" style="stroke:#000000;stroke-width:1;"/></g><!--link User to Log--><g class="link" data-entity-1="ent0002" data-entity-2="ent0021" data-link-type="dependency" data-source-line="130" id="lnk45"><path d="M1364.2984,276.2258 C1375.6584,284.1858 1387.3284,292.6658 1397.9884,300.9958 C1450.6284,342.1158 1503.6696,390.3637 1537.3796,421.9437" fill="none" id="User-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1541.7584,426.0458,1537.925,416.9736,1538.1094,422.6274,1532.4556,422.8119,1541.7584,426.0458" style="stroke:#000000;stroke-width:1;"/></g><!--link Keys to Policy--><g class="link" data-entity-1="ent0024" data-entity-2="ent0026" data-link-type="dependency" data-source-line="131" id="lnk46"><path d="M776.4784,175.2558 C819.9384,176.3958 866.3704,177.618 908.9304,178.738" fill="none" id="Keys-to-Policy" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="914.9284,178.8958,906.0367,174.6604,909.9301,178.7643,905.8262,182.6577,914.9284,178.8958" style="stroke:#000000;stroke-width:1;"/></g><!--link Rebuild to Policy--><g class="link" data-entity-1="ent0025" data-entity-2="ent0026" data-link-type="dependency" data-source-line="132" id="lnk47"><path d="M759.9384,248.9158 C806.0384,235.5758 860.9449,219.6837 909.0449,205.7637" fill="none" id="Rebuild-to-Policy" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="914.8084,204.0958,905.0511,202.7554,910.0054,205.4857,907.2751,210.44,914.8084,204.0958" style="stroke:#000000;stroke-width:1;"/></g><!--link Policy to User--><g class="link" data-entity-1="ent0026" data-entity-2="ent0002" data-link-type="dependency" data-source-line="133" id="lnk48"><path d="M1076.3284,195.5658 C1128.6284,205.1258 1189.996,216.3479 1237.636,225.0479" fill="none" id="Policy-to-User" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1243.5384,226.1258,1235.4034,220.574,1238.6197,225.2276,1233.9662,228.4439,1243.5384,226.1258" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.4403" x="1108.9884" y="198.1639">ACCEPT</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1152.4287" y="198.1639"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="4.464" x="1155.5487" y="198.1639">/</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1160.0127" y="198.1639"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.3403" x="1163.1328" y="198.1639">REJECT</text></g><g class="caption" data-source-line="51"><text fill="#000000" font-family="sans-serif" font-size="18" font-weight="bold" lengthAdjust="spacing" textLength="543.7407" x="548.2936" y="738.2377">Threat Model - Reproducible Builds according to SLSA Level 4</text></g><g class="footer" data-source-line="39"><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="86.6457" x="1327.7104" y="760.4776">Advantages:</text><ellipse cx="1192.0734" cy="770.6995" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="356.9197" x="1198.5734" y="775.2695">Consistency between source code and binaries through Reproducible Builds</text><ellipse cx="1238.2084" cy="784.3195" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="264.6497" x="1244.7084" y="788.8895">No single trust anchor -> at least 2 independent builders</text><ellipse cx="1170.1184" cy="797.9395" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="400.8296" x="1176.6184" y="802.5095">Subsequent manipulation detectable through checksums in the Git Transparency Log</text><ellipse cx="1221.2733" cy="811.5595" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="298.5198" x="1227.7733" y="816.1295">Insider attacks made more difficult through multiple signatures</text><ellipse cx="1107.2385" cy="825.1795" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="526.5894" x="1113.7385" y="829.7495">Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps</text><ellipse cx="1307.6333" cy="838.7995" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="125.7999" x="1314.1333" y="843.3695">Each box is a trust boarder</text></g><?plantuml-src fLRRRkF84NtdLrGq6ymu86coUJTi0vB6DYPhpngMiY_POD4YMrB3l6X9IhPtiV-UqqrAbiQQm4duOBcxgaxTg_eliappTIRedDVfKXQy5QV3xN-NXf6BUKjjHRLSB5lAP2tILbQbqJpASiLhNf2wuUKY5_I7GJJYwUEYhjPbDgxoggOFrzVNuNMeA5MTYRg_3G87d_7d7avPjT-7k1wFmMny92huesZeGUI_qg8MOj-IOLrNJzTLsMgvytDD1-VbPS-g08PbkWGeRsZoymqrgrgsmkX-w0VU4S-RpO8sKZoDgkUBWKCECSUtuy3T_WukOUVvYhTBciiylnXySFGteEnYSETwYHsuiUcos0wI87T3E_Py4p-U5wQEwLZCiKFVDrbYnr5a-SoEM61wZkr77e1JzKzYWj5stSYAVTj960wEbrWk3F0Zbhg-7IQ-vTjH4faii7s7MMvikp7RdZnVIMiufSzn81n2ABAyq6PkR7cHpIAlFwNQ9ZU0SRZtNARCPP3fJuhBYJMQwGPs6BccwzXU59fmCc69oM2A7vkUPoUXcqDVWW30M1P5m8PYtxDSn46xwuIknI8uuX-UW9-xaPt0IFpuxYsKmQx02NA4AexCqBCznrKyNiYKFr4IfB37yK9msgw3C0BGZKpb7K8SCOGux4_A_C155Y0Ad4J1kR5lAHUyn8oG8D-taBtOyND4Cqay4p-1wqEz5oSM-1CdklqcmRy3zovcTX34VPmGSaI78GIn7JgnoamO8cA93dntQjGfYC3XXPxP7pfI7sR4bo7z25r7Y5rhZors9xrEFxG3Bp0FBFXzS7ffd9-YaD74-Bh-NGgE7ZGkQBgi1M_fhif4JXRQQLLNsJgLCxJnQ2tph26UfkXOMIvK-qzk9qEw5Hjm-yQwKRUopCHAu4_PqasvlaSpoKN9stMD_kHbHe_YfJ7GPqyYprM__NTAS0-WLLLkgUrIq1JDEKAJDwB6tCa5RmG1D1LDOzAUgg_o-QU9IP_5JF9I6_DLjAF9PtXEVyqmsJuDNl1PTtTMbj5oULOKWnC3plG1wiCrhp2JLBY6sOQNBL-8vipu6ushif5DAyhqXMQYVS9eeQPQrwcW507L-cQovBL49DebHjbYUSnxG7sjI0KJLsszRbhg1v1rISYEygybTX3fcP8KjPATh6UD-6sjRWjUojKwvseqKoPQDPALdgtoT2dInsPTDC3IWRoHBKrhNZQOdDgFsse1o2zm3EXGtc88Dy25EqLL2qp--LocwxpTOHOuo1MKlAOT23-A5ofaiqPY_bSxTFnQKQogckUaww3tR2CvjR8GJSkBbT9snTCbpQfdaYYbFeIpYgj5exBPvmzVobTwRVsVbG_CBPB1qnQP6dokdigyKbNpI_dfPr7BkHJroK1LuJzKcNwuqQkdv_vImg1IjE15h4MAg7MygCyjpzVfFKr4lO6msz6cz-uH8gCjbMsfGvqtRSesbQTqzQnqyhnJj6MX3myYCpxsWbCLEf6Xj8i2ct2hkJlYxDBtMTaXAwDTR50CpRuZkpFWth2mGnO5Oxo-BGPtNA83PIdgWNubx94cNU-DaL8uZif2LPqG5dI_p_zeKfwB2snJCrKlWmlz6lZpKYliX0y1LLK-zEDboXS0rGFEKfKkidT3GrGzMlQ0ltpRoRIIAv73gmPANbl-v8sFz-2ZuNzGdAk9rMkVTU4UkKSmHk_5wF8nOig5kwgL6zs3lzvKFFyq7SvC6gHLWJ67Kj0bCJX1ZUY7sN01Z8LcxpX7xYjtCp3f1-MnVgHT3BGwTTUAv_RWxiI0C5MM1NawWzdQo3DDlDoYqNHuVge9bw_ix5titRSNdsqh4wzRCKU1Dc_ICEmfD4I-nlqqwnlB_Gxhw2qh-wOkZer1IAan9sfhgGPQLtZlgZiro_VTmgwgvMojcZONsGAzzYJRvIybtOdw4HnJo2hBCVHGXlHfb5VfOxf4ixrReuOzSEadMAvB03DSb1jPLsM1ieTNrLoF_cmtEDzM-uybYBHQptAPwlsYXh5wJoZncHu36SthgjYjITXzk2YxPQ2UwCt9Rh8SQdaGXpq8yFrrq8drJ8UItPnFkwsqgc3bYmfSLI-mY9kjsmKCmu07HPiwcdoXwKE7UgzbL1MeuKuM5hxQV6SqnNfJT-pREsDlU2gIEe9M2-GMswanzYRdKRhHZqb5n6JOFp7367MeAE9H9uyQDORxbcrBs1YoOxSxvgx2Zl2_8HWOa9hKps03Ir2VrU8qTelA-gTQLV_IPaCShOmSuOq1duxmA0p5LBPrbH_bK5eFOF24LDDDg0epFfwUxbPRvr77lq07eg31lU6vp5vVFNGWmjudOXZwSQ1ujmMskr3jgxEd3dsXR4jrxwhxsSKB-eRZyTNz51l_uUhlL-Fflm40?></g></svg>
\ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.png Binary files differnew file mode 100644 index 0000000..4197e78 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.puml new file mode 100644 index 0000000..edb377d --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.puml @@ -0,0 +1,87 @@ +@startuml +!include <archimate/Archimate> +left to right direction +skinparam linetype polyline + + +Title SLSA4 - Risk and Security Overlay + +' grouping +Grouping(riskex, "Risk Experience"){ + +Motivation_Assessment(hazard_ass, "Hazard Assessment") + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' STRATEGY +' together{ +Strategy_Resource(threat_enabler, "Threat Enabler\nGnuPG Signature Secret Key") +Strategy_Resource(asset, "Asset at Risk\nISO-Image gets manipulated") +Strategy_Capability(vuln, "Vulnerability Capability\n") +' } + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' business +' together{ +Business_Actor(threat_agent, "Threat Agent\nBlackHat manipulates ISO-Image") +Business_Event(threat_event, "Business Threat Event\nManipulated ISO-Image gets installed") +Business_Event(loss_event, "Business Loss Event\nNetBSD-Server has to be shutdown") +' } +Business_Service(control, "Implemented Control Measure\n") + +' grouping +} + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' Motivation +together{ +Motivation_Goal(global_goal, "Gloabl Goal:Run NetBSD-Server that is free from manipulation") +Motivation_Assessment(risk_assessment, "Risk Assessment\nISO-Image might be manipulated") +Motivation_Goal(goal, "<<ControlObjective>>\nGoal") +Motivation_Driver(risk_driver, "Risk Driver\nInstall Non-Manipulated ISO-Image") +Motivation_Stakeholder(risk_assessor, "Risk Assessor\nInstall-Admin verifying Signature") +Motivation_Stakeholder(risk_subj, "Risk Subject\nService Owner running NetBSD") +Motivation_Requirement(sec_req, "sec. requirement\nIntegrity of ISO-Image") +Motivation_Requirement(control_req, "control requirement\nInstall Non-Manipulated ISO-Image") +Motivation_Principle(sec_princ, "Security_Principle\n") +} + + +' Beziehungen +Rel_Association(hazard_ass, threat_event) +Rel_Association(vuln, threat_event) +Rel_Association(vuln, threat_enabler) +Rel_Association(vuln, loss_event) +Rel_Association(vuln, asset) + +Rel_Association(control, threat_enabler) +Rel_Association(control, asset) + +Rel_Association(threat_event, threat_enabler) +Rel_Association(loss_event, asset) + + +Rel_Association(riskex, risk_driver) + + +Rel_Association(risk_subj,global_goal) +Rel_Association(risk_assessment,risk_driver) +Rel_Association(risk_assessment,risk_assessor) +Rel_Association(risk_assessment,goal) + ' Rel_Association(, ) + +Rel_Realization(sec_req,goal,Realise) +Rel_Realization(sec_princ,goal,Realise) +Rel_Realization(control_req,sec_princ,Realise) + +' Rel_Realization(control,sec_princ,Realise) + +Rel_Realization(control,control_req,Realise) + +Rel_Flow(loss_event,global_goal,Flow) + +Rel_Assignment(threat_agent,threat_event,Assign) + + + +@enduml + diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.svg new file mode 100644 index 0000000..690d46d --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/203-SLSA4-ReproducibleBuilds-L1-Motivation.svg @@ -0,0 +1 @@ +<?plantuml 1.2026.1?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" data-diagram-type="DESCRIPTION" height="1062px" preserveAspectRatio="none" style="width:1686px;height:1062px;background:#FFFFFF;" version="1.1" viewBox="0 0 1686 1062" width="1686px" zoomAndPan="magnify"><title>SLSA4 - Risk and Security Overlay</title><defs><filter height="300%" id="f1blty4z7cgquj" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4" dy="4" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><g class="title" data-source-line="6"><text fill="#000000" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="230.1871" x="721.2921" y="24.9659">SLSA4 - Risk and Security Overlay</text></g><!--cluster riskex--><g class="cluster" data-qualified-name="riskex" data-source-line="340" id="ent0002"><path d="M8.5,46.0839 L103.2207,46.0839 A3.75,3.75 0 0 1 105.7207,48.5839 L112.7207,68.4281 L890.92,68.4281 A2.5,2.5 0 0 1 893.42,70.9281 L893.42,590.5839 A2.5,2.5 0 0 1 890.92,593.0839 L8.5,593.0839 A2.5,2.5 0 0 1 6,590.5839 L6,48.5839 A2.5,2.5 0 0 1 8.5,46.0839" fill="#FFFFFF" filter="url(#f1blty4z7cgquj)" style="stroke:#444444;stroke-width:1.5;stroke-dasharray:8,5;"/><line style="stroke:#444444;stroke-width:1.5;stroke-dasharray:8,5;" x1="6" x2="112.7207" y1="68.4281" y2="68.4281"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="93.7207" x="10" y="60.912">Risk Experience</text></g><!--entity hazard_ass--><g class="entity" data-qualified-name="riskex.hazard_ass" data-source-line="277" id="ent0003"><path d="M74.99,99.4139 L190.99,99.4139 L202.99,111.4139 L202.99,142.7581 L190.99,154.7581 L74.99,154.7581 L62.99,142.7581 L62.99,111.4139 L74.99,99.4139" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M187.563,111.2049 C184.8945,111.2413 182.7501,113.4427 182.7819,116.1111 C182.7975,117.4206 183.334,118.6047 184.1921,119.468 L177.8033,125.8573 A0.5,0.5 0 0 0 177.8033,126.5643 A0.5,0.5 0 0 0 178.5102,126.5643 L184.9703,120.1042 C185.7478,120.6162 186.6799,120.9102 187.6781,120.9 C190.3467,120.8727 192.4995,118.6799 192.4768,116.0114 C192.4541,113.3429 190.2646,111.1867 187.596,111.205 A0.5,0.5 0 0 0 187.5805,111.2107 A0.5,0.5 0 0 0 187.563,111.205 M187.594,112.1971 L187.5945,112.1971 A0.5,0.5 0 0 0 187.6023,112.2049 C189.7311,112.1904 191.4588,113.8905 191.477,116.0191 C191.4952,118.1477 189.7972,119.8782 187.6684,119.9 C186.7627,119.9093 185.9288,119.6082 185.2675,119.0949 A0.5,0.5 0 0 0 185.1859,119.0298 C184.3394,118.3352 183.796,117.2845 183.7819,116.0992 C183.7565,113.9707 185.4478,112.2338 187.5765,112.2049 A0.5,0.5 0 0 0 187.594,112.1971" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="40.3323" x="77.6816" y="141.242">Hazard</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="118.0139" y="141.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="67.1645" x="121.1339" y="141.242">Assessment</text></g><!--entity threat_enabler--><g class="entity" data-qualified-name="riskex.threat_enabler" data-source-line="89" id="ent0004"><rect fill="#F8E7C0" height="71.6882" rx="0.5" ry="0.5" style="stroke:#181818;stroke-width:0.5;" width="179.0971" x="688.83" y="188.2439"/><path d="M840.0071,203.4259 A0.5001,0.5001 0 0 0 839.5054,203.9257 L839.5054,213.3494 A0.5001,0.5001 0 0 0 840.0051,213.8496 L854.9271,213.8496 A0.5001,0.5001 0 0 0 855.4268,213.3556 L855.4443,211.5764 L856.9894,211.5588 A0.5001,0.5001 0 0 0 857.4835,211.0586 L857.4835,206.076 A0.5001,0.5001 0 0 0 856.9894,205.5762 L855.4835,205.5587 L855.4737,203.9454 A0.5001,0.5001 0 0 0 854.9735,203.4493 M840.5053,204.4259 L854.4763,204.4471 L854.4918,206.7322 L854.4313,212.8497 L840.5053,212.8497 M844.935,205.7245 A0.25,0.25 0 0 0 844.6849,205.9746 L844.6968,211.2539 A0.25,0.25 0 0 0 844.7051,211.3185 A0.25,0.25 0 0 0 844.7154,211.3495 A0.25,0.25 0 0 0 844.9464,211.504 A0.25,0.25 0 0 0 845.1965,211.2539 L845.1846,205.9746 A0.25,0.25 0 0 0 844.935,205.7245 M842.0266,205.7307 A0.25,0.25 0 0 0 841.7765,205.9803 L841.7568,211.2229 A0.25,0.25 0 0 0 842.007,211.4745 A0.25,0.25 0 0 0 842.2571,211.2244 L842.2767,205.9823 A0.25,0.25 0 0 0 842.0266,205.7307 M847.8919,205.7343 A0.25,0.25 0 0 0 847.6418,205.9823 L847.632,211.244 A0.25,0.25 0 0 0 847.8821,211.4941 A0.25,0.25 0 0 0 848.1322,211.2461 L848.142,205.9844 A0.25,0.25 0 0 0 847.8919,205.7343 M855.4935,206.5585 L856.4836,206.5704 L856.4836,210.5645 L855.5147,210.5764 L855.4914,206.6934" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.8763" x="736.8703" y="230.072">Threat</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="773.7465" y="230.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.0203" x="776.8666" y="230.072">Enabler</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.5643" x="698.83" y="246.4161">GnuPG</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="738.3943" y="246.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6844" x="741.5143" y="246.4161">Signature</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="796.1987" y="246.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="35.1723" x="799.3187" y="246.4161">Secret</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="834.491" y="246.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="20.3161" x="837.611" y="246.4161">Key</text></g><!--entity asset--><g class="entity" data-qualified-name="riskex.asset" data-source-line="89" id="ent0005"><rect fill="#F8E7C0" height="71.6882" rx="0.5" ry="0.5" style="stroke:#181818;stroke-width:0.5;" width="182.0971" x="687.33" y="383.2439"/><path d="M841.5071,398.4259 A0.5001,0.5001 0 0 0 841.0053,398.9257 L841.0053,408.3494 A0.5001,0.5001 0 0 0 841.5051,408.8496 L856.4271,408.8496 A0.5001,0.5001 0 0 0 856.9268,408.3556 L856.9443,406.5764 L858.4894,406.5588 A0.5001,0.5001 0 0 0 858.9835,406.0586 L858.9835,401.076 A0.5001,0.5001 0 0 0 858.4894,400.5762 L856.9835,400.5587 L856.9737,398.9454 A0.5001,0.5001 0 0 0 856.4735,398.4493 M842.0053,399.4259 L855.9763,399.4471 L855.9918,401.7322 L855.9313,407.8497 L842.0053,407.8497 M846.435,400.7245 A0.25,0.25 0 0 0 846.1849,400.9746 L846.1968,406.2539 A0.25,0.25 0 0 0 846.2051,406.3185 A0.25,0.25 0 0 0 846.2154,406.3495 A0.25,0.25 0 0 0 846.4464,406.504 A0.25,0.25 0 0 0 846.6965,406.2539 L846.6846,400.9746 A0.25,0.25 0 0 0 846.435,400.7245 M843.5266,400.7307 A0.25,0.25 0 0 0 843.2765,400.9803 L843.2568,406.2229 A0.25,0.25 0 0 0 843.5069,406.4745 A0.25,0.25 0 0 0 843.7571,406.2244 L843.7767,400.9823 A0.25,0.25 0 0 0 843.5266,400.7307 M849.3919,400.7343 A0.25,0.25 0 0 0 849.1418,400.9823 L849.132,406.244 A0.25,0.25 0 0 0 849.3821,406.4941 A0.25,0.25 0 0 0 849.6322,406.2461 L849.642,400.9844 A0.25,0.25 0 0 0 849.3919,400.7343 M856.9935,401.5585 L857.9836,401.5704 L857.9836,405.5645 L857.0147,405.5764 L856.9914,401.6934" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="30.2642" x="743.2363" y="425.072">Asset</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="773.5005" y="425.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="11.0641" x="776.6206" y="425.072">at</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="787.6846" y="425.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.7162" x="790.8047" y="425.072">Risk</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="697.33" y="441.4161">ISO-Image</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="757.3904" y="441.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.2282" x="760.5104" y="441.4161">gets</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="784.7386" y="441.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="71.5685" x="787.8586" y="441.4161">manipulated</text></g><!--entity vuln--><g class="entity" data-qualified-name="riskex.vuln" data-source-line="92" id="ent0006"><rect fill="#F8E7C0" height="71.6882" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="149.3729" x="58.31" y="340.2439"/><path d="M190.5999,352.6079 A0.5001,0.5001 0 0 0 190.0961,353.1077 L190.0961,357.6335 L185.594,357.6118 A0.5001,0.5001 0 0 0 185.0922,358.112 L185.0922,362.6647 L180.5648,362.6647 A0.5001,0.5001 0 0 0 180.0646,363.1685 L180.1116,368.1041 A0.5001,0.5001 0 0 0 180.6118,368.5982 L195.6258,368.5982 A0.5001,0.5001 0 0 0 196.126,368.0979 L196.1023,353.1309 A0.5001,0.5001 0 0 0 195.6041,352.6307 M191.096,353.6099 L195.102,353.6296 L195.1077,357.6567 L191.0961,357.637 M186.0922,358.6137 L190.0961,358.6334 L190.0961,362.6647 L186.0922,362.6647 M191.096,358.637 L195.102,358.6566 L195.102,362.6646 L191.096,362.6646 M181.069,363.6646 L185.0925,363.6646 L185.0925,367.5982 L181.1082,367.5982 M186.0925,363.6646 L190.0964,363.6646 L190.0964,367.5744 L186.0925,367.5744 M191.0963,363.6646 L195.1178,363.6646 L195.1256,367.5982 L191.0964,367.5982" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="70.7045" x="68.31" y="382.072">Vulnerability</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="139.0145" y="382.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="55.5484" x="142.1345" y="382.072">Capability</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="131.4364" y="398.4161"> </text></g><!--entity threat_agent--><g class="entity" data-qualified-name="riskex.threat_agent" data-source-line="110" id="ent0007"><rect fill="#FFFFCC" height="71.6882" rx="0.5" ry="0.5" style="stroke:#181818;stroke-width:0.5;" width="205.9893" x="30" y="190.2439"/><path d="M216.8851,201.1939 C214.8867,201.2211 213.2775,202.8712 213.3013,204.8697 C213.323,206.6913 214.6953,208.1913 216.4515,208.4271 L216.4515,209.6369 L210.9671,209.6214 A0.5,0.5 0 0 0 210.4653,210.1196 A0.5,0.5 0 0 0 210.9635,210.6214 L216.4515,210.6369 L216.4515,213.8403 L213.508,218.9671 A0.5,0.5 0 0 0 213.6935,219.6487 A0.5,0.5 0 0 0 214.3751,219.4652 L216.8928,215.0784 L219.4983,219.4399 A0.5006,0.5006 0 0 0 220.3577,218.9263 L217.4514,214.0511 L217.4514,210.6394 L222.9689,210.6549 A0.5,0.5 0 0 0 223.4712,210.1546 A0.5,0.5 0 0 0 222.9731,209.6549 L217.4515,209.6394 L217.4515,208.4229 C219.2228,208.1695 220.5843,206.6314 220.5686,204.7952 C220.5515,202.7967 218.9089,201.1802 216.9104,201.1939 A0.5,0.5 0 0 0 216.899,201.1999 A0.5,0.5 0 0 0 216.885,201.1939 M216.9084,202.1898 A0.5,0.5 0 0 0 216.9182,202.1938 C218.3769,202.1838 219.5562,203.3443 219.5687,204.8029 C219.5811,206.2616 218.4218,207.4447 216.9632,207.4596 C215.5046,207.4745 214.3187,206.3163 214.3013,204.8577 C214.2839,203.3991 215.4405,202.2136 216.8991,202.1938 A0.5,0.5 0 0 0 216.9084,202.1898" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.8763" x="96.2144" y="232.072">Threat</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="133.0906" y="232.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="33.5642" x="136.2107" y="232.072">Agent</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.7523" x="40" y="248.4161">BlackHat</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="89.7523" y="248.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="69.9365" x="92.8724" y="248.4161">manipulates</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="162.8088" y="248.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="165.9289" y="248.4161">ISO-Image</text></g><!--entity threat_event--><g class="entity" data-qualified-name="riskex.threat_event" data-source-line="136" id="ent0008"><rect fill="#FFFFCC" height="71.6882" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="232.5455" x="334.99" y="99.2439"/><path d="M539.6555,115.6539 A0.5001,0.5001 0 0 0 539.316,116.5211 L543.7416,120.6139 C543.2801,121.0245 542.4937,121.7261 541.7086,122.435 C541.0982,122.9862 540.4887,123.5412 540.0307,123.9703 C539.8016,124.1848 539.6106,124.3678 539.4721,124.5072 C539.4028,124.5769 539.3479,124.634 539.3,124.6891 C539.2761,124.7167 539.2544,124.7411 539.2261,124.7826 C539.2119,124.8034 539.1952,124.8276 539.1734,124.8767 C539.1625,124.9013 539.1509,124.9326 539.1403,124.9837 C539.1353,125.0092 539.1284,125.0772 539.1284,125.0778 C539.1284,125.0784 539.1458,125.2178 539.146,125.2183 A0.5001,0.5001 0 0 0 539.6286,125.5894 L552.2786,125.5894 A0.5,0.5 0 0 0 552.2826,125.5894 C554.9698,125.5646 557.1298,123.3115 557.1087,120.582 C557.0875,117.8542 554.8967,115.6382 552.2118,115.6541 C552.2108,115.6541 552.2098,115.6541 552.2078,115.6541 L552.2018,115.6541 M540.9329,116.6539 L552.2079,116.6539 A0.5,0.5 0 0 0 552.2119,116.6539 A0.5,0.5 0 0 0 552.2159,116.6539 C554.3489,116.6414 556.0911,118.3896 556.1082,120.5896 C556.1253,122.7875 554.4148,124.564 552.2847,124.5894 C552.2827,124.5894 552.2807,124.5894 552.2787,124.5894 L540.8347,124.5894 C541.2717,124.182 541.814,123.6862 542.3778,123.1771 C543.5013,122.1625 544.6292,121.1608 544.7947,121.0139 A0.5,0.5 0 0 0 544.8526,120.9607 A0.5,0.5 0 0 0 544.9332,120.8403 A0.5,0.5 0 0 0 544.9342,120.8383 A0.5,0.5 0 0 0 544.9569,120.783 A0.5,0.5 0 0 0 544.9609,120.7701 A0.5,0.5 0 0 0 544.9743,120.7195 A0.5,0.5 0 0 0 544.9763,120.704 A0.5,0.5 0 0 0 544.9823,120.659 A0.5,0.5 0 0 0 544.9833,120.6311 A0.5,0.5 0 0 0 544.9828,120.5923 A0.5,0.5 0 0 0 544.9798,120.5696 A0.5,0.5 0 0 0 544.9738,120.5272 A0.5,0.5 0 0 0 544.9668,120.4983 A0.5,0.5 0 0 0 544.9588,120.4689 A0.5,0.5 0 0 0 544.9443,120.4307 A0.5,0.5 0 0 0 544.9353,120.408 A0.5,0.5 0 0 0 544.8681,120.3031 A0.5,0.5 0 0 0 544.8671,120.3021 A0.5,0.5 0 0 0 544.8581,120.2907 A0.5,0.5 0 0 0 544.8018,120.2359" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.7404" x="389.1923" y="141.072">Business</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="438.9327" y="141.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.8763" x="442.0527" y="141.072">Threat</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="478.9289" y="141.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="31.2842" x="482.049" y="141.072">Event</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="71.2325" x="344.99" y="157.4161">Manipulated</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="416.2225" y="157.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="419.3425" y="157.4161">ISO-Image</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="479.4029" y="157.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.2282" x="482.5229" y="157.4161">gets</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="506.7511" y="157.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="47.6643" x="509.8711" y="157.4161">installed</text></g><!--entity loss_event--><g class="entity" data-qualified-name="riskex.loss_event" data-source-line="136" id="ent0009"><rect fill="#FFFFCC" height="71.6882" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="217.8814" x="342.32" y="489.2439"/><path d="M532.3214,505.6539 A0.5001,0.5001 0 0 0 531.9819,506.5211 L536.4075,510.6139 C535.946,511.0245 535.1596,511.7261 534.3745,512.435 C533.7641,512.9862 533.1546,513.5412 532.6966,513.9703 C532.4676,514.1848 532.2765,514.3678 532.138,514.5072 C532.0687,514.5769 532.0138,514.634 531.9659,514.6891 C531.942,514.7167 531.9203,514.7411 531.892,514.7826 C531.8778,514.8034 531.8611,514.8276 531.8393,514.8767 C531.8284,514.9013 531.8168,514.9326 531.8062,514.9837 C531.8012,515.0092 531.7943,515.0772 531.7943,515.0778 C531.7943,515.0784 531.8117,515.2178 531.8119,515.2183 A0.5001,0.5001 0 0 0 532.2946,515.5894 L544.9446,515.5894 A0.5,0.5 0 0 0 544.9486,515.5894 C547.6358,515.5646 549.7958,513.3115 549.7747,510.582 C549.7535,507.8542 547.5627,505.6382 544.8778,505.6541 C544.8768,505.6541 544.8758,505.6541 544.8738,505.6541 L544.8678,505.6541 M533.5988,506.6539 L544.8738,506.6539 A0.5,0.5 0 0 0 544.8778,506.6539 A0.5,0.5 0 0 0 544.8818,506.6539 C547.0148,506.6414 548.757,508.3896 548.7741,510.5896 C548.7912,512.7875 547.0807,514.564 544.9506,514.5894 C544.9486,514.5894 544.9466,514.5894 544.9446,514.5894 L533.5006,514.5894 C533.9376,514.182 534.4799,513.6862 535.0437,513.1771 C536.1672,512.1625 537.2951,511.1608 537.4606,511.0139 A0.5,0.5 0 0 0 537.5185,510.9607 A0.5,0.5 0 0 0 537.5991,510.8403 A0.5,0.5 0 0 0 537.6001,510.8383 A0.5,0.5 0 0 0 537.6228,510.783 A0.5,0.5 0 0 0 537.6268,510.7701 A0.5,0.5 0 0 0 537.6402,510.7195 A0.5,0.5 0 0 0 537.6422,510.704 A0.5,0.5 0 0 0 537.6482,510.659 A0.5,0.5 0 0 0 537.6492,510.6311 A0.5,0.5 0 0 0 537.6487,510.5923 A0.5,0.5 0 0 0 537.6457,510.5696 A0.5,0.5 0 0 0 537.6397,510.5272 A0.5,0.5 0 0 0 537.6327,510.4983 A0.5,0.5 0 0 0 537.6247,510.4689 A0.5,0.5 0 0 0 537.6102,510.4307 A0.5,0.5 0 0 0 537.6012,510.408 A0.5,0.5 0 0 0 537.534,510.3031 A0.5,0.5 0 0 0 537.533,510.3021 A0.5,0.5 0 0 0 537.524,510.2907 A0.5,0.5 0 0 0 537.4677,510.2359" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.7404" x="395.1063" y="531.072">Business</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="444.8467" y="531.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.0442" x="447.9667" y="531.072">Loss</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="473.0109" y="531.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="31.2842" x="476.1309" y="531.072">Event</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="83.3646" x="352.32" y="547.4161">NetBSD-Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="435.6846" y="547.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="19.8961" x="438.8046" y="547.4161">has</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="458.7008" y="547.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="11.5921" x="461.8208" y="547.4161">to</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="473.4129" y="547.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.1481" x="476.5329" y="547.4161">be</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="490.681" y="547.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="56.4004" x="493.801" y="547.4161">shutdown</text></g><!--entity control--><g class="entity" data-qualified-name="riskex.control" data-source-line="142" id="ent0010"><rect fill="#FFFFCC" height="71.6882" rx="12.5" ry="12.5" style="stroke:#181818;stroke-width:0.5;" width="193.8333" x="354.35" y="294.2439"/><path d="M525.6833,310.1539 C523.0077,310.1479 520.8302,312.358 520.8061,315.0761 C520.782,317.7942 522.9202,320.0456 525.5955,320.0897 A0.5,0.5 0 0 0 525.611,320.0897 L533.152,320.0897 A0.5,0.5 0 0 0 533.158,320.0897 C535.8452,320.0649 538.0032,317.8113 537.982,315.0817 C537.9609,312.3635 535.785,310.1551 533.113,310.1554 L533.113,310.1534 L533.0799,310.1534 M525.6813,311.1539 A0.5,0.5 0 0 0 525.6853,311.1539 L533.1127,311.1539 C535.2352,311.154 536.9647,312.8975 536.9817,315.0896 C536.9988,317.2896 535.285,319.0679 533.152,319.0899 C533.151,319.0899 533.149,319.0899 533.148,319.0899 L525.6131,319.0899 C523.4879,319.0548 521.7866,317.2781 521.8061,315.086 C521.8256,312.8939 523.5558,311.1496 525.6813,311.1539" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.4165" x="364.35" y="336.072">Implemented</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="440.7665" y="336.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="41.9043" x="443.8866" y="336.072">Control</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="485.7909" y="336.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.2724" x="488.9109" y="336.072">Measure</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="449.7066" y="352.4161"> </text></g><!--entity global_goal--><g class="entity" data-qualified-name="global_goal" data-source-line="280" id="ent0011"><path d="M1001.22,839.4139 L1347.0945,839.4139 L1359.0945,851.4139 L1359.0945,882.7581 L1347.0945,894.7581 L1001.22,894.7581 L989.22,882.7581 L989.22,851.4139 L1001.22,839.4139" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1340.1195,853.1679 A0.5,0.5 0 0 0 1340.0983,853.1777 A0.5,0.5 0 0 0 1340.0787,853.1699 C1336.6595,853.2165 1333.9127,856.0339 1333.9535,859.4532 C1333.9942,862.8725 1336.8056,865.6227 1340.225,865.5877 C1343.6444,865.5528 1346.4011,862.7455 1346.3719,859.3261 C1346.3427,855.9067 1343.5391,853.1444 1340.1196,853.1678 M1340.1179,854.1581 A0.5,0.5 0 0 0 1340.1272,854.1679 C1343.0069,854.1482 1345.3473,856.4544 1345.3718,859.334 C1345.3964,862.2136 1343.0951,864.5585 1340.2155,864.5879 C1337.3359,864.6173 1334.9881,862.321 1334.9538,859.4414 C1334.9195,856.5619 1337.2125,854.2091 1340.092,854.1699 A0.5,0.5 0 0 0 1340.1178,854.158 M1340.1096,855.51 C1337.9812,855.5389 1336.2679,857.2955 1336.2933,859.424 C1336.3187,861.5525 1338.0731,863.2698 1340.2016,863.2481 C1342.3301,863.2263 1344.05,861.4746 1344.0319,859.346 C1344.0137,857.2175 1342.2641,855.4955 1340.1355,855.5101 A0.5,0.5 0 0 0 1340.1236,855.5214 A0.5,0.5 0 0 0 1340.1097,855.5101 M1340.137,856.5037 A0.5,0.5 0 0 0 1340.1432,856.5099 C1341.7319,856.499 1343.0184,857.7649 1343.0319,859.3537 C1343.0454,860.9424 1341.7805,862.2319 1340.1918,862.2481 C1338.6031,862.2643 1337.3122,861.0008 1337.2933,859.4121 C1337.2744,857.8234 1338.535,856.5316 1340.1236,856.51 A0.5,0.5 0 0 0 1340.137,856.5038 M1340.1391,857.6912 C1339.2198,857.7038 1338.4642,858.4793 1338.4751,859.3986 C1338.486,860.3179 1339.2611,861.0756 1340.1804,861.0662 C1341.0997,861.0568 1341.8579,860.2828 1341.8501,859.3635 C1341.8423,858.4442 1341.0703,857.685 1340.151,857.6913 A0.959,0.959 0 0 0 1340.1448,857.6975 A0.959,0.959 0 0 0 1340.1391,857.6913" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.3003" x="999.22" y="881.242">Gloabl</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1035.5203" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="51.3363" x="1038.6403" y="881.242">Goal:Run</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1089.9766" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="83.3646" x="1093.0967" y="881.242">NetBSD-Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1176.4613" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.8121" x="1179.5813" y="881.242">that</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1202.3934" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="8.8441" x="1205.5135" y="881.242">is</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1214.3575" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.6202" x="1217.4776" y="881.242">free</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1240.0977" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.5642" x="1243.2178" y="881.242">from</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1270.782" y="881.242"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="75.1925" x="1273.902" y="881.242">manipulation</text></g><!--entity risk_assessment--><g class="entity" data-qualified-name="risk_assessment" data-source-line="277" id="ent0012"><path d="M1081.86,930.2439 L1266.4413,930.2439 L1278.4413,942.2439 L1278.4413,989.9322 L1266.4413,1001.9322 L1081.86,1001.9322 L1069.86,989.9322 L1069.86,942.2439 L1081.86,930.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1263.0143,942.0349 C1260.3458,942.0713 1258.2014,944.2727 1258.2332,946.9411 C1258.2488,948.2506 1258.7853,949.4347 1259.6434,950.298 L1253.2546,956.6873 A0.5,0.5 0 0 0 1253.2546,957.3943 A0.5,0.5 0 0 0 1253.9615,957.3943 L1260.4216,950.9342 C1261.1991,951.4462 1262.1312,951.7402 1263.1294,951.73 C1265.798,951.7027 1267.9508,949.5099 1267.9281,946.8414 C1267.9054,944.1729 1265.7159,942.0167 1263.0473,942.035 A0.5,0.5 0 0 0 1263.0318,942.0407 A0.5,0.5 0 0 0 1263.0143,942.035 M1263.0453,943.0271 L1263.0458,943.0271 A0.5,0.5 0 0 0 1263.0536,943.0349 C1265.1824,943.0204 1266.9101,944.7205 1266.9283,946.8491 C1266.9465,948.9777 1265.2485,950.7082 1263.1197,950.73 C1262.214,950.7393 1261.3801,950.4382 1260.7188,949.9249 A0.5,0.5 0 0 0 1260.6372,949.8598 C1259.7907,949.1652 1259.2473,948.1145 1259.2332,946.9292 C1259.2078,944.8007 1260.8991,943.0638 1263.0278,943.0349 A0.5,0.5 0 0 0 1263.0453,943.0271" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.7162" x="1127.6503" y="972.072">Risk</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1150.3665" y="972.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="67.1645" x="1153.4865" y="972.072">Assessment</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="1079.86" y="988.4161">ISO-Image</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1139.9204" y="988.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="33.4442" x="1143.0404" y="988.4161">might</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1176.4847" y="988.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.1481" x="1179.6047" y="988.4161">be</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1193.7528" y="988.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="71.5685" x="1196.8728" y="988.4161">manipulated</text></g><!--entity goal--><g class="entity" data-qualified-name="goal" data-source-line="280" id="ent0013"><path d="M1511.93,716.2439 L1627.93,716.2439 L1639.93,728.2439 L1639.93,775.9322 L1627.93,787.9322 L1511.93,787.9322 L1499.93,775.9322 L1499.93,728.2439 L1511.93,716.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1620.955,729.9979 A0.5,0.5 0 0 0 1620.9338,730.0077 A0.5,0.5 0 0 0 1620.9142,729.9999 C1617.495,730.0465 1614.7482,732.8639 1614.789,736.2832 C1614.8297,739.7025 1617.6411,742.4527 1621.0605,742.4177 C1624.4799,742.3828 1627.2366,739.5755 1627.2074,736.1561 C1627.1782,732.7367 1624.3746,729.9744 1620.9551,729.9978 M1620.9534,730.9881 A0.5,0.5 0 0 0 1620.9627,730.9979 C1623.8424,730.9782 1626.1828,733.2844 1626.2073,736.164 C1626.2319,739.0436 1623.9306,741.3885 1621.051,741.4179 C1618.1714,741.4473 1615.8236,739.151 1615.7893,736.2714 C1615.755,733.3919 1618.048,731.0391 1620.9275,730.9999 A0.5,0.5 0 0 0 1620.9533,730.988 M1620.9451,732.34 C1618.8167,732.3689 1617.1034,734.1255 1617.1288,736.254 C1617.1542,738.3825 1618.9086,740.0998 1621.0371,740.0781 C1623.1656,740.0563 1624.8855,738.3046 1624.8674,736.176 C1624.8492,734.0475 1623.0996,732.3255 1620.971,732.3401 A0.5,0.5 0 0 0 1620.9591,732.3514 A0.5,0.5 0 0 0 1620.9452,732.3401 M1620.9725,733.3337 A0.5,0.5 0 0 0 1620.9787,733.3399 C1622.5674,733.329 1623.8539,734.5949 1623.8674,736.1837 C1623.8809,737.7724 1622.616,739.0619 1621.0273,739.0781 C1619.4386,739.0943 1618.1477,737.8308 1618.1288,736.2421 C1618.1099,734.6534 1619.3705,733.3616 1620.9591,733.34 A0.5,0.5 0 0 0 1620.9725,733.3338 M1620.9746,734.5212 C1620.0553,734.5338 1619.2997,735.3093 1619.3106,736.2286 C1619.3216,737.1479 1620.0966,737.9056 1621.0159,737.8962 C1621.9352,737.8868 1622.6934,737.1128 1622.6856,736.1935 C1622.6778,735.2742 1621.9058,734.515 1620.9865,734.5213 A0.959,0.959 0 0 0 1620.9803,734.5275 A0.959,0.959 0 0 0 1620.9746,734.5213" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="106.7888" x="1516.5356" y="758.072">«ControlObjective»</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.8242" x="1557.0179" y="774.4161">Goal</text></g><!--entity risk_driver--><g class="entity" data-qualified-name="risk_driver" data-source-line="274" id="ent0014"><path d="M1472.09,929.7439 L1667.7714,929.7439 L1679.7714,941.7439 L1679.7714,990.4322 L1667.7714,1002.4322 L1472.09,1002.4322 L1460.09,990.4322 L1460.09,941.7439 L1472.09,929.7439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1660.8324,940.1869 A0.5,0.5 0 0 0 1660.3322,940.6872 L1660.3322,943.1666 C1658.8966,943.259 1657.5886,943.8224 1656.5598,944.7019 L1654.8261,942.9682 A0.5,0.5 0 0 0 1654.4726,942.8219 A0.5,0.5 0 0 0 1654.1191,942.9682 A0.5,0.5 0 0 0 1654.1191,943.6751 L1655.8518,945.4078 C1654.9664,946.4377 1654.3997,947.748 1654.3046,949.1812 L1651.8381,949.1812 A0.5,0.5 0 0 0 1651.3379,949.6809 A0.5,0.5 0 0 0 1651.8381,950.1811 L1654.3155,950.1811 C1654.4401,951.5979 1655.0246,952.8836 1655.9164,953.8899 L1654.1542,955.6515 L1654.1134,955.6929 A0.5001,0.5001 0 0 0 1654.8203,956.3998 L1654.8224,956.3998 L1654.8617,956.359 L1656.6352,954.5855 C1657.6542,955.4304 1658.9347,955.9688 1660.3321,956.0588 L1660.3321,958.6809 A0.5001,0.5001 0 0 0 1661.332,958.6809 L1661.332,956.0459 C1662.7095,955.9221 1663.9625,955.3637 1664.9545,954.5106 L1666.8438,956.3999 A0.5001,0.5001 0 0 0 1667.5508,955.693 L1667.5099,955.6516 L1665.6604,953.8026 C1666.5102,952.8082 1667.0639,951.5545 1667.1843,950.1811 L1669.8337,950.1811 A0.5001,0.5001 0 0 0 1669.8337,949.1812 L1667.1946,949.1812 C1667.1018,947.7869 1666.564,946.5121 1665.7234,945.4982 L1667.5471,943.6751 A0.5,0.5 0 0 0 1667.5471,942.9682 A0.5,0.5 0 0 0 1666.8381,942.9682 L1665.0268,944.7789 C1664.0222,943.889 1662.7405,943.3064 1661.3319,943.1795 L1661.3319,940.6871 A0.5,0.5 0 0 0 1660.8322,940.1868 M1660.3322,944.6703 L1660.3322,948.1507 C1660.2533,948.1767 1660.1767,948.2084 1660.1032,948.2453 L1657.6186,945.7602 C1658.3695,945.1499 1659.3044,944.7553 1660.3321,944.6703 M1661.3321,944.6874 C1662.3337,944.8036 1663.2434,945.2158 1663.9707,945.8356 L1661.5724,948.2339 C1661.4953,948.1966 1661.4148,948.1651 1661.3321,948.1398 M1656.9101,946.4666 L1659.3792,948.9352 C1659.3348,949.0136 1659.2965,949.096 1659.265,949.1812 L1655.8089,949.1812 C1655.8962,948.1548 1656.2945,947.2183 1656.9101,946.4666 M1664.6631,946.5586 C1665.2362,947.2928 1665.6066,948.1944 1665.6909,949.1812 L1662.4343,949.1812 C1662.3998,949.088 1662.3574,948.9984 1662.3077,948.9135 M1655.8228,950.1811 L1659.2179,950.1811 C1659.2454,950.2838 1659.2828,950.3834 1659.3285,950.4777 L1656.9726,952.8331 C1656.3506,952.1036 1655.9371,951.1899 1655.8228,950.1811 M1662.4808,950.1811 L1665.6775,950.1811 C1665.5682,951.1473 1665.1829,952.0285 1664.6016,952.7437 L1662.3588,950.5009 L1662.3588,950.5004 C1662.4098,950.3991 1662.4509,950.2921 1662.4808,950.181 M1660.0091,951.2115 L1660.0096,951.2115 C1660.1111,951.2708 1660.2192,951.3205 1660.3321,951.3577 L1660.3321,954.5549 C1659.3415,954.4732 1658.4344,954.1023 1657.6956,953.5255 M1661.6684,951.2244 L1663.8962,953.4522 C1663.1827,954.0368 1662.3014,954.426 1661.332,954.5384 L1661.332,951.3691 C1661.4499,951.3331 1661.5626,951.2842 1661.6684,951.2244" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.7162" x="1539.6965" y="972.572">Risk</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1562.4126" y="972.572"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="34.6322" x="1565.5327" y="972.572">Driver</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="34.4882" x="1470.09" y="988.9161">Install</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1504.5782" y="988.9161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="98.8927" x="1507.6983" y="988.9161">Non-Manipulated</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1606.5909" y="988.9161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="1609.711" y="988.9161">ISO-Image</text></g><!--entity risk_assessor--><g class="entity" data-qualified-name="risk_assessor" data-source-line="270" id="ent0015"><path d="M1479.37,823.2439 L1660.4833,823.2439 L1672.4833,835.2439 L1672.4833,882.9322 L1660.4833,894.9322 L1479.37,894.9322 L1467.37,882.9322 L1467.37,835.2439 L1479.37,823.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1658.9283,838.7179 L1648.0653,838.7257 A0.5,0.5 0 0 0 1648.0555,838.7257 C1647.0672,838.7437 1646.1945,839.293 1645.5947,840.1029 C1644.9949,840.9129 1644.6422,841.991 1644.6418,843.1709 C1644.6414,844.3508 1644.9934,845.4309 1645.5926,846.2415 C1646.1918,847.0521 1647.0636,847.6011 1648.0519,847.6202 A0.5,0.5 0 0 0 1648.0612,847.6202 A0.5,0.5 0 0 0 1648.071,847.6202 L1658.993,847.63 L1658.993,847.629 C1659.8182,847.6273 1660.6361,847.2173 1661.2528,846.4642 A0.5,0.5 0 0 0 1661.272,846.3996 A0.5,0.5 0 0 0 1661.3324,846.3645 C1662.6287,844.6723 1662.6936,842.02 1661.4988,840.216 C1660.9014,839.314 1660.0495,838.7774 1659.1511,838.7215 C1659.0984,838.7182 1659.0457,838.7188 1658.993,838.7189 L1658.993,838.7179 L1658.931,838.7179 C1658.9301,838.7179 1658.9288,838.7179 1658.9279,838.7179 M1658.9934,839.7169 C1659.0254,839.7169 1659.0572,839.718 1659.089,839.72 C1659.6363,839.754 1660.2048,840.0719 1660.6651,840.767 C1661.5857,842.157 1661.5201,844.4759 1660.54,845.7553 A0.5,0.5 0 0 0 1660.5266,845.8059 A0.5,0.5 0 0 0 1660.4796,845.8312 C1660.0172,846.3959 1659.4996,846.6325 1658.9934,846.6301 L1658.9908,846.6301 C1658.9479,846.6299 1658.9048,846.6275 1658.8621,846.6239 C1658.3148,846.5772 1657.7467,846.2453 1657.2937,845.5382 C1656.3877,844.124 1656.4831,841.8073 1657.4756,840.554 C1657.9226,839.9896 1658.4295,839.7375 1658.9256,839.7179 L1658.9933,839.7179 M1656.8747,839.7195 C1656.8122,839.7873 1656.7511,839.8586 1656.6923,839.9329 C1655.3734,841.5983 1655.2794,844.2491 1656.4504,846.0772 C1656.5796,846.2788 1656.7211,846.4628 1656.8731,846.628 L1648.0716,846.6202 L1648.0711,846.6202 C1647.4396,846.608 1646.8532,846.2644 1646.3973,845.6477 C1645.9415,845.031 1645.6415,844.1499 1645.6418,843.1708 C1645.6422,842.1918 1645.9411,841.3126 1646.3973,840.6965 C1646.8535,840.0804 1647.4416,839.737 1648.0732,839.7255" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.7162" x="1532.1864" y="865.072">Risk</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1554.9025" y="865.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.6444" x="1558.0225" y="865.072">Assessor</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="75.1325" x="1477.37" y="881.4161">Install-Admin</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1552.5025" y="881.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.0564" x="1555.6225" y="881.4161">verifying</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1604.6789" y="881.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6844" x="1607.7989" y="881.4161">Signature</text></g><!--entity risk_subj--><g class="entity" data-qualified-name="risk_subj" data-source-line="270" id="ent0016"><path d="M692.47,742.2439 L864.2712,742.2439 L876.2712,754.2439 L876.2712,801.9322 L864.2712,813.9322 L692.47,813.9322 L680.47,801.9322 L680.47,754.2439 L692.47,742.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M862.7162,757.7179 L851.8532,757.7257 A0.5,0.5 0 0 0 851.8434,757.7257 C850.8552,757.7437 849.9824,758.293 849.3826,759.1029 C848.7828,759.9129 848.4301,760.991 848.4297,762.1709 C848.4293,763.3508 848.7814,764.4309 849.3806,765.2415 C849.9798,766.0521 850.8516,766.6011 851.8399,766.6202 A0.5,0.5 0 0 0 851.8492,766.6202 A0.5,0.5 0 0 0 851.859,766.6202 L862.781,766.63 L862.781,766.629 C863.6061,766.6273 864.4241,766.2173 865.0408,765.4642 A0.5,0.5 0 0 0 865.0599,765.3996 A0.5,0.5 0 0 0 865.1204,765.3645 C866.4167,763.6723 866.4816,761.02 865.2868,759.216 C864.6894,758.314 863.8375,757.7774 862.9391,757.7215 C862.8864,757.7182 862.8336,757.7188 862.7809,757.7189 L862.7809,757.7179 L862.7189,757.7179 C862.7181,757.7179 862.7167,757.7179 862.7158,757.7179 M862.7813,758.7169 C862.8133,758.7169 862.8451,758.718 862.8769,758.72 C863.4243,758.754 863.9927,759.0719 864.453,759.767 C865.3737,761.157 865.308,763.4759 864.328,764.7553 A0.5,0.5 0 0 0 864.3145,764.8059 A0.5,0.5 0 0 0 864.2675,764.8312 C863.8051,765.3959 863.2876,765.6325 862.7813,765.6301 L862.7787,765.6301 C862.7358,765.6299 862.6927,765.6275 862.65,765.6239 C862.1028,765.5772 861.5346,765.2453 861.0816,764.5382 C860.1757,763.124 860.271,760.8073 861.2635,759.554 C861.7105,758.9896 862.2175,758.7375 862.7135,758.7179 L862.7812,758.7179 M860.6626,758.7195 C860.6001,758.7873 860.5391,758.8586 860.4802,758.9329 C859.1613,760.5983 859.0673,763.2491 860.2384,765.0772 C860.3675,765.2788 860.509,765.4628 860.6611,765.628 L851.8596,765.6202 L851.8591,765.6202 C851.2275,765.608 850.6412,765.2644 850.1853,764.6477 C849.7294,764.031 849.4294,763.1499 849.4298,762.1708 C849.4301,761.1918 849.7291,760.3126 850.1853,759.6965 C850.6415,759.0804 851.2296,758.737 851.8612,758.7255" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="22.7162" x="744.7824" y="784.072">Risk</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="767.4985" y="784.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="41.3403" x="770.6186" y="784.072">Subject</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="40.0323" x="690.47" y="800.4161">Service</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="730.5023" y="800.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="37.9443" x="733.6223" y="800.4161">Owner</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="771.5666" y="800.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="45.0963" x="774.6866" y="800.4161">running</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="819.7829" y="800.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.3683" x="822.9029" y="800.4161">NetBSD</text></g><!--entity sec_req--><g class="entity" data-qualified-name="sec_req" data-source-line="289" id="ent0017"><path d="M1113.07,625.2439 L1235.2269,625.2439 L1247.2269,637.2439 L1247.2269,684.9322 L1235.2269,696.9322 L1113.07,696.9322 L1101.07,684.9322 L1101.07,637.2439 L1113.07,625.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1223.3269,641.7889 A0.5001,0.5001 0 0 0 1222.8796,642.0663 L1218.9148,650.0311 A0.5001,0.5001 0 0 0 1219.3641,650.7537 C1224.0045,650.7401 1228.64,650.8055 1233.2941,650.7596 A0.5001,0.5001 0 0 0 1233.7374,650.4823 L1237.7003,642.5116 A0.5001,0.5001 0 0 0 1237.2531,641.7889 M1223.6355,642.7889 L1236.4465,642.7889 L1232.9797,649.7596 C1228.7128,649.7973 1224.447,649.749 1220.1687,649.7537" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="21.4922" x="1126.3041" y="667.072">sec.</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1147.7963" y="667.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="71.0765" x="1150.9163" y="667.072">requirement</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="48.4683" x="1111.07" y="683.4161">Integrity</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1159.5383" y="683.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="11.3881" x="1162.6584" y="683.4161">of</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1174.0465" y="683.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="1177.1665" y="683.4161">ISO-Image</text></g><!--entity control_req--><g class="entity" data-qualified-name="control_req" data-source-line="289" id="ent0018"><path d="M680.53,630.2439 L876.2114,630.2439 L888.2114,642.2439 L888.2114,689.9322 L876.2114,701.9322 L680.53,701.9322 L668.53,689.9322 L668.53,642.2439 L680.53,630.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M864.3114,646.7889 A0.5001,0.5001 0 0 0 863.8641,647.0663 L859.8993,655.0311 A0.5001,0.5001 0 0 0 860.3485,655.7537 C864.9889,655.7401 869.6244,655.8055 874.2785,655.7596 A0.5001,0.5001 0 0 0 874.7219,655.4823 L878.6848,647.5116 A0.5001,0.5001 0 0 0 878.2375,646.7889 M864.62,647.7889 L877.431,647.7889 L873.9642,654.7596 C869.6973,654.7973 865.4315,654.749 861.1532,654.7537" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="40.0803" x="721.2323" y="672.072">control</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="761.3126" y="672.072"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="71.0765" x="764.4326" y="672.072">requirement</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="34.4882" x="678.53" y="688.4161">Install</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="713.0182" y="688.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="98.8927" x="716.1383" y="688.4161">Non-Manipulated</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="815.0309" y="688.4161"> </text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="60.0604" x="818.151" y="688.4161">ISO-Image</text></g><!--entity sec_princ--><g class="entity" data-qualified-name="sec_princ" data-source-line="286" id="ent0019"><path d="M1116.15,732.2439 L1232.15,732.2439 L1244.15,744.2439 L1244.15,791.9322 L1232.15,803.9322 L1116.15,803.9322 L1104.15,791.9322 L1104.15,744.2439 L1116.15,732.2439" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M1225.19,745.6109 C1223.5483,745.6149 1221.9053,745.6837 1220.5861,745.8161 C1219.9265,745.8823 1219.349,745.9636 1218.8829,746.0657 C1218.5503,746.1385 1218.3272,746.2593 1218.0902,746.3861 L1217.9145,746.3861 L1217.7719,746.5153 C1217.4917,746.7693 1217.3836,747.0848 1217.2737,747.4703 C1217.1638,747.8558 1217.0826,748.3171 1217.0179,748.8392 C1216.8884,749.8833 1216.8333,751.1655 1216.8422,752.4488 C1216.8512,753.7321 1216.9236,755.0122 1217.0572,756.0543 C1217.1239,756.5753 1217.2052,757.036 1217.3068,757.4175 C1217.4084,757.7989 1217.4979,758.0982 1217.7445,758.359 C1218.0498,758.682 1218.3754,758.7224 1218.8287,758.8179 C1219.2819,758.9133 1219.8501,758.9876 1220.5025,759.0463 C1221.8073,759.1638 1223.4491,759.2184 1225.0924,759.2143 C1226.7358,759.2102 1228.3762,759.1461 1229.6782,759.0267 C1230.3291,758.9669 1230.8942,758.8944 1231.3442,758.8024 C1231.7943,758.7104 1232.1081,758.679 1232.4186,758.3688 C1232.6766,758.111 1232.7748,757.8043 1232.8811,757.4216 C1232.9873,757.0388 1233.0714,756.5794 1233.1389,756.0599 C1233.2739,755.021 1233.3437,753.7463 1233.3518,752.4684 C1233.3598,751.1905 1233.3058,749.9131 1233.188,748.8707 C1233.1291,748.3495 1233.0539,747.8877 1232.9576,747.5033 C1232.8613,747.1189 1232.7727,746.8172 1232.5354,746.5524 C1232.2413,746.2245 1231.9001,746.1583 1231.444,746.0522 C1230.9878,745.9461 1230.4215,745.8638 1229.7702,745.7985 C1228.4676,745.6679 1226.8318,745.6069 1225.1901,745.6109 M1225.194,746.6109 C1226.8093,746.607 1228.4208,746.669 1229.6707,746.7943 C1230.2957,746.857 1230.8305,746.9369 1231.2174,747.0269 C1231.5444,747.103 1231.7693,747.2316 1231.7972,747.232 L1231.7982,747.232 L1231.7988,747.2315 C1231.8254,747.2827 1231.9212,747.4775 1231.9889,747.7478 C1232.0684,748.0649 1232.1384,748.4915 1232.1941,748.9839 C1232.3054,749.9685 1232.3601,751.2168 1232.3522,752.4622 C1232.3442,753.7076 1232.2741,754.9531 1232.1471,755.9312 C1232.0836,756.4202 1232.0051,756.8426 1231.9187,757.1539 C1231.8504,757.4 1231.7586,757.5767 1231.7249,757.6381 C1231.6953,757.6354 1231.4611,757.7587 1231.1435,757.8236 C1230.7537,757.9033 1230.215,757.9752 1229.5865,758.0329 C1228.3295,758.1482 1226.7082,758.2102 1225.0886,758.2143 C1223.469,758.2183 1221.8477,758.1636 1220.5907,758.0504 C1219.9622,757.9938 1219.4246,757.921 1219.0357,757.8391 C1218.7188,757.7724 1218.4922,757.6486 1218.4611,757.6494 C1218.4303,757.5886 1218.34,757.4073 1218.274,757.1595 C1218.1903,756.8452 1218.1128,756.4193 1218.0497,755.927 C1217.9236,754.9426 1217.8512,753.6907 1217.8425,752.4409 C1217.8335,751.1911 1217.8891,749.941 1218.0104,748.9626 C1218.0711,748.4734 1218.1497,748.051 1218.2373,747.7436 C1218.317,747.4641 1218.4289,747.2838 1218.443,747.2584 C1218.4595,747.2583 1218.7232,747.1242 1219.0967,747.0424 C1219.5016,746.9537 1220.0509,746.8757 1220.6863,746.8119 C1221.9571,746.6844 1223.5787,746.6148 1225.194,746.6109 M1223.9946,747.8961 A0.5001,0.5001 0 0 0 1223.5068,748.4997 L1224.608,753.7459 A0.5001,0.5001 0 0 0 1225.5904,753.7242 L1226.4694,748.478 A0.5001,0.5001 0 0 0 1225.9774,747.8961 M1225.0845,755.3396 C1224.6053,755.3462 1224.2117,755.7507 1224.2174,756.23 C1224.2234,756.7093 1224.6269,757.1041 1225.1062,757.0992 C1225.5855,757.0943 1225.9816,756.6917 1225.9775,756.2124 C1225.9745,755.868 1225.7349,755.625 1225.44,755.4838 A0.5,0.5 0 0 0 1225.3072,755.4295 C1225.2299,755.4074 1225.1744,755.339 1225.0907,755.3396 A0.5,0.5 0 0 0 1225.0887,755.3417 A0.5,0.5 0 0 0 1225.0847,755.3396" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="99.1927" x="1124.5536" y="774.072">Security_Principle</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1172.59" y="790.4161"> </text></g><!--link hazard_ass to threat_event--><g class="link" data-entity-1="ent0003" data-entity-2="ent0008" data-link-type="association" data-source-line="349" id="lnk20"><path d="M203.4,128.8439 C241.86,129.8139 290.67,131.0439 334.71,132.1639" fill="none" id="hazard_ass-threat_event" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="283.99" y="126.432"> </text></g><!--link vuln to threat_event--><g class="link" data-entity-1="ent0006" data-entity-2="ent0008" data-link-type="association" data-source-line="349" id="lnk21"><path d="M174.67,340.0639 C233.4,288.0539 334.99,198.0839 334.99,198.0839 C334.99,198.0839 358.25,185.3739 383.88,171.3639" fill="none" id="vuln-threat_event" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="283.99" y="223.752"> </text></g><!--link vuln to threat_enabler--><g class="link" data-entity-1="ent0006" data-entity-2="ent0004" data-link-type="association" data-source-line="349" id="lnk22"><path d="M207.7,339.7839 C265.06,311.5239 334.99,277.0839 334.99,277.0839 C334.99,277.0839 597.53,245.0839 597.53,245.0839 C597.53,245.0839 643.2,239.7539 688.51,234.4639" fill="none" id="vuln-threat_enabler" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="449.76" y="244.592"> </text></g><!--link vuln to loss_event--><g class="link" data-entity-1="ent0006" data-entity-2="ent0009" data-link-type="association" data-source-line="349" id="lnk23"><path d="M208.12,405.1539 C223.94,411.3539 235.99,416.0839 235.99,416.0839 C235.99,416.0839 265.99,446.0839 265.99,446.0839 C265.99,446.0839 317.23,468.0539 365.68,488.8239" fill="none" id="vuln-loss_event" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="283.99" y="441.912"> </text></g><!--link vuln to asset--><g class="link" data-entity-1="ent0006" data-entity-2="ent0005" data-link-type="association" data-source-line="349" id="lnk24"><path d="M207.98,385.2839 C265.29,392.4139 334.99,401.0839 334.99,401.0839 C334.99,401.0839 557.66,410.1439 687.05,415.4039" fill="none" id="vuln-asset" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="449.76" y="396.912"> </text></g><!--link control to threat_enabler--><g class="link" data-entity-1="ent0010" data-entity-2="ent0004" data-link-type="association" data-source-line="349" id="lnk25"><path d="M548.49,298.7139 C592.77,284.2739 644.98,267.2539 688.34,253.1139" fill="none" id="control-threat_enabler" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="616.53" y="266.562"> </text></g><!--link control to asset--><g class="link" data-entity-1="ent0010" data-entity-2="ent0005" data-link-type="association" data-source-line="349" id="lnk26"><path d="M548.49,356.4239 C592.3,368.4239 643.88,382.5339 686.97,394.3339" fill="none" id="control-asset" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="616.53" y="367.742"> </text></g><!--link threat_event to threat_enabler--><g class="link" data-entity-1="ent0008" data-entity-2="ent0004" data-link-type="association" data-source-line="349" id="lnk27"><path d="M567.8,166.7139 C607.5,177.5839 651.29,189.5639 688.53,199.7639" fill="none" id="threat_event-threat_enabler" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="616.53" y="172.742"> </text></g><!--link loss_event to asset--><g class="link" data-entity-1="ent0009" data-entity-2="ent0005" data-link-type="association" data-source-line="349" id="lnk28"><path d="M560.52,489.7839 C601.53,476.4139 647.74,461.3539 686.94,448.5739" fill="none" id="loss_event-asset" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="616.53" y="461.562"> </text></g><!--link riskex to risk_driver--><g class="link" data-entity-1="ent0002" data-entity-2="ent0014" data-link-type="association" data-source-line="349" id="lnk29"><path d="M139.4079,593.1349 C139.7588,593.6563 140.1257,594.2015 140.5084,594.7702 C141.2738,595.9076 142.1023,597.1386 142.9914,598.4598 C144.7696,601.1022 146.7906,604.1054 149.0354,607.4412 C158.0146,620.7845 170.5759,639.4511 185.5123,661.6475 C215.3853,706.0405 254.7594,764.5533 293.9813,822.8402 C372.425,939.4139 450.26,1055.0839 450.26,1055.0839 C450.26,1055.0839 450.26,1055.0839 1175.15,1055.0839 C1175.15,1055.0839 1359.09,1019.0839 1359.09,1019.0839 C1359.09,1019.0839 1408.72,1006.5439 1459.71,993.6739" fill="none" id="riskex-risk_driver" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="776.88" y="1050.912"> </text></g><!--link risk_subj to global_goal--><g class="link" data-entity-1="ent0016" data-entity-2="ent0011" data-link-type="association" data-source-line="349" id="lnk30"><path d="M876.71,800.0839 C928.64,811.8239 993.11,826.3939 1048.64,838.9439" fill="none" id="risk_subj-global_goal" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="937.22" y="807.822"> </text></g><!--link risk_assessment to risk_driver--><g class="link" data-entity-1="ent0012" data-entity-2="ent0014" data-link-type="association" data-source-line="349" id="lnk31"><path d="M1278.87,966.0839 C1334.58,966.0839 1403.23,966.0839 1459.76,966.0839" fill="none" id="risk_assessment-risk_driver" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1408.09" y="961.912"> </text></g><!--link risk_assessment to risk_assessor--><g class="link" data-entity-1="ent0012" data-entity-2="ent0015" data-link-type="association" data-source-line="349" id="lnk32"><path d="M1278.87,937.9039 C1336.98,922.1139 1409.15,902.5039 1466.97,886.7939" fill="none" id="risk_assessment-risk_assessor" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1408.09" y="895.682"> </text></g><!--link risk_assessment to goal--><g class="link" data-entity-1="ent0012" data-entity-2="ent0013" data-link-type="association" data-source-line="349" id="lnk33"><path d="M1278.68,935.6939 C1320.51,923.4139 1359.09,912.0839 1359.09,912.0839 C1359.09,912.0839 1389.09,874.0839 1389.09,874.0839 C1389.09,874.0839 1460.09,806.0839 1460.09,806.0839 C1460.09,806.0839 1478.23,797.0839 1499.69,786.4339" fill="none" id="risk_assessment-goal" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1408.09" y="831.842"> </text></g><!--link sec_req to goal--><g class="link" data-entity-1="ent0017" data-entity-2="ent0013" data-link-type="extension" data-source-line="349" id="lnk34"><path d="M1247.38,677.7739 C1319.21,694.3739 1411.1022,715.6112 1481.9422,731.9812" fill="none" id="sec_req-to-goal" style="stroke:#000000;stroke-width:1;stroke-dasharray:1,3;"/><polygon fill="none" points="1499.48,736.0339,1483.2931,726.1353,1480.5913,737.8272,1499.48,736.0339" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.6723" x="1390.09" y="707.862">Realise</text></g><!--link sec_princ to goal--><g class="link" data-entity-1="ent0019" data-entity-2="ent0013" data-link-type="extension" data-source-line="349" id="lnk35"><path d="M1244.65,765.2639 C1316.4,762.3439 1409.7449,758.556 1481.4849,755.636" fill="none" id="sec_princ-to-goal" style="stroke:#000000;stroke-width:1;stroke-dasharray:1,3;"/><polygon fill="none" points="1499.47,754.9039,1481.2409,749.6409,1481.7289,761.631,1499.47,754.9039" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.6723" x="1390.09" y="754.012">Realise</text></g><!--link control_req to sec_princ--><g class="link" data-entity-1="ent0018" data-entity-2="ent0019" data-link-type="extension" data-source-line="349" id="lnk36"><path d="M888.54,694.3639 C957.39,712.1939 1026.8149,730.1811 1086.3549,745.6011" fill="none" id="control_req-to-sec_princ" style="stroke:#000000;stroke-width:1;stroke-dasharray:1,3;"/><polygon fill="none" points="1103.78,750.1139,1087.8592,739.7927,1084.8506,751.4095,1103.78,750.1139" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.6723" x="919.22" y="700.772">Realise</text></g><!--link control to control_req--><g class="link" data-entity-1="ent0010" data-entity-2="ent0018" data-link-type="extension" data-source-line="349" id="lnk37"><path d="M518.65,366.3639 C544.27,380.3739 567.53,393.0839 567.53,393.0839 C567.53,393.0839 597.53,501.0839 597.53,501.0839 C597.53,501.0839 660.53,577.0839 660.53,577.0839 C660.53,577.0839 683.1806,594.3373 715.5306,618.9773" fill="none" id="control-to-control_req" style="stroke:#000000;stroke-width:1;stroke-dasharray:1,3;"/><polygon fill="none" points="729.85,629.8839,719.1662,614.2042,711.8951,623.7504,729.85,629.8839" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.6723" x="598.53" y="496.912">Realise</text></g><!--link loss_event to global_goal--><g class="link" data-entity-1="ent0009" data-entity-2="ent0011" data-link-type="dependency" data-source-line="349" id="lnk38"><path d="M475.55,561.3039 C529.9,645.8539 660.53,849.0839 660.53,849.0839 C660.53,849.0839 833.8549,855.1732 980.8149,860.3332" fill="none" id="loss_event-to-global_goal" style="stroke:#000000;stroke-width:1;stroke-dasharray:7,7;"/><polygon fill="#000000" points="988.81,860.6139,980.9202,857.3351,980.7097,863.3314,988.81,860.6139" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="26.0162" x="765.38" y="844.912">Flow</text></g><!--link threat_agent to threat_event--><g class="link" data-entity-1="ent0007" data-entity-2="ent0008" data-link-type="dependency" data-source-line="349" id="lnk39"><path d="M247.7726,193.3474 C279.1726,184.3174 294.7317,179.8353 326.9617,170.5653" fill="none" id="threat_agent-threat_event" style="stroke:#000000;stroke-width:1;"/><ellipse cx="242.0063" cy="195.0057" fill="#000000" rx="6" ry="6" style="stroke:#000000;stroke-width:1.5;"/><polygon fill="#000000" points="334.65,168.3539,326.1324,167.6821,327.7909,173.4484,334.65,168.3539" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="37.0563" x="266.99" y="173.682">Assign</text></g><?plantuml-src fLLRJzim57xFhpZZXLQYsykU9eHKBklG1amDcZIfKkKcXyJ3iJFRAHIq_xvZEscINiOsU2Ysp-Slv_hv3PU9g5A4OwQJd1VCuhjnipg91DvPi0eqpt8BATUOMAvaPEwvB9bc1GWkqQvAX5A9bTj4KNJBhK20-4iyVWyZc79p3qoc46DIQMvNSBD4BTWAekWGCgsgaiiicjIBWIOyFXx1WRzuyLYYvYWJF1W-Hz6Lidp9d1FpiJ5eJ87I3dBsn7GwPyRGjKz-0wtvOEW-TFY_VtGtlfsERoyctsbfLOOsH_qSnLPJahBLV8f6LJh1WSqrCZj7oHO2DRbowm_W8XpCv4HMNoSGyqmoMsbq6T5euJEkoCTjFee7BT6uK2mGaSl8J5x6DwFBWcK8v8g1WabULeBkfbsMCrQo1HUKxy6o4f9elj4_rFKXjFQPf7k7yEkrMLfKXXh0c5wMJkl3-JYnIZSf8kUbRHCqTjkPF1KikVz4-pOa0-jeoSarsSNIbRt9zpAGDLPeqhxqh5TjVc0ZTLmQouJmYTlW5egMMynVwBJXlKPx6f-FOjJKpf0puoPbWM3oogRgeKdgcjS1ELKrKT9g9OZsiYW5kWubpyx2ALmXCzGQlYRTyNXrTTh9YThgTCPfefWOP48jc9Xdj2R_9a9HuuApV9XM4leHsvnop0tSQKJwKKLRDk8ZztVFgXjlDwdrlfdp5j5jyC8B3oMrt-HRRWT_Zu_hBDuiVZYbMkB92GqT6VjtpZMPTF0azUl6Ys0X3q9ZmBMIevtzSp24BcDisJtcIgGDRGXGwNvuggKUZTE2Iw2lyRiL5RXLXRwlMyocMlneMEFA1pgJTM_1pGDDEEXAIaSPwjNdc-BFYdJSby9WCjVuazXezHPqQt9kaefujLPtlHdSmrLtTSrNxpOfNqngb_shfiU9quHuFqkt8-Rc4MdDVbHeFAZ7J_69Orv9afDeYiArdKguf-kz4LtX66uXWrp-2oRe-pvKAoNx45xeQTuthMkfUEb3Q-0-fhvKlaJN5R-6SGlKlDETCTe72qtR4PVXRbX75dgiVmLkHkvbUF003c4JU0HrwgR817yAXysKU97n1eF3dQZGet_6TUUalRE6Hy6f7JTselTXkr_fepyAzT2jRrVndQtj7TAZelFAXYUxrqS1v8h-6m00?></g></svg>
\ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png Binary files differindex 1bf7971..6eeff72 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc index fe1010a..e3e62b6 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc @@ -35,5 +35,19 @@ image::200-ThreatModel-SLSA1-DownloadSig.png[] +=== Reproducible Builds SLSA L4 + +Modeling Trust, Trust Anchors and Boundaries and Attack Vectors + +==== The whole implementation + +* Trust Boundaries: Rectangles +* Attack Vectors: Red Arrows + image::201-ThreatModel-SLSA4-ReproducibleBuilds.png[] +* Trust Anchor: Green Anchor + +image::202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png[] + + diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/pumlit.sh b/PlantUML-ModelingTrust/GnuPG-WoT-Download/pumlit.sh index b20b927..3214510 100755 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/pumlit.sh +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/pumlit.sh @@ -1,3 +1,3 @@ -plantuml -v --skip-fresh -svg *.puml -plantuml -v --skip-fresh -png *.puml +plantuml --skip-fresh -svg *.puml +plantuml --skip-fresh -png *.puml #asciidoctor index.adoc |
