Merge pull request 'pages init' (#1) from pages into mainHEADmain

Reviewed-on: https://codeberg.org/0xKaishakunin/Architecture/pulls/1

1 files changed, 38 insertions, 3 deletions

diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc
index 7fa6b8b..fb7b965 100644
--- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc
+++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc
@@ -1,8 +1,12 @@
-= PLantUML Diagrams for GnuPG Key Signing
+= PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4)
 0.0.2
 :pdf-page-size: A3
 :pdf-page-layout: landscape
 
+
+
+// tag::inhalt[]
+
 I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling. 
 
 So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff. 
@@ -32,7 +36,9 @@ image::300-NetBSD-RelEng-STRIDE.png[]
 
 == Supply-chain Levels for Software Artifacts
 
-A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines. 
+=== SLSA L1
+
+A simple threat model for SLSA Level 1: 
 
 image::200-ThreatModel-SLSA1-DownloadSig.png[]
 
@@ -40,7 +46,33 @@ image::200-ThreatModel-SLSA1-DownloadSig.png[]
 
 === Reproducible Builds SLSA L4
 
-Modeling Trust, Trust Anchors and Boundaries and Attack Vectors
+Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:
+
+The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!
+
+
+. general goals
+.. Build process produces identical artefacts (bit-for-bit) from the same source and inputs
+.. independent parties can rebuild and verify outputs match the original -> verify freedom from insider threat!
+.. require a deterministic build environments
+.. all build steps, dependencies, and tooling are tightly controlled and audited
+. security goals:
+.. detect tampering in build pipelines or artefacts
+.. prevents hidden backdoors introduced during compilation or packaging by a  malicious insider
+.. ensure integrity of supply chain, dependencies and build tools
+.. enables independent verification without trusting the original builder
+.. drastrically reduce insider and supply chain attack surface
+. Zero Trust:
+.. never trust, always verify!
+.. verifiable evidence (rebuild && compare)
+.. eliminates implicit trust in build pipeline
+.. build system considered untrustworthy
+.. combine with signed artefacts and attestation frameworks for full supply chain integrity
+
+
+
+
+
 
 ==== The whole implementation
 
@@ -58,3 +90,6 @@ image::202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png[]
 === Motivation/Business Layer: Risk/Security Overlay
 
 image::203-SLSA4-ReproducibleBuilds-L1-Motivation.png[]
+
+
+// end::inhalt[]