diff options
Diffstat (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html')
| -rw-r--r-- | PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html | 72 |
1 files changed, 68 insertions, 4 deletions
diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html index 5bc2456..712e918 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html @@ -6,7 +6,7 @@ <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="generator" content="Asciidoctor 2.0.26"> <meta name="author" content="0.0.2"> -<title>PLantUML Diagrams for GnuPG Key Signing</title> +<title>PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4)</title> <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700"> <style> /*! Asciidoctor default stylesheet | MIT License | https://asciidoctor.org */ @@ -437,7 +437,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b </head> <body class="article toc2 toc-left"> <div id="header"> -<h1>PLantUML Diagrams for GnuPG Key Signing</h1> +<h1>PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4)</h1> <div class="details"> <span id="author" class="author">0.0.2</span><br> </div> @@ -520,7 +520,71 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b <div class="sect2"> <h3 id="_reproducible_builds_slsa_l4">Reproducible Builds SLSA L4</h3> <div class="paragraph"> -<p>Modeling Trust, Trust Anchors and Boundaries and Attack Vectors</p> +<p>Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:</p> +</div> +<div class="paragraph"> +<p>The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!</p> +</div> +<div class="olist loweralpha"> +<div class="title">Goals:</div> +<ol class="loweralpha" type="a"> +<li> +<p>Build process produces identical artefacts (bit-for-bit) from the same source and inputs</p> +</li> +<li> +<p>independent parties can rebuild and verify outputs match the original → verify freedom from insider threat!</p> +</li> +<li> +<p>require a deterministic build environments</p> +</li> +<li> +<p>all build steps, dependencies, and tooling are tightly controlled and audited</p> +<div class="olist arabic"> +<ol class="arabic"> +<li> +<p>security goals:</p> +</li> +</ol> +</div> +</li> +<li> +<p>detect tampering in build pipelines or artefacts</p> +</li> +<li> +<p>prevents hidden backdoors introduced during compilation or packaging by a malicious insider</p> +</li> +<li> +<p>ensure integrity of supply chain, dependencies and build tools</p> +</li> +<li> +<p>enables independent verification without trusting the original builder</p> +</li> +<li> +<p>drastrically reduce insider and supply chain attack surface</p> +<div class="olist arabic"> +<ol class="arabic"> +<li> +<p>Zero Trust:</p> +</li> +</ol> +</div> +</li> +<li> +<p>never trust, always verify!</p> +</li> +<li> +<p>verifiable evidence (rebuild && compare)</p> +</li> +<li> +<p>eliminates implicit trust in build pipeline</p> +</li> +<li> +<p>build system considered untrustworthy</p> +</li> +<li> +<p>combine with signed artefacts and attestation frameworks for full supply chain integrity</p> +</li> +</ol> </div> <div class="sect3"> <h4 id="_the_whole_implementation">The whole implementation</h4> @@ -566,7 +630,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b </div> <div id="footer"> <div id="footer-text"> -Last updated 2026-03-14 18:58:41 +0100 +Last updated 2026-05-05 17:43:18 +0200 </div> </div> </body> |