From 2993aae60e019804e249de3f56e48eca365723df Mon Sep 17 00:00:00 2001
From: stefan <stefan@i3mint.local>
Date: Tue, 24 Feb 2026 20:36:44 +0100
Subject: Risk/Security Overlay im Business/Motivation Layer angefangen

---
 .../202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg             | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg

(limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg')

diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg
new file mode 100644
index 0000000..a1071dc
--- /dev/null
+++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.svg
@@ -0,0 +1 @@
+<?plantuml 1.2026.1?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" data-diagram-type="DESCRIPTION" height="854px" preserveAspectRatio="none" style="width:1654px;height:854px;background:#FFFFFF;" version="1.1" viewBox="0 0 1654 854" width="1654px" zoomAndPan="magnify"><defs/><g><g class="header" data-source-line="31"><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="422.9104" x="1217.4175" y="14.9659">Threat Model - Reproducible Builds according to SLSA Level 4</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="220.4198" x="1419.9081" y="29.7579">using independent GnuPG signatures and keys</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="262.5298" x="1377.7982" y="43.3779">as well as Reproducible Builds according to SLSA Level 4</text><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="414.2194" x="1226.1085" y="56.9979">corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD</text><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="112.6295" x="1527.6984" y="74.8938">2026-02-24 12:20</text></g><!--cluster Maintainer--><g class="cluster" data-qualified-name="Maintainer" data-source-line="67" id="ent0009"><rect fill="#FFF6F6" height="107" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="468.73" x="306.8284" y="472.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="66.2045" x="508.0911" y="487.8239">Maintainer</text></g><!--cluster Independent build pipelines\n(at least 2)--><g class="cluster" data-qualified-name="Independent build pipelines.n.at least 2." data-source-line="72" id="ent0012"><rect fill="#FFF6F6" height="179" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="183" x="904.6384" y="512.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="167.9652" x="912.1558" y="527.8239">Independent build pipelines</text><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="62.7964" x="964.7401" y="544.168">(at least 2)</text></g><!--cluster Download artefacts--><g class="cluster" data-qualified-name="Download artefacts" data-source-line="87" id="ent0018"><rect fill="#FFF6F6" height="191" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="172" x="1217.9884" y="521.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="117.5048" x="1245.236" y="536.8239">Download artefacts</text></g><!--cluster Operational environment\n(of the downloader)--><g class="cluster" data-qualified-name="Operational environment.n.of the downloader." data-source-line="95" id="ent0023"><rect fill="#FFF6F6" height="224" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:1;" width="505.16" x="586.8284" y="86.9958"/><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="152.7131" x="763.0518" y="101.8239">Operational environment</text><text fill="#000000" font-family="Verdana" font-size="12" font-weight="bold" lengthAdjust="spacing" textLength="118.2248" x="780.296" y="118.168">(of the downloader)</text></g><!--entity Source--><g class="entity" data-qualified-name="Maintainer.Source" data-source-line="68" id="ent0010"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="619.5584" y="508.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.7483" x="654.1281" y="531.2339">Source</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="692.8764" y="531.2339">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="28.9922" x="695.9964" y="531.2339">Code</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.1121" x="656.9648" y="550.0647">(in</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="671.0769" y="550.0647">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="19.7641" x="674.1969" y="550.0647">Git)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="9.3601" x="693.9611" y="550.0647">&#160;&#160;&#160;</text><path d="M716.1997,546.6202 L717.7536,548.1282 C717.7536,548.1282 715.848,550.886 713.8098,550.941 C713.854,550.941 713.8206,543.1787 713.8134,541.2975 C715.1698,540.8547 716.1582,539.6191 716.1582,538.1482 C716.1582,536.3012 714.6169,534.805 712.7176,534.805 C710.8147,534.805 709.2734,536.3012 709.2734,538.1473 C709.2734,539.5938 710.2312,540.8177 711.5579,541.2822 L711.5669,550.9077 C709.1075,550.7382 707.6843,548.3717 707.6843,548.3717 L709.3456,546.7646 L703.3211,545.8734 L704.2338,551.7166 L705.8364,550.1663 C707.2244,551.2837 708.7919,553.6042 712.5635,553.6042 C717.3018,553.4834 718.3958,550.9329 719.6106,549.93 L721.3638,551.639 L722.2305,545.7399 L716.1997,546.6202 M710.9419,538.0922 C710.9419,537.1416 711.7365,536.3696 712.7159,536.3696 C713.6952,536.3696 714.4934,537.1416 714.4934,538.0922 C714.4934,539.0454 713.6952,539.8166 712.7159,539.8166 C711.7365,539.8166 710.9419,539.0454 710.9419,538.0922" fill="#007F00"/></g><!--entity Tag--><g class="entity" data-qualified-name="Maintainer.Tag" data-source-line="69" id="ent0011"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="322.8284" y="508.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="16.1641" x="349.562" y="531.2339">Git</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="365.7262" y="531.2339">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.3443" x="368.8462" y="531.2339">Release</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="412.1905" y="531.2339">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="20.7841" x="415.3105" y="531.2339">Tag</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="88.4166" x="334.5246" y="550.0647">(GnuPG-signed)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="9.3601" x="422.9413" y="550.0647">&#160;&#160;&#160;</text><path d="M445.1799,546.6202 L446.7338,548.1282 C446.7338,548.1282 444.8282,550.886 442.79,550.941 C442.8342,550.941 442.8008,543.1787 442.7936,541.2975 C444.1499,540.8547 445.1384,539.6191 445.1384,538.1482 C445.1384,536.3012 443.5971,534.805 441.6978,534.805 C439.7949,534.805 438.2536,536.3012 438.2536,538.1473 C438.2536,539.5938 439.2114,540.8177 440.538,541.2822 L440.5471,550.9077 C438.0877,550.7382 436.6645,548.3717 436.6645,548.3717 L438.3258,546.7646 L432.3013,545.8734 L433.214,551.7166 L434.8166,550.1663 C436.2046,551.2837 437.772,553.6042 441.5436,553.6042 C446.282,553.4834 447.376,550.9329 448.5908,549.93 L450.344,551.639 L451.2107,545.7399 L445.1799,546.6202 M439.9221,538.0922 C439.9221,537.1416 440.7167,536.3696 441.696,536.3696 C442.6754,536.3696 443.4736,537.1416 443.4736,538.0922 C443.4736,539.0454 442.6754,539.8166 441.696,539.8166 C440.7167,539.8166 439.9221,539.0454 439.9221,538.0922" fill="#007F00"/></g><!--entity B1--><g class="entity" data-qualified-name="Independent build pipelines.n.at least 2..B1" data-source-line="73" id="ent0013"><rect fill="#FFF6F6" height="38.8308" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="925.6384" y="637.5758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.5042" x="958.3348" y="662.8905">Pipe</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="982.839" y="662.8905">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.6681" x="985.959" y="662.8905">A</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="993.627" y="662.8905">&#160;&#160;</text><path d="M1012.7457,659.4461 L1014.2996,660.954 C1014.2996,660.954 1012.394,663.7119 1010.3557,663.7669 C1010.4,663.7669 1010.3665,656.0046 1010.3593,654.1234 C1011.7157,653.6806 1012.7041,652.445 1012.7041,650.9741 C1012.7041,649.1271 1011.1629,647.6309 1009.2636,647.6309 C1007.3606,647.6309 1005.8194,649.1271 1005.8194,650.9732 C1005.8194,652.4197 1006.7772,653.6436 1008.1038,654.108 L1008.1128,663.7336 C1005.6535,663.564 1004.2303,661.1976 1004.2303,661.1976 L1005.8916,659.5905 L999.8671,658.6993 L1000.7797,664.5425 L1002.3824,662.9922 C1003.7703,664.1096 1005.3378,666.4301 1009.1094,666.4301 C1013.8477,666.3093 1014.9418,663.7588 1016.1565,662.7559 L1017.9097,664.4649 L1018.7764,658.5658 L1012.7457,659.4461 M1007.4878,650.9181 C1007.4878,649.9675 1008.2824,649.1955 1009.2618,649.1955 C1010.2412,649.1955 1011.0394,649.9675 1011.0394,650.9181 C1011.0394,651.8713 1010.2412,652.6425 1009.2618,652.6425 C1008.2824,652.6425 1007.4878,651.8713 1007.4878,650.9181" fill="#8FED8F"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.2441" x="1018.6979" y="662.8905">b1</text></g><!--entity B2--><g class="entity" data-qualified-name="Independent build pipelines.n.at least 2..B2" data-source-line="74" id="ent0014"><rect fill="#FFF6F6" height="38.8308" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="925.6384" y="563.5758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.5042" x="958.2688" y="588.8905">Pipe</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="982.773" y="588.8905">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.8" x="985.893" y="588.8905">B</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="993.693" y="588.8905">&#160;&#160;</text><path d="M1012.8117,585.4461 L1014.3656,586.954 C1014.3656,586.954 1012.46,589.7119 1010.4217,589.7669 C1010.4659,589.7669 1010.4325,582.0046 1010.4253,580.1234 C1011.7817,579.6806 1012.7701,578.445 1012.7701,576.9741 C1012.7701,575.1271 1011.2289,573.6309 1009.3295,573.6309 C1007.4266,573.6309 1005.8854,575.1271 1005.8854,576.9732 C1005.8854,578.4197 1006.8431,579.6436 1008.1698,580.108 L1008.1788,589.7336 C1005.7195,589.564 1004.2963,587.1976 1004.2963,587.1976 L1005.9575,585.5905 L999.9331,584.6993 L1000.8457,590.5425 L1002.4484,588.9922 C1003.8363,590.1096 1005.4038,592.4301 1009.1754,592.4301 C1013.9137,592.3093 1015.0078,589.7588 1016.2225,588.7559 L1017.9757,590.4649 L1018.8424,584.5658 L1012.8117,585.4461 M1007.5538,576.9181 C1007.5538,575.9675 1008.3484,575.1955 1009.3278,575.1955 C1010.3072,575.1955 1011.1054,575.9675 1011.1054,576.9181 C1011.1054,577.8713 1010.3072,578.6425 1009.3278,578.6425 C1008.3484,578.6425 1007.5538,577.8713 1007.5538,576.9181" fill="#8FED8F"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.2441" x="1018.7639" y="588.8905">b2</text></g><!--entity A1--><g class="entity" data-qualified-name="Download artefacts.A1" data-source-line="88" id="ent0019"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="1233.9884" y="644.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="44.6763" x="1276.2562" y="667.4839">Artefact</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1320.9325" y="667.4839">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.6681" x="1324.0525" y="667.4839">A</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="65.5205" x="1271.2281" y="683.828">(Checksum)</text></g><!--entity A2--><g class="entity" data-qualified-name="Download artefacts.A2" data-source-line="89" id="ent0020"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="1233.9884" y="556.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="44.6763" x="1276.1902" y="579.4839">Artefact</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1320.8665" y="579.4839">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="7.8" x="1323.9865" y="579.4839">B</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="65.5205" x="1271.2281" y="595.828">(Checksum)</text></g><!--entity Keys--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Keys" data-source-line="96" id="ent0024"><rect fill="#FFF6F6" height="69.0323" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="173.4571" x="602.8284" y="138.4758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.9523" x="615.0484" y="161.3039">Known</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="654.0006" y="161.3039">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="34.1282" x="657.1207" y="161.3039">public</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="691.2489" y="161.3039">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="41.5323" x="694.3689" y="161.3039">signing</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="735.9012" y="161.3039">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.0442" x="739.0212" y="161.3039">keys</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="53.9644" x="625.2424" y="177.648">(obtained</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="679.2068" y="177.648">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.5642" x="682.3268" y="177.648">from</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="709.891" y="177.648">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="11.0641" x="713.0111" y="177.648">at</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="724.0751" y="177.648">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="26.6762" x="727.1952" y="177.648">least</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="612.8284" y="193.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="615.9484" y="193.9921">2</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="622.8124" y="193.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="72.1205" x="625.9325" y="193.9921">independent</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="698.053" y="193.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="26.7842" x="701.173" y="193.9921">trust</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="727.9572" y="193.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="35.2082" x="731.0772" y="193.9921">paths)</text></g><!--entity Rebuild--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Rebuild" data-source-line="97" id="ent0025"><rect fill="#FFF6F6" height="52.6882" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="140" x="619.5584" y="242.6558"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="42.6003" x="644.198" y="265.4839">Rebuild</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="686.7983" y="265.4839">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="45.0003" x="689.9184" y="265.4839">pipeline</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="81.9246" x="648.5961" y="281.828">(Reproducible)</text></g><!--entity Policy--><g class="entity" data-qualified-name="Operational environment.n.of the downloader..Policy" data-source-line="98" id="ent0026"><rect fill="#FFF6F6" height="69.0323" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="160.701" x="915.2884" y="146.4758"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="63.8405" x="945.8025" y="169.3039">Verification</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1009.643" y="169.3039">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="32.7122" x="1012.763" y="169.3039">policy</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="925.2884" y="185.648">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="84.8526" x="928.4084" y="185.648">(organisational</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1013.261" y="185.648">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.6084" x="1016.381" y="185.648">measure</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="959.0806" y="201.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.5642" x="962.2006" y="201.9921">from</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="989.7648" y="201.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="18.4561" x="992.8849" y="201.9921">BSI</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1011.341" y="201.9921">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="17.7361" x="1014.461" y="201.9921">TR)</text></g><!--entity User--><g class="entity" data-qualified-name="User" data-source-line="55" id="ent0002"><ellipse cx="1303.9884" cy="199.1558" fill="#008000" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,207.1558 L1303.9884,234.1558 M1290.9884,215.1558 L1316.9884,215.1558 M1303.9884,234.1558 L1290.9884,249.1558 M1303.9884,234.1558 L1316.9884,249.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="69.0605" x="1269.4581" y="263.4839">Downloader</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="48.1684" x="1279.9042" y="279.828">(Verifier)</text></g><!--entity Net--><g class="entity" data-qualified-name="Net" data-source-line="56" id="ent0003"><ellipse cx="392.8284" cy="361.1558" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,369.1558 L392.8284,396.1558 M379.8284,377.1558 L405.8284,377.1558 M392.8284,396.1558 L379.8284,411.1558 M392.8284,396.1558 L405.8284,411.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="46.0563" x="369.8002" y="425.4839">Internet</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="56.1004" x="364.7782" y="441.828">(Insecure)</text></g><!--entity NTP1--><g class="entity" data-qualified-name="NTP1" data-source-line="57" id="ent0004"><ellipse cx="1303.9884" cy="327.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,335.3258 L1303.9884,362.3258 M1290.9884,343.3258 L1316.9884,343.3258 M1303.9884,362.3258 L1290.9884,377.3258 M1303.9884,362.3258 L1316.9884,377.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="23.0522" x="1267.8441" y="391.6539">NTP</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1290.8963" y="391.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.1323" x="1294.0163" y="391.6539">Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1330.1486" y="391.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="1333.2686" y="391.6539">1</text></g><!--entity NTP2--><g class="entity" data-qualified-name="NTP2" data-source-line="58" id="ent0005"><ellipse cx="1303.9884" cy="438.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M1303.9884,446.3258 L1303.9884,473.3258 M1290.9884,454.3258 L1316.9884,454.3258 M1303.9884,473.3258 L1290.9884,488.3258 M1303.9884,473.3258 L1316.9884,488.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="23.0522" x="1267.8441" y="502.6539">NTP</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1290.8963" y="502.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.1323" x="1294.0163" y="502.6539">Server</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1330.1486" y="502.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="1333.2686" y="502.6539">2</text></g><!--entity Attacker--><g class="entity" data-qualified-name="Attacker" data-source-line="59" id="ent0006"><ellipse cx="57.8284" cy="498.1558" fill="#FF0000" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M57.8284,506.1558 L57.8284,533.1558 M44.8284,514.1558 L70.8284,514.1558 M57.8284,533.1558 L44.8284,548.1558 M57.8284,533.1558 L70.8284,548.1558" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="46.9563" x="34.3502" y="562.4839">Attacker</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.0323" x="6" y="578.828">(Insider</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="49.0323" y="578.828">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="4.464" x="52.1523" y="578.828">/</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="56.6164" y="578.828">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.9203" x="59.7364" y="578.828">External)</text></g><!--entity Keyserver1--><g class="entity" data-qualified-name="Keyserver1" data-source-line="63" id="ent0007"><ellipse cx="392.8284" cy="215.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,223.3258 L392.8284,250.3258 M379.8284,231.3258 L405.8284,231.3258 M392.8284,250.3258 L379.8284,265.3258 M392.8284,250.3258 L405.8284,265.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="55.6084" x="360.0321" y="279.6539">Keyserver</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="415.6405" y="279.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="418.7606" y="279.6539">1</text></g><!--entity Keyserver2--><g class="entity" data-qualified-name="Keyserver2" data-source-line="64" id="ent0008"><ellipse cx="392.8284" cy="104.3258" fill="#FFFFFF" rx="8" ry="8" style="stroke:#181818;stroke-width:0.5;"/><path d="M392.8284,112.3258 L392.8284,139.3258 M379.8284,120.3258 L405.8284,120.3258 M392.8284,139.3258 L379.8284,154.3258 M392.8284,139.3258 L405.8284,154.3258" fill="none" style="stroke:#181818;stroke-width:0.5;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="55.6084" x="360.0321" y="168.6539">Keyserver</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="415.6405" y="168.6539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.864" x="418.7606" y="168.6539">2</text></g><!--entity TAb--><g class="entity" data-qualified-name="TAb" data-source-line="280" id="ent0015"><path d="M631.5584,611.3258 L747.5584,611.3258 L759.5584,623.3258 L759.5584,654.6699 L747.5584,666.6699 L631.5584,666.6699 L619.5584,654.6699 L619.5584,623.3258 L631.5584,611.3258" fill="#CCCCFF" style="stroke:#181818;stroke-width:0.5;"/><path d="M740.5834,625.0798 A0.5,0.5 0 0 0 740.5622,625.0896 A0.5,0.5 0 0 0 740.5425,625.0818 C737.1233,625.1283 734.3765,627.9458 734.4173,631.3651 C734.4581,634.7844 737.2694,637.5346 740.6888,637.4996 C744.1082,637.4646 746.8649,634.6574 746.8357,631.238 C746.8066,627.8186 744.0029,625.0563 740.5834,625.0797 M740.5818,626.0699 A0.5,0.5 0 0 0 740.5911,626.0797 C743.4708,626.06 745.8112,628.3662 745.8357,631.2458 C745.8602,634.1254 743.559,636.4703 740.6794,636.4997 C737.7998,636.5292 735.452,634.2328 735.4177,631.3532 C735.3833,628.4737 737.6764,626.1209 740.5559,626.0817 A0.5,0.5 0 0 0 740.5817,626.0698 M740.5735,627.4218 C738.4451,627.4508 736.7318,629.2073 736.7572,631.3358 C736.7825,633.4643 738.537,635.1816 740.6655,635.1599 C742.794,635.1382 744.5139,633.3864 744.4958,631.2578 C744.4776,629.1293 742.728,627.4073 740.5994,627.4219 A0.5,0.5 0 0 0 740.5875,627.4333 A0.5,0.5 0 0 0 740.5735,627.4219 M740.6009,628.4156 A0.5,0.5 0 0 0 740.6071,628.4218 C742.1958,628.4109 743.4823,629.6768 743.4958,631.2656 C743.5093,632.8543 742.2444,634.1438 740.6557,634.16 C739.067,634.1762 737.7761,632.9127 737.7572,631.324 C737.7382,629.7353 738.9989,628.4435 740.5875,628.4219 A0.5,0.5 0 0 0 740.6009,628.4157 M740.603,629.6031 C739.6837,629.6156 738.9281,630.3912 738.939,631.3105 C738.9499,632.2298 739.7249,632.9875 740.6443,632.9781 C741.5636,632.9687 742.3218,632.1947 742.314,631.2754 C742.3062,630.356 741.5342,629.5969 740.6149,629.6032 A0.959,0.959 0 0 0 740.6087,629.6094 A0.959,0.959 0 0 0 740.603,629.6032" fill="#000000"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="56.2804" x="645.296" y="653.1539">combined</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="701.5764" y="653.1539">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="29.1242" x="704.6965" y="653.1539">Trust</text></g><!--entity Log--><g class="entity" data-qualified-name="Log" data-source-line="92" id="ent0021"><rect fill="#FFF6F6" height="55.1749" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="152.3396" x="1495.9884" y="426.4058"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="16.1641" x="1512.1637" y="449.2339">Git</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1528.3278" y="449.2339">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.6565" x="1531.4479" y="449.2339">Transparency</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1608.1044" y="449.2339">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="20.9281" x="1611.2244" y="449.2339">Log</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="107.2687" x="1505.9884" y="468.0647">(tamper-hardened)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="1613.2571" y="468.0647">&#160;&#160;</text><path d="M1632.3757,464.6202 L1633.9296,466.1282 C1633.9296,466.1282 1632.024,468.886 1629.9858,468.941 C1630.03,468.941 1629.9966,461.1787 1629.9894,459.2975 C1631.3458,458.8547 1632.3342,457.6191 1632.3342,456.1482 C1632.3342,454.3012 1630.7929,452.805 1628.8936,452.805 C1626.9907,452.805 1625.4494,454.3012 1625.4494,456.1473 C1625.4494,457.5938 1626.4072,458.8177 1627.7339,459.2822 L1627.7429,468.9077 C1625.2836,468.7382 1623.8604,466.3717 1623.8604,466.3717 L1625.5216,464.7646 L1619.4972,463.8734 L1620.4098,469.7166 L1622.0124,468.1663 C1623.4004,469.2837 1624.9679,471.6042 1628.7395,471.6042 C1633.4778,471.4834 1634.5718,468.9329 1635.7866,467.93 L1637.5398,469.639 L1638.4065,463.7399 L1632.3757,464.6202 M1627.1179,456.0922 C1627.1179,455.1416 1627.9125,454.3696 1628.8919,454.3696 C1629.8712,454.3696 1630.6694,455.1416 1630.6694,456.0922 C1630.6694,457.0454 1629.8712,457.8166 1628.8919,457.8166 C1627.9125,457.8166 1627.1179,457.0454 1627.1179,456.0922" fill="#007F00"/></g><!--entity Ledger--><g class="entity" data-qualified-name="Ledger" data-source-line="93" id="ent0022"><rect fill="#FFF6F6" height="71.519" rx="0.5" ry="0.5" style="stroke:#550000;stroke-width:0.5;" width="150.1289" x="1497.0884" y="621.2358"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="63.2645" x="1507.0884" y="644.0639">Distributed</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1570.3528" y="644.0639">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="36.3483" x="1573.4728" y="644.0639">ledger</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1609.8211" y="644.0639">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="24.2762" x="1612.9411" y="644.0639">with</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1514.0364" y="660.408">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.8803" x="1517.1564" y="660.408">Merkle</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1556.0367" y="660.408">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="25.1642" x="1559.1567" y="660.408">Tree</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1584.3209" y="660.408">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="42.8283" x="1587.4409" y="660.408">records</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1524.0852" y="679.2388">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="67.9445" x="1527.2052" y="679.2388">(Blockchain)</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="6.2401" x="1595.1497" y="679.2388">&#160;&#160;</text><path d="M1614.2683,675.7943 L1615.8222,677.3023 C1615.8222,677.3023 1613.9166,680.0601 1611.8784,680.1152 C1611.9226,680.1152 1611.8892,672.3528 1611.882,670.4716 C1613.2383,670.0288 1614.2268,668.7933 1614.2268,667.3223 C1614.2268,665.4753 1612.6855,663.9791 1610.7862,663.9791 C1608.8833,663.9791 1607.342,665.4753 1607.342,667.3214 C1607.342,668.768 1608.2998,669.9918 1609.6264,670.4563 L1609.6355,680.0818 C1607.1761,679.9123 1605.7529,677.5458 1605.7529,677.5458 L1607.4142,675.9387 L1601.3897,675.0476 L1602.3024,680.8907 L1603.905,679.3404 C1605.2929,680.4578 1606.8604,682.7783 1610.632,682.7783 C1615.3704,682.6575 1616.4644,680.107 1617.6792,679.1041 L1619.4324,680.8131 L1620.299,674.914 L1614.2683,675.7943 M1609.0105,667.2663 C1609.0105,666.3157 1609.805,665.5437 1610.7844,665.5437 C1611.7638,665.5437 1612.562,666.3157 1612.562,667.2663 C1612.562,668.2196 1611.7638,668.9907 1610.7844,668.9907 C1609.805,668.9907 1609.0105,668.2196 1609.0105,667.2663" fill="#007F00"/></g><!--reverse link TAb to B1--><g class="link" data-entity-1="ent0015" data-entity-2="ent0013" data-link-type="aggregation" data-source-line="79" id="lnk16"><path d="M771.541,665.2931 C786.641,669.3831 791.0784,669.8658 806.2884,671.9958 C845.5984,677.4958 889.8184,674.4358 925.5384,669.6958" fill="none" id="TAb-backto-B1" style="stroke:#000000;stroke-width:1;"/><polygon fill="none" points="759.9584,662.1558,764.7039,667.5853,771.541,665.2931,766.7954,659.8636,759.9584,662.1558" style="stroke:#000000;stroke-width:1;"/><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6484" x="807.2884" y="667.8239">combines</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="861.9368" y="667.8239">&#160;</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.3401" x="865.0568" y="667.8239">TA</text></g><!--reverse link TAb to B2--><g class="link" data-entity-1="ent0015" data-entity-2="ent0014" data-link-type="aggregation" data-source-line="80" id="lnk17"><path d="M771.7399,624.0423 C821.2599,614.9223 875.7784,604.8858 925.2884,595.7658" fill="none" id="TAb-backto-B2" style="stroke:#000000;stroke-width:1;"/><polygon fill="none" points="759.9384,626.2158,766.5636,629.0629,771.7399,624.0423,765.1146,621.1952,759.9384,626.2158" style="stroke:#000000;stroke-width:1;"/><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="54.6484" x="807.2884" y="600.1639">combines</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="861.9368" y="600.1639">&#160;</text><text fill="#008000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="14.3401" x="865.0568" y="600.1639">TA</text></g><!--link NTP1 to Log--><g class="link" data-entity-1="ent0004" data-entity-2="ent0021" data-link-type="dependency" data-source-line="101" id="lnk27"><path d="M1364.3884,378.6458 C1403.1484,392.7658 1448.4613,409.2807 1490.0713,424.4507" fill="none" id="NTP1-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1495.7084,426.5058,1488.6229,419.6651,1491.0108,424.7932,1485.8827,427.1811,1495.7084,426.5058" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.7562" x="1422.4884" y="389.7839">Time</text></g><!--link NTP2 to Log--><g class="link" data-entity-1="ent0005" data-entity-2="ent0021" data-link-type="dependency" data-source-line="102" id="lnk28"><path d="M1364.3884,464.8758 C1403.1484,462.8358 1448.1067,460.4711 1489.7167,458.2811" fill="none" id="NTP2-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1495.7084,457.9658,1486.5106,454.4444,1490.7153,458.2286,1486.931,462.4333,1495.7084,457.9658" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="27.7562" x="1422.4884" y="455.5739">Time</text></g><!--link Keyserver1 to Keys--><g class="link" data-entity-1="ent0007" data-entity-2="ent0024" data-link-type="dependency" data-source-line="104" id="lnk29"><path d="M453.1184,230.5158 C495.9784,220.0358 548.7199,207.1601 596.7199,195.4301" fill="none" id="Keyserver1-to-Keys" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="602.5484,194.0058,592.8561,192.2566,597.6913,195.1927,594.7552,200.028,602.5484,194.0058" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.4884" x="507.3284" y="198.3739">retrieves</text></g><!--link Keyserver2 to Keys--><g class="link" data-entity-1="ent0008" data-entity-2="ent0024" data-link-type="dependency" data-source-line="105" id="lnk30"><path d="M453.1184,141.8458 C495.9784,147.5158 548.6002,154.4789 596.6002,160.8289" fill="none" id="Keyserver2-to-Keys" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="602.5484,161.6158,594.1507,156.47,597.5915,160.9601,593.1015,164.4009,602.5484,161.6158" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="49.4884" x="507.3284" y="143.5539">retrieves</text></g><!--link Source to B1--><g class="link" data-entity-1="ent0010" data-entity-2="ent0013" data-link-type="dependency" data-source-line="107" id="lnk31"><path d="M735.3384,563.9058 C764.5884,581.9858 798.6984,602.7558 806.2884,605.9958 C844.4384,622.3158 883.3652,633.3328 919.6752,641.8028" fill="none" id="Source-to-B1" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="925.5184,643.1658,917.6623,637.2258,920.6491,642.0299,915.845,645.0167,925.5184,643.1658" style="stroke:#000000;stroke-width:1;"/></g><!--link Source to B2--><g class="link" data-entity-1="ent0010" data-entity-2="ent0014" data-link-type="dependency" data-source-line="108" id="lnk32"><path d="M759.9084,538.2458 C796.0184,540.2358 840.7584,543.9758 880.2884,550.9958 C897.2384,554.0058 909.5088,556.8442 926.1488,561.4842" fill="none" id="Source-to-B2" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="931.9284,563.0958,924.3335,556.8254,927.1121,561.7528,922.1847,564.5314,931.9284,563.0958" style="stroke:#000000;stroke-width:1;"/></g><!--link B1 to A1--><g class="link" data-entity-1="ent0013" data-entity-2="ent0019" data-link-type="dependency" data-source-line="110" id="lnk33"><path d="M1065.7684,660.1558 C1115.8884,662.4458 1177.3947,665.2511 1227.5847,667.5511" fill="none" id="B1-to-A1" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1233.5784,667.8258,1224.7709,663.418,1228.5836,667.5969,1224.4047,671.4096,1233.5784,667.8258" style="stroke:#000000;stroke-width:1;"/></g><!--link B2 to A2--><g class="link" data-entity-1="ent0014" data-entity-2="ent0020" data-link-type="dependency" data-source-line="111" id="lnk34"><path d="M1065.7684,582.9958 C1115.8884,582.9958 1177.3884,582.9958 1227.5784,582.9958" fill="none" id="B2-to-A2" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1233.5784,582.9958,1224.5784,578.9958,1228.5784,582.9958,1224.5784,586.9958,1233.5784,582.9958" style="stroke:#000000;stroke-width:1;"/></g><!--link A1 to Log--><g class="link" data-entity-1="ent0019" data-entity-2="ent0021" data-link-type="dependency" data-source-line="113" id="lnk35"><path d="M1374.2584,645.2158 C1382.9184,640.0658 1391.1184,634.0258 1397.9884,626.9958 C1404.0984,620.7358 1400.6784,615.9558 1405.9884,608.9958 C1426.8784,581.6358 1440.4984,583.1358 1465.9884,559.9958 C1494.0084,534.5558 1520.1393,507.9995 1540.9693,486.1395" fill="none" id="A1-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1545.1084,481.7958,1536.0039,485.552,1541.6591,485.4156,1541.7956,491.0708,1545.1084,481.7958" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="555.8239">Checksum</text></g><!--link A2 to Log--><g class="link" data-entity-1="ent0020" data-entity-2="ent0021" data-link-type="dependency" data-source-line="114" id="lnk36"><path d="M1360.1384,556.2658 C1404.9084,534.5658 1462.439,506.6824 1507.919,484.6424" fill="none" id="A2-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1513.3184,482.0258,1503.4749,482.3511,1508.8189,484.2063,1506.9637,489.5503,1513.3184,482.0258" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="502.7739">Checksum</text></g><!--link A1 to Ledger--><g class="link" data-entity-1="ent0019" data-entity-2="ent0022" data-link-type="dependency" data-source-line="116" id="lnk37"><path d="M1374.4684,686.6258 C1402.8984,690.9858 1436.0784,693.4458 1465.9884,688.9958 C1476.0884,687.4958 1480.7507,686.7329 1491.0007,684.0729" fill="none" id="A1-to-Ledger" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1496.8084,682.5658,1487.0922,680.9548,1491.9687,683.8218,1489.1017,688.6983,1496.8084,682.5658" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="684.8239">Checksum</text></g><!--link A2 to Ledger--><g class="link" data-entity-1="ent0020" data-entity-2="ent0022" data-link-type="dependency" data-source-line="117" id="lnk38"><path d="M1362.1284,609.7958 C1374.0084,615.4258 1386.4184,621.3658 1397.9884,626.9958 C1401.5584,628.7358 1402.1984,629.7858 1405.9884,630.9958 C1435.0184,640.2858 1462.0725,645.5315 1490.9025,649.4315" fill="none" id="A2-to-Ledger" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1496.8484,650.2358,1488.4658,645.0654,1491.8935,649.5655,1487.3934,652.9932,1496.8484,650.2358" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="58.3204" x="1406.9884" y="626.8239">Checksum</text></g><!--link Tag to Source--><g class="link" data-entity-1="ent0011" data-entity-2="ent0010" data-link-type="dependency" data-source-line="119" id="lnk39"><path d="M463.2984,535.9958 C510.3584,535.9958 566.2884,535.9958 613.2984,535.9958" fill="none" id="Tag-to-Source" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="619.2984,535.9958,610.2984,531.9958,614.2984,535.9958,610.2984,539.9958,619.2984,535.9958" style="stroke:#000000;stroke-width:1;"/></g><!--link Net to User--><g class="link" data-entity-1="ent0003" data-entity-2="ent0002" data-link-type="dependency" data-source-line="121" id="lnk40"><path d="M453.2284,396.1158 C575.7084,389.2058 864.5984,367.7958 1099.9884,310.9958 C1149.5784,299.0258 1198.2113,281.1584 1238.1213,264.9084" fill="none" id="Net-to-User" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1243.6784,262.6458,1233.8344,262.3351,1239.0475,264.5313,1236.8512,269.7444,1243.6784,262.6458" style="stroke:#000000;stroke-width:1;"/></g><!--link Attacker to B1--><g class="link" data-entity-1="ent0006" data-entity-2="ent0013" data-link-type="dependency" data-source-line="122" id="lnk41"><path d="M118.1084,558.7258 C213.4484,593.9358 407.5484,660.0958 578.8284,683.9958 C668.9484,696.5658 692.5684,684.4658 783.5584,683.9958 C826.5484,683.7758 837.5884,688.0158 880.2884,682.9958 C894.9484,681.2758 904.6035,679.7119 919.3335,676.5319" fill="none" id="Attacker-to-B1" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="925.1984,675.2658,915.5569,673.2551,920.311,676.3209,917.2451,681.0749,925.1984,675.2658" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.4166" x="493.8284" y="665.3739">compromises</text></g><!--link Attacker to Net--><g class="link" data-entity-1="ent0006" data-entity-2="ent0003" data-link-type="dependency" data-source-line="123" id="lnk42"><path d="M117.9784,511.6658 C178.4384,486.7858 266.2696,450.6487 326.8396,425.7287" fill="none" id="Attacker-to-Net" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="332.3884,423.4458,322.5433,423.171,327.7644,425.3482,325.5872,430.5693,332.3884,423.4458" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="45.8283" x="196.8284" y="439.1339">controls</text></g><!--link Attacker to Tag--><g class="link" data-entity-1="ent0006" data-entity-2="ent0011" data-link-type="dependency" data-source-line="124" id="lnk43"><path d="M117.9784,535.9958 C175.2584,535.9958 256.0984,535.9958 316.5784,535.9958" fill="none" id="Attacker-to-Tag" style="stroke:#FF0000;stroke-width:1;"/><polygon fill="#FF0000" points="322.5784,535.9958,313.5784,531.9958,317.5784,535.9958,313.5784,539.9958,322.5784,535.9958" style="stroke:#FF0000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="76.4166" x="148.8284" y="531.8239">compromises</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="225.2449" y="531.8239">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="39.3603" x="228.365" y="531.8239">private</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="267.7252" y="531.8239">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="19.2961" x="270.8453" y="531.8239">key</text></g><!--link User to Rebuild--><g class="link" data-entity-1="ent0002" data-entity-2="ent0025" data-link-type="dependency" data-source-line="129" id="lnk44"><path d="M1243.7984,240.0858 C1130.0084,246.0358 887.2602,258.7227 765.9102,265.0627" fill="none" id="User-to-Rebuild" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="759.9184,265.3758,769.1148,268.9008,764.9116,265.1149,768.6974,260.9117,759.9184,265.3758" style="stroke:#000000;stroke-width:1;"/></g><!--link User to Log--><g class="link" data-entity-1="ent0002" data-entity-2="ent0021" data-link-type="dependency" data-source-line="130" id="lnk45"><path d="M1364.2984,276.2258 C1375.6584,284.1858 1387.3284,292.6658 1397.9884,300.9958 C1450.6284,342.1158 1503.6696,390.3637 1537.3796,421.9437" fill="none" id="User-to-Log" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1541.7584,426.0458,1537.925,416.9736,1538.1094,422.6274,1532.4556,422.8119,1541.7584,426.0458" style="stroke:#000000;stroke-width:1;"/></g><!--link Keys to Policy--><g class="link" data-entity-1="ent0024" data-entity-2="ent0026" data-link-type="dependency" data-source-line="131" id="lnk46"><path d="M776.4784,175.2558 C819.9384,176.3958 866.3704,177.618 908.9304,178.738" fill="none" id="Keys-to-Policy" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="914.9284,178.8958,906.0367,174.6604,909.9301,178.7643,905.8262,182.6577,914.9284,178.8958" style="stroke:#000000;stroke-width:1;"/></g><!--link Rebuild to Policy--><g class="link" data-entity-1="ent0025" data-entity-2="ent0026" data-link-type="dependency" data-source-line="132" id="lnk47"><path d="M759.9384,248.9158 C806.0384,235.5758 860.9449,219.6837 909.0449,205.7637" fill="none" id="Rebuild-to-Policy" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="914.8084,204.0958,905.0511,202.7554,910.0054,205.4857,907.2751,210.44,914.8084,204.0958" style="stroke:#000000;stroke-width:1;"/></g><!--link Policy to User--><g class="link" data-entity-1="ent0026" data-entity-2="ent0002" data-link-type="dependency" data-source-line="133" id="lnk48"><path d="M1076.3284,195.5658 C1128.6284,205.1258 1189.996,216.3479 1237.636,225.0479" fill="none" id="Policy-to-User" style="stroke:#000000;stroke-width:1;"/><polygon fill="#000000" points="1243.5384,226.1258,1235.4034,220.574,1238.6197,225.2276,1233.9662,228.4439,1243.5384,226.1258" style="stroke:#000000;stroke-width:1;"/><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="43.4403" x="1108.9884" y="198.1639">ACCEPT</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1152.4287" y="198.1639">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="4.464" x="1155.5487" y="198.1639">/</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="3.12" x="1160.0127" y="198.1639">&#160;</text><text fill="#000000" font-family="Verdana" font-size="12" lengthAdjust="spacing" textLength="38.3403" x="1163.1328" y="198.1639">REJECT</text></g><g class="caption" data-source-line="51"><text fill="#000000" font-family="sans-serif" font-size="18" font-weight="bold" lengthAdjust="spacing" textLength="543.7407" x="548.2936" y="738.2377">Threat Model - Reproducible Builds according to SLSA Level 4</text></g><g class="footer" data-source-line="39"><text fill="#888888" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="86.6457" x="1327.7104" y="760.4776">Advantages:</text><ellipse cx="1192.0734" cy="770.6995" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="356.9197" x="1198.5734" y="775.2695">Consistency between source code and binaries through Reproducible Builds</text><ellipse cx="1238.2084" cy="784.3195" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="264.6497" x="1244.7084" y="788.8895">No single trust anchor -&gt; at least 2 independent builders</text><ellipse cx="1170.1184" cy="797.9395" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="400.8296" x="1176.6184" y="802.5095">Subsequent manipulation detectable through checksums in the Git Transparency Log</text><ellipse cx="1221.2733" cy="811.5595" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="298.5198" x="1227.7733" y="816.1295">Insider attacks made more difficult through multiple signatures</text><ellipse cx="1107.2385" cy="825.1795" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="526.5894" x="1113.7385" y="829.7495">Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps</text><ellipse cx="1307.6333" cy="838.7995" fill="#888888" rx="2.5" ry="2.5"/><text fill="#888888" font-family="sans-serif" font-size="10" lengthAdjust="spacing" textLength="125.7999" x="1314.1333" y="843.3695">Each box is a trust boarder</text></g><?plantuml-src fLRRRkF84NtdLrGq6ymu86coUJTi0vB6DYPhpngMiY_POD4YMrB3l6X9IhPtiV-UqqrAbiQQm4duOBcxgaxTg_eliappTIRedDVfKXQy5QV3xN-NXf6BUKjjHRLSB5lAP2tILbQbqJpASiLhNf2wuUKY5_I7GJJYwUEYhjPbDgxoggOFrzVNuNMeA5MTYRg_3G87d_7d7avPjT-7k1wFmMny92huesZeGUI_qg8MOj-IOLrNJzTLsMgvytDD1-VbPS-g08PbkWGeRsZoymqrgrgsmkX-w0VU4S-RpO8sKZoDgkUBWKCECSUtuy3T_WukOUVvYhTBciiylnXySFGteEnYSETwYHsuiUcos0wI87T3E_Py4p-U5wQEwLZCiKFVDrbYnr5a-SoEM61wZkr77e1JzKzYWj5stSYAVTj960wEbrWk3F0Zbhg-7IQ-vTjH4faii7s7MMvikp7RdZnVIMiufSzn81n2ABAyq6PkR7cHpIAlFwNQ9ZU0SRZtNARCPP3fJuhBYJMQwGPs6BccwzXU59fmCc69oM2A7vkUPoUXcqDVWW30M1P5m8PYtxDSn46xwuIknI8uuX-UW9-xaPt0IFpuxYsKmQx02NA4AexCqBCznrKyNiYKFr4IfB37yK9msgw3C0BGZKpb7K8SCOGux4_A_C155Y0Ad4J1kR5lAHUyn8oG8D-taBtOyND4Cqay4p-1wqEz5oSM-1CdklqcmRy3zovcTX34VPmGSaI78GIn7JgnoamO8cA93dntQjGfYC3XXPxP7pfI7sR4bo7z25r7Y5rhZors9xrEFxG3Bp0FBFXzS7ffd9-YaD74-Bh-NGgE7ZGkQBgi1M_fhif4JXRQQLLNsJgLCxJnQ2tph26UfkXOMIvK-qzk9qEw5Hjm-yQwKRUopCHAu4_PqasvlaSpoKN9stMD_kHbHe_YfJ7GPqyYprM__NTAS0-WLLLkgUrIq1JDEKAJDwB6tCa5RmG1D1LDOzAUgg_o-QU9IP_5JF9I6_DLjAF9PtXEVyqmsJuDNl1PTtTMbj5oULOKWnC3plG1wiCrhp2JLBY6sOQNBL-8vipu6ushif5DAyhqXMQYVS9eeQPQrwcW507L-cQovBL49DebHjbYUSnxG7sjI0KJLsszRbhg1v1rISYEygybTX3fcP8KjPATh6UD-6sjRWjUojKwvseqKoPQDPALdgtoT2dInsPTDC3IWRoHBKrhNZQOdDgFsse1o2zm3EXGtc88Dy25EqLL2qp--LocwxpTOHOuo1MKlAOT23-A5ofaiqPY_bSxTFnQKQogckUaww3tR2CvjR8GJSkBbT9snTCbpQfdaYYbFeIpYgj5exBPvmzVobTwRVsVbG_CBPB1qnQP6dokdigyKbNpI_dfPr7BkHJroK1LuJzKcNwuqQkdv_vImg1IjE15h4MAg7MygCyjpzVfFKr4lO6msz6cz-uH8gCjbMsfGvqtRSesbQTqzQnqyhnJj6MX3myYCpxsWbCLEf6Xj8i2ct2hkJlYxDBtMTaXAwDTR50CpRuZkpFWth2mGnO5Oxo-BGPtNA83PIdgWNubx94cNU-DaL8uZif2LPqG5dI_p_zeKfwB2snJCrKlWmlz6lZpKYliX0y1LLK-zEDboXS0rGFEKfKkidT3GrGzMlQ0ltpRoRIIAv73gmPANbl-v8sFz-2ZuNzGdAk9rMkVTU4UkKSmHk_5wF8nOig5kwgL6zs3lzvKFFyq7SvC6gHLWJ67Kj0bCJX1ZUY7sN01Z8LcxpX7xYjtCp3f1-MnVgHT3BGwTTUAv_RWxiI0C5MM1NawWzdQo3DDlDoYqNHuVge9bw_ix5titRSNdsqh4wzRCKU1Dc_ICEmfD4I-nlqqwnlB_Gxhw2qh-wOkZer1IAan9sfhgGPQLtZlgZiro_VTmgwgvMojcZONsGAzzYJRvIybtOdw4HnJo2hBCVHGXlHfb5VfOxf4ixrReuOzSEadMAvB03DSb1jPLsM1ieTNrLoF_cmtEDzM-uybYBHQptAPwlsYXh5wJoZncHu36SthgjYjITXzk2YxPQ2UwCt9Rh8SQdaGXpq8yFrrq8drJ8UItPnFkwsqgc3bYmfSLI-mY9kjsmKCmu07HPiwcdoXwKE7UgzbL1MeuKuM5hxQV6SqnNfJT-pREsDlU2gIEe9M2-GMswanzYRdKRhHZqb5n6JOFp7367MeAE9H9uyQDORxbcrBs1YoOxSxvgx2Zl2_8HWOa9hKps03Ir2VrU8qTelA-gTQLV_IPaCShOmSuOq1duxmA0p5LBPrbH_bK5eFOF24LDDDg0epFfwUxbPRvr77lq07eg31lU6vp5vVFNGWmjudOXZwSQ1ujmMskr3jgxEd3dsXR4jrxwhxsSKB-eRZyTNz51l_uUhlL-Fflm40?></g></svg>
\ No newline at end of file
-- 
cgit v1.2.3