@startuml
left to right direction
skinparam rectangle {
  BackgroundColor #F9F9F9
  BorderColor #333
}


right header
= Threat Model - Integrity verification of download artifacts with key list!
using independent GnuPG signatures and public keys
as well as a key list with authorised signing keys
=  %date("yyyy-MM-dd hh:hh") UTC
endheader

right footer
* Maintainer publishes signed artifacts, public GnuPG keys and signed key list
* The key list or its signature is the central trust anchor
* Both are located in a central place!
* If the key list and the information about signature authorisation of the key list are replaced, manipulated artifacts with valid signatures can be distributed
* The security objective authenticity of the artifacts can therefore be violated
endfooter




actor "Downloader\n(Verifier)" as User #Green
actor "Attacker\n(MITM / Mirror)" as Attacker #Red
' actor "Keyserver" as Keyserver 
' actor "Website with signed key list\nand information about signature authorisation of the key list"  as WWW #Orange



rectangle "Maintainer" {
  rectangle "Private key\n(on hardware token)" as PrivKey
  rectangle "Release artifact\n(binary)" as Artifact
  rectangle "Signature\n(.asc)" as Sig
}

rectangle "Website with signed key list\nand information about signature authorisation of the key list" as Channel #Orange

rectangle "Verification environment\n(Server)" {
  rectangle "Public key\nfrom keyserver\n(fingerprint verified)" as PubKey
  rectangle "gpg --verify *.asc" as GPG
}

PrivKey --> Sig : signs
Artifact --> Sig

Sig --> Channel
Artifact --> Channel

Channel --> User
' Attacker -[#Red]-> Channel : MITM attack
Attacker -[#Red]-> Channel: replaces key list


' Keyserver --> User: retrieves public keys
Channel --> User: retrieves key list and verifies its signature
User --> GPG
PubKey --> GPG
Artifact --> GPG
Sig --> GPG

GPG --> User : OK / FAIL
@enduml