PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4)

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

DFD: Keysigning Simple

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines.

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:

The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!

Goals:

Build process produces identical artefacts (bit-for-bit) from the same source and inputs
independent parties can rebuild and verify outputs match the original → verify freedom from insider threat!
require a deterministic build environments
all build steps, dependencies, and tooling are tightly controlled and audited
1. security goals:
detect tampering in build pipelines or artefacts
prevents hidden backdoors introduced during compilation or packaging by a malicious insider
ensure integrity of supply chain, dependencies and build tools
enables independent verification without trusting the original builder
drastrically reduce insider and supply chain attack surface
1. Zero Trust:
never trust, always verify!
verifiable evidence (rebuild && compare)
eliminates implicit trust in build pipeline
build system considered untrustworthy
combine with signed artefacts and attestation frameworks for full supply chain integrity