From 558c7de0ddf84198296bdc0c28cf3cfc04028516 Mon Sep 17 00:00:00 2001 From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com> Date: Sun, 15 Feb 2026 17:29:34 -0800 Subject: [PATCH 01/51] feat: add build architecture article (#296) --- content/articles/BUILD_ARCHITECTURE.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 content/articles/BUILD_ARCHITECTURE.md diff --git a/content/articles/BUILD_ARCHITECTURE.md b/content/articles/BUILD_ARCHITECTURE.md new file mode 100644 index 0000000..0be25f2 --- /dev/null +++ b/content/articles/BUILD_ARCHITECTURE.md @@ -0,0 +1,25 @@ +--- +title: "Build Architecture | secureblue" +description: "Build architecture for secureblue" +permalink: /articles/build-architecture +--- + +# Build Architecture + +Supply chain security is a priority for secureblue. During the the build process, we use complementary security mechanisms to protect against a variety of supply chain attack vectors. The documentation below covers each of these mechanisms, the protections they provide, and where secureblue uses these mechanisms. + +## Definitions + +| Security mechanism | Implementation tooling | Threat vectors | Mitigation logic | Scope | +|------------|---------------------------------------|-------------------------|--------------|---------------------------------| +| Provenance | [SLSA](https://slsa.dev) | | To generate provenance, the build platform (in our case, GitHub Actions) generates and signs an attestation file containing metadata about the build environment. Crucially, it cryptographically attests to the authenticity of runner and the source commit on which the artifact is being built. This attestation is then published in the repository or registry alongside the artifact. On the client side, when the artifact is pulled, the signature of the attestation is validated against the build platform's public key and the contents of the attestation are validated to confirm that the artifact was built: on an authorized runner from a commit in a specific branch in the source repository protected by branch policies, pull request review, and maintainer login 2FA. This means that even in the event that a maintainer's artifact signing keys and artifact repository credentials were both stolen, any malicious builds pushed by the credential thief would be rejected by clients due to provenance validation. | All secureblue [OCI](https://opencontainers.org/) images, Trivalent RPM packages, Blue-Build build tools | +| Signatures | [cosign](https://github.com/sigstore/cosign), [GPG](https://gnupg.org/) |