From d31eb1ed97c7b756ff9490b9814dcd13c112531f Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Sat, 10 Oct 2026 22:16:48 -0400 Subject: [PATCH 1/4] v0.3 trust pages draft: how-we-build, the reader's problem on the NIST and verify drafts; CISA section moved out of the preview --- .../index.html | 16 +------ how-we-build/index.html | 46 +++++++++++-------- verify-a-release/index.html | 2 +- 3 files changed, 28 insertions(+), 36 deletions(-) diff --git a/how-our-pipeline-maps-to-nist-and-slsa/index.html b/how-our-pipeline-maps-to-nist-and-slsa/index.html index c8ee228..a52f7e3 100644 --- a/how-our-pipeline-maps-to-nist-and-slsa/index.html +++ b/how-our-pipeline-maps-to-nist-and-slsa/index.html @@ -89,7 +89,7 @@

How the v0.3.0 release pipeline maps to NIST and SLSA

-

This page puts each stage of the new release pipeline next to the NIST practice it was designed against. It says where a stage only partly implements a practice.

+

If you have to explain our release pipeline to a security reviewer, start here. This page puts each stage of the new release pipeline next to the NIST practice it was designed against, and says where a stage only partly implements a practice.

DRAFT for v0.3.0, not published and never merged before v0.3.0 is live. [TO-VERIFY] marks anything not yet run against a real release.

This is guidance we followed when designing the pipeline. It is not a certification.

Stage by stage

@@ -108,20 +108,6 @@

Stage by stage

Our wording: signed at every stage, verified together at release.

SLSA

[TO-VERIFY] The SLSA Build level we assess v0.3.0 at. We claim Level 3 for the Build stage only after a test shows that a malicious build step cannot produce provenance the release step accepts. Until that test has passed, this page says nothing about Level 3.

-

CISA Secure by Design

-

[TO-VERIFY] This section is a draft and is not published. It lines up the seven goals of CISA's Secure by Design materials with what the product does. CISA does not endorse any company or product, and this page is not a statement by CISA. We do not claim to meet any of these goals until each row below has been checked against the v0.3.0 release.

- - - - - - - - - - - -
GoalWhat the product doesStatus
Multi-factor authentication[TO-VERIFY] The server has one optional shared HTTP Basic login (plus an optional read-only one). It has no multi-factor sign-in and no single sign-on.[TO-VERIFY]
Default passwords[TO-VERIFY] No password ships in the product. Logins come only from settings you provide at start, and a half-set pair is refused.[TO-VERIFY]
Classes of vulnerability[TO-VERIFY] The server is written in Go, with no C imports and cgo off. Request paths are checked twice against directory traversal. There is no SQL.[TO-VERIFY]
Security patches[TO-VERIFY] A daily rescan for newly disclosed vulnerabilities, and a 48-hour fix target (best effort). The server does not update itself, by design. Whether automatic patch releases are live at v0.3.0: [TO-VERIFY].[TO-VERIFY]
Vulnerability disclosure policy[TO-VERIFY] A private reporting channel exists on GitHub. Whether the policy allows testing, promises no legal action, sets a scope and gives a disclosure time: [TO-VERIFY].[TO-VERIFY]
CVE records[TO-VERIFY] When we issue a CVE, and the fields it carries.[TO-VERIFY]
Evidence of intrusions[TO-VERIFY] Structured logs and metrics. The server writes no per-request access log and does not log or count failed logins. Whether that changes at v0.3.0: [TO-VERIFY].[TO-VERIFY]

What this page does not say