07 – Harden Build and Deployment Trust Boundaries #238

New issue

Closed

opened 2026-09-19 20:33:26 +01:00 by nimmo · 2 comments

nimmo commented

2026-09-19 20:33:26 +01:00

Owner

Goal

Review and harden the remote build and deployment trust boundaries.

Scope

Audit credential separation, secret placement, access controls, recovery, and the effects of a compromised component. Preserve the approved development and recovery workflows.

Keep host-specific security findings, attack paths, and the detailed compromise analysis in private operational records. This public issue tracks the work without publishing those details.

Validation

Complete the access-control and recovery checks, record the detailed evidence privately, and post only a non-sensitive completion summary here.

## Goal Review and harden the remote build and deployment trust boundaries. ## Scope Audit credential separation, secret placement, access controls, recovery, and the effects of a compromised component. Preserve the approved development and recovery workflows. Keep host-specific security findings, attack paths, and the detailed compromise analysis in private operational records. This public issue tracks the work without publishing those details. ## Validation Complete the access-control and recovery checks, record the detailed evidence privately, and post only a non-sensitive completion summary here.

nimmo added this to the NixOS Build & Deployment Pipeline milestone

2026-09-19 20:33:26 +01:00

nimmo added the

project:nixos-build-deployment-pipeline

service:nix

labels

2026-09-19 21:02:04 +01:00

nimmo referenced this issue

2026-09-19 21:02:24 +01:00

08 – Audit Forgejo Write Access Across Workload Hosts #239

nimmo referenced this issue

2026-09-19 21:02:37 +01:00

09 – Document Build, Deployment and Recovery Workflows #240

nimmo referenced this issue

2026-09-19 21:02:49 +01:00

10 – Add Forgejo CI Build Validation #241

nimmo referenced this issue

2026-09-23 18:18:15 +01:00

test: assert remote builder credential boundaries #250

~~nimmo referenced this issue 2026-09-23 18:21:27 +01:00~~

test: assert remote builder credential boundaries #250

~~nimmo referenced this issue 2026-09-23 18:24:20 +01:00~~

test: assert remote builder credential boundaries #250

~~nimmo referenced this issue 2026-09-23 18:44:19 +01:00~~

10 – Add Forgejo CI Build Validation #241

nimmo commented

2026-09-23 18:56:10 +01:00

Author

Owner

The access-control, credential-lifecycle, recovery, and final authorised-key policy checks are complete. Detailed security findings remain in private operational records. The issue can close after MR !250 is merged; follow-on Forgejo authority and CI work is tracked separately.