Vord

Enhancement Proposal

Proposal: Build and release-pipeline integrity

Dependency-advisory scanning exists (cargo-deny + Dependabot, ADR-0008), but for a security product the build and release pipeline is itself a top supply-chain target — a compromised CI step or release artifact backdoors the identity system for every adopter. This proposal hardens the development and release process. It changes no runtime architecture (no plane, seam, token, or API), so it is a proposal, not an ADR; it extends the ADR-0008 posture.

Motivation

DCO sign-off (ADR-0008) is contribution provenance, not artifact integrity. There is no signed release, no build provenance, and no pipeline hardening — so an adopter cannot verify that the binary they run was built from this source by this pipeline, and a compromised GitHub Action could inject a backdoor unnoticed.

Design — free for a public repository

  • Signed releases. Binaries and container images are signed with Sigstore / cosign; signatures are publicly verifiable by adopters. What is released, under which version, and with what support promise is the release plan (proposal 0029); this proposal is the pipeline every one of those artifacts must pass through.
  • Build provenance. CI emits SLSA-style provenance attestations (what built what, from which commit) attached to each release.
  • Source integrity. Protected default branch, required review, signed commits and tags (integrity, atop the DCO's provenance), no force-push to main.
  • Pipeline hardening. GitHub Actions pinned by commit digest (not tag), least-privilege GITHUB_TOKEN, no secrets echoed to logs, Dependabot for Actions (exists), and the OpenSSF Scorecard + Best Practices badge (named in ADR-0027) tracked as the public posture signal.
  • SBOM. A CycloneDX/SPDX software bill of materials generated per release and published with it.

Alternatives considered

  • Trust the platform / unsigned releases — rejected; the pipeline is in scope for a security product.
  • Reproducible builds — desirable and reserved (Rust reproducibility is improving); not a v1 gate.

Graduation criteria

Releases are signed, carry SLSA provenance, and ship an SBOM; the default branch is protected with signed commits; Actions are pinned by digest; Scorecard runs in CI. Every control here is free for a public repository.

Backward compatibility

Development/release process only — no runtime-architecture, token-format, or API impact.

Open questions

  • Reproducible-builds timeline.
  • Signed commits from all contributors (friction) vs maintainers/release-tags only.