gamertan
00d1dd4209
Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime. Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2 Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381 AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
50 lines
2.5 KiB
Markdown
50 lines
2.5 KiB
Markdown
# Threat model
|
|
|
|
## Protected properties
|
|
|
|
- A release is identified by an operator-approved SHA-256 digest.
|
|
- Only regular, bounded, allowlisted archive entries are extracted.
|
|
- Release roots, state, pointers, and Caddy files reject symlink substitution
|
|
at their checked boundaries.
|
|
- Configuration is strict JSON and is never interpolated into a shell command.
|
|
- Candidate health is established before traffic or the singleton current
|
|
pointer changes. New deployments also satisfy configured content smoke
|
|
checks; rollback uses health and readiness because future-release content
|
|
markers are not valid requirements for an older retained release.
|
|
- Caddy configuration validates before reload.
|
|
- An activation failure restores the previously observed state.
|
|
- Active and previous releases survive pruning.
|
|
- The restricted receiver accepts one versioned bounded stream, one allowlisted
|
|
service name, and one explicitly approved digest. It accepts no remote path,
|
|
URL, environment value, or shell expression.
|
|
- OpenSSH host keys are pinned; forwarding, PTYs, proxy commands, local commands,
|
|
and user SSH configuration are disabled by the client invocation.
|
|
- Production secret values are absent from configuration, process arguments,
|
|
artifacts, manifests, reports, deployment state, and Tend logs.
|
|
- One host-wide lock serializes shared Caddy activation without stopping or
|
|
reconfiguring unrelated services.
|
|
|
|
## Trusted inputs
|
|
|
|
Reviewed source, the pinned Go toolchain, root-owned server policy and service
|
|
configuration, systemd unit files, the Caddy handler template, the operator,
|
|
and the target host's root account are trusted. Packaging a hostile repository
|
|
can execute hostile Go compiler hooks or consume resources; Tend is not a
|
|
source-code sandbox.
|
|
|
|
## Adversarial inputs
|
|
|
|
Artifact paths and bytes, protocol frames, requested service names, archive
|
|
metadata, stale or malformed state, HTTP responses, subprocess failures, and
|
|
filesystem objects at managed paths are validated and fail closed. Process
|
|
output and receive fields are bounded.
|
|
|
|
## Non-goals and preview limits
|
|
|
|
Tend does not defend against a concurrently malicious root user, a compromised
|
|
kernel/toolchain/systemd/Caddy/OpenSSH installation, denial of service by the
|
|
trusted application, or secrets an application itself exposes. It does not
|
|
manage data migrations, databases, containers, Kubernetes, or application-specific
|
|
activation. EQL therefore remains outside the generic deployment adapter until
|
|
its SQLite/catalog publication checkpoints can be modeled explicitly.
|