Supply chain

We hold our own releases to the bar we ask of every app. Two paths matter: how our packages reach your machine, and how packs and driver metadata reach your running app.

flowchart LR
  subgraph build["Release workflow (only place that publishes)"]
    src["Tagged commit"] --> b["Hosted, isolated build<br/>reproducible"]
    b --> sig["Sigstore signature<br/>keyless, GitHub OIDC"]
    b --> prov["SLSA L3 provenance"]
    b --> sbom["CycloneDX SBOM"]
  end
  sig & prov & sbom --> reg["npm: mainsdk, @mainsdk/*"]
  reg --> you["Your install<br/>verify before use"]
  subgraph tuf["TUF repository"]
    packs["Baseline and market packs<br/>driver metadata"]
  end
  packs -- "mainsdk sync, startup, background" --> app["Your running app"]

Our releases

Each release ships these artifacts:

mainsdk, @mainsdk/cli,     pure JavaScript tarballs, ESM only, no native binary
@mainsdk/testing
*.sigstore.json            Sigstore bundle per artifact
provenance.intoto.jsonl    SLSA level 3 provenance
sbom.cdx.json              CycloneDX SBOM

Package names stay placeholders until the owner approves them, and the pipeline defaults to a dry run.

Delivery to running apps: TUF

Signing proves who signed a file. It does not stop an attacker who steals one key, replays an old but validly signed pack, hides newer ones, or mixes files from different releases. The Update Framework does (ADR-0005). From milestone 0.4, every baseline pack, market pack and driver metadata file is a TUF target.

Still open: who holds the root keys, where they are stored, the final threshold and the host that serves the repository.

Attacks it refuses

flowchart TB
  f["Fetch metadata and target"] --> r{"Version lower than trusted?"}
  r -- yes --> rb["Refuse: MAIN-TUF-0001 rollback"]
  r -- no --> t{"Timestamp expired?"}
  t -- yes --> st["Keep last good set: MAIN-TUF-0004 stale"]
  t -- no --> s{"Target listed in current snapshot?"}
  s -- no --> mm["Refuse: mix and match"]
  s -- yes --> h{"Bytes match the hash?"}
  h -- no --> bad["Refuse; never handed to the engine"]
  h -- yes --> ok["Load"]

A publisher signing outside its delegation is refused too. On expiry or an unreachable mirror, the app keeps its last good verified targets and never blocks traffic. The app verifies TUF metadata in TypeScript on WebCrypto with no dependency; the signing pipeline and CLI helpers use tuf-js.

main.lock records each target's hash, so two clean builds from the same lock load byte-identical packs.

Tenant-signed Fleet policies

Phase 4 (Fleet). Each Fleet tenant gets a delegated TUF role signed only with its own keys, with a threshold (for example 2 of 3, one offline). We cannot forge a tenant's policy: a policy signed with one tenant key, or with our own key, is rejected and the app keeps its last good policy. Fleet sends only signed, declarative policy and data, never code.

Security policy

SECURITY.md states:

• private disclosure through GitHub security advisories, with CVE numbering;
• critical issues fixed within 7 days and high within 30, with an advisory for each;
• a bug bounty live at public beta (platform and budget not chosen yet);
• a long-term support line of at least 24 months for each baseline.

Later

Next

• Contracts and versioning: what main.lock pins.
• Security architecture: where delivery sits among the trust boundaries.