mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
80a1747e3e
* feat: Add support for bubblewrap sandbox * fix: Glob pattern expansion limit for linux * fix: Bug in glob pattern expansion for bwrap * fix: README on trust * fix: Multiple bubblewrap translator fix * test: Add E2E for linux sandbox * fix: Refactor bwrap sandbox to use common dangerous files * fix: Path test case * fix: Non-existent path handling bug * refactor: Misc cleanup * fix: Avoid bind mount for non-existentent deny protection * fix: Off by one bug in path depth handling * ci: Disable AppArmor on GHA runner * fix: Disable apparmor userns restrictions
76 lines
2.7 KiB
Markdown
76 lines
2.7 KiB
Markdown
# Trust
|
|
|
|
PMG exists to protect developers from malicious open source packages. This effectively means:
|
|
|
|
1. Open source packages are not *implicitly* trusted
|
|
2. PMG need to be trusted to block malicious packages
|
|
|
|
The assertion in [2] cannot be *implicit*. If so, it breaks the entire security and trust model.
|
|
|
|
## Security Goals
|
|
|
|
- Adopt software supply chain security best practices so that PMG users can *verify* and only then trust PMG
|
|
- PMG is open source, built in public and reviewed by the community for verifiable source of truth
|
|
- PMG leverages GitHub build attestation to verify the integrity of the PMG binary with source provenance
|
|
- PMG npm package has build attestation to verify the integrity of the PMG binary and build environment with source provenance
|
|
- PMG security model is multi-layered without single point of failure
|
|
|
|
## Verified Installation
|
|
|
|
Zero-friction installation options are available in [README](../README.md). However, for more control, you can install PMG manually
|
|
after verifying the integrity of the PMG binary. Verified installations allow you to:
|
|
|
|
- Verify the integrity of the PMG binary and identify the exact source code that was used to build the binary
|
|
- Manually review the source code for trust
|
|
- Build your own binary from source or download a pre-built binary with source provenance guarantee
|
|
|
|
### GitHub Release
|
|
|
|
Get the latest attested version of PMG release binaries using GitHub CLI:
|
|
|
|
```bash
|
|
gh release verify -R safedep/pmg
|
|
```
|
|
|
|
Optionally, you can checkout the source code from which the binary was built and review the code for trust.
|
|
|
|
```bash
|
|
export RELEASE_TAG=$(gh release view -R safedep/pmg --json tagName --jq .tagName)
|
|
|
|
gh repo clone safedep/pmg && \
|
|
cd pmg && \
|
|
git checkout $RELEASE_TAG
|
|
```
|
|
|
|
Install verified binary for your platform:
|
|
|
|
```bash
|
|
gh release download $RELEASE_TAG -R safedep/pmg --dir ./pmg-$RELEASE_TAG
|
|
```
|
|
|
|
Install the platform specific binary from `./pmg-$RELEASE_TAG`. To see binary specific attestation metadata, run:
|
|
|
|
```bash
|
|
gh attestation verify pmg_Linux_x86_64.tar.gz -R safedep/pmg --format json
|
|
```
|
|
|
|
### npm Release
|
|
|
|
Verify npm package was built on GitHub Actions:
|
|
|
|
```bash
|
|
npm view @safedep/pmg --json
|
|
```
|
|
|
|
Navigate to [npm package](https://www.npmjs.com/package/@safedep/pmg) to verify the package provenance.
|
|
|
|
## Security Model
|
|
|
|
PMG aims to provide a multi-layered security model to avoid single point of trust or failure. PMG's security
|
|
model consists of the following layers:
|
|
|
|
1. Threat Intelligence (provided by [SafeDep](https://safedep.io) with planned support for BYO adapters)
|
|
2. Policy as Code (Planned CEL policy based guardrails to prevent known bad practices)
|
|
3. Sandbox for enforcing least privilege and defense in depth protection
|
|
|