Changes between Version 1 and Version 2 of Potential risks and mitigations
- Timestamp:
- 04/30/25 10:49:45 (18 months ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Potential risks and mitigations
v1 v2 1 = Potential risks 1 = Potential risks and mitigations 2 2 3 == Mitigation strategies3 == Security Risks in an Air-Gapped Guix Workflow 4 4 5 Recommendations specific to Guix in air-gapped, classified use 6 7 === Security Risks in an Air-Gapped Guix Workflow 8 9 ==== Supply Chain Attacks via Source Code 5 === Supply Chain Attacks via Source Code 10 6 11 7 Even though you're building from source, the upstream source code (tarballs, Git repos) may be maliciously modified. … … 22 18 * Use content scanning tools (e.g., static analyzers) on all .tar.gz and Git checkouts. 23 19 24 === =Compromise via Channel Updates20 === Compromise via Channel Updates 25 21 26 22 Your Guix package definitions come from Git channels (e.g., guix.git, or your own). … … 38 34 * Use guix time-machine to avoid rolling updates. 39 35 40 === =Media Transfer Risks (USB, SD cards)36 === Media Transfer Risks (USB, SD cards) 41 37 42 38 USB drives used for transferring .nar files or source archives can be a vector for malware, even in an air-gapped setup. … … 50 46 * Prefer hash verification of transferred files (sha256sum sources.nar) using offline-known-good hashes. 51 47 52 === =Build Environment Leakage48 === Build Environment Leakage 53 49 54 50 If the build process writes temporary files or outputs data to places outside the Guix store, secrets or traces of sensitive data could leak or persist. … … 64 60 * Consider full-disk encryption for the build system. 65 61 66 === =Tampered Nar Archives62 === Tampered Nar Archives 67 63 68 64 .nar archives imported into your air-gapped server could be tampered with in transit. … … 78 74 * Store all .nar imports in a sealed append-only log for auditing. 79 75 80 = =High-Security Recommendations for Guix in Classified Environments76 = High-Security Recommendations for Guix in Classified Environments 81 77 82 78 || '''Concern''' || '''Recommendation''' || … … 90 86 || User separation || Separate users for import, build, audit, and deployment tasks || 91 87 92 = =Final Thoughts88 = Final Thoughts 93 89 94 90 Guix offers an excellent foundation for secure, reproducible software environments.
