68 lines
3.9 KiB
HTML
68 lines
3.9 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>Security — Keru OS</title>
|
|
<meta name="description" content="Keru's trust model: source-only builds, verification against fetch, no binary packages, a small auditable toolchain, and clean licensing.">
|
|
<link rel="stylesheet" href="assets/css/style.css">
|
|
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>ける</text></svg>">
|
|
</head>
|
|
<body>
|
|
|
|
<nav class="top" data-nav></nav>
|
|
|
|
<header class="pagehead">
|
|
<p class="crumbs"><a href="index.html">home</a> / <a href="docs.html">docs</a> / security</p>
|
|
<h1>Security</h1>
|
|
<p>The trust model, stated plainly.</p>
|
|
</header>
|
|
|
|
<section>
|
|
<div class="wrap">
|
|
<div class="prose">
|
|
<p>Keru's security stance follows from its design. No binaries, no opaque machinery, no hidden services. That shrinks the attack surface to things you can actually read.</p>
|
|
|
|
<h3>Source-only by construction</h3>
|
|
<p>There is no binary package store to compromise. Every package is compiled in your install from original source fetched over the network. The "prebuilt artifact" class of attack simply doesn't exist.</p>
|
|
|
|
<h3>Verified fetch</h3>
|
|
<ul class="features">
|
|
<li><strong>Mirror then upstream.</strong> Downloads prefer the project mirror and fall back to upstream, never the other way.</li>
|
|
<li><strong>Integrity enforced.</strong> A fetched tarball that doesn't verify is refused, not untarred. Failed verification is a hard stop.</li>
|
|
<li><strong>Pinned sources.</strong> Recipes pin the exact <code>url</code> and version. Nothing is ever pulled "latest" implicitly.</li>
|
|
</ul>
|
|
|
|
<h3>A toolchain you can audit</h3>
|
|
<div class="code-block">scripts/build-root.sh # ~shell; reads your make.conf
|
|
profile/make.conf # your choices, explicit
|
|
kama # ~225-line package manager
|
|
kama-packages/*.sh # recipes as plain shell you can read top to bottom</div>
|
|
<p>The whole vertical slice from "make.conf" to "booted system" is a handful of shell files. That's the honest counter to the "trust the distro binary blob" model.</p>
|
|
|
|
<h3>Privilege by your rules</h3>
|
|
<p>Privilege elevation is swappable: <code>doas</code> (slender, auditable) is the default, with sudo, opendoas, and plain <code>su</code> available. Keru never preloads root-owned services or hidden daemons.</p>
|
|
|
|
<h3>Kernel hardening, if you want it</h3>
|
|
<p>Pick <code>linux-hardened</code> at install for a hardened kernel, or stick with stable <code>linux</code>. The choice is yours and applied at the moment your system is built.</p>
|
|
|
|
<h3>Licensing, because supply chain is security</h3>
|
|
<p>All three repos are <span class="tag accent">AGPL-3.0</span>. Recipes tag their <code>license</code> explicitly. Nothing in the pipeline is proprietary-black-boxed.</p>
|
|
|
|
<div class="callout">Trust is transitive: you still trust the sources you install and the mirror that serves them. Keru's job is to make that trust chain visible and verifiable — not to pretend you can be protected from everything.</div>
|
|
|
|
<h3>Reporting</h3>
|
|
<p>Found a flaw in the installer, kama, or a recipe? File it with the stage and the failing artifact. See <a href="contact.html">contact</a> and <a href="troubleshooting.html">troubleshooting</a>.</p>
|
|
|
|
<p><a href="troubleshooting.html">← Troubleshooting</a> · <a href="toolchain.html">Toolchain bootstrap →</a></p>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
|
|
<footer data-footer></footer>
|
|
|
|
<noscript><div style="text-align:center;padding:16px">See the <a href="sitemap.html">sitemap</a> for all pages.</div></noscript>
|
|
|
|
<script src="assets/js/include.js" data-base="."></script>
|
|
</body>
|
|
</html> |