Registry self-attestation

Threat model

Last reviewed 2026-06-04 · commit 93aa6c686d1f · source markdown

The threat model document could not be fetched inline — read it directly at https://github.com/jessetop/nubifer-vsk/blob/93aa6c686d1f4cb4b4017e9244fb4dbf0e6f6750/docs/threat-model.md.

Scanner manifest

Every scanner installed in the scanner-base image, with pinned version, distribution source, and the checksum or lockfile that verifies it. Served verbatim from the version-controlled manifest.

Pending integration: augustus, garak, modelscan, pompelmi

Scanner image in use

The SHA-256 digest of the scanner-base image every scan currently executes in. Digest-pinned — never a mutable tag (backend Req 24.8).

sha256:a7d54ff47cb2e1293aa9379b4bd2338c73c77149f260f47a7023136e0b0ba492

Software bill of materials

SBOM generation is pending. The scanner manifest above documents tool-level provenance in the meantime; the SBOM will add the full dependency inventory once published.

Verify this attestation

Don't take this page's word for it. Everything shown here comes from one unauthenticated endpoint you can query and verify yourself.

1. ETag — detect silent changes

The response carries an ETagderived from the SHA-256 of the threat model's git commit, the scanner manifest's git commit, and the running image digest. If any of the three changes, the ETag changes — so you can pin the attestation you reviewed and detect drift with a conditional request (304 Not Modified means nothing changed):

# Capture the ETag of the attestation you reviewed
curl -sI https://api.nerlo.ai/api/v1/registry/self-attestation | grep -i etag

# Later: returns 304 if nothing changed, 200 + new body if it did
curl -s -o /dev/null -w "%{http_code}\n" \
  -H 'If-None-Match: "<etag-you-captured>"' https://api.nerlo.ai/api/v1/registry/self-attestation

2. Image digest pinning — no mutable tags

Scans run in a scanner-base image referenced by SHA-256 digest, not by a mutable tag — a tag like :latest can silently change contents; a digest cannot. If the platform is ever configured with a tag instead of a digest, this endpoint returns HTTP 503 (image_not_digest_pinned) and this page shows a degraded-transparency banner rather than pretending all is well. Compare the digest above with what the audit chain of any server's report claims:

# The digest in a server's audit report ("Audit Chain" section)
# must match image_digest_in_use on this endpoint
curl -s https://api.nerlo.ai/api/v1/registry/self-attestation | jq -r .image_digest_in_use

3. Scanner checksums — verify the tools themselves

Every scanner in the manifest records how its install artifact is verified: a SHA-256 for binaries, install scripts, and .deb packages, or per-dependency hashes in a committed lockfile for npm/PyPI installs (npm ci / pip install --require-hashes abort on any mismatch). To check a binary-style entry, download the artifact from its source_url and compare:

# Example: verify a release artifact against the manifest's SHA
curl -sL -o artifact "<url-from-manifest>"
sha256sum artifact   # must equal the manifest's *_sha256 for that scanner