SECURITY-POLICY-BUILDS v1.0

albertlane.net / security / build-policy · sha256 3c612d5a59a0579f685dee2197cfe28352a6f3bb031a0ddd65cf8100a4a25281 · raw .md

# SECURITY-POLICY-BUILDS v1.0 — 2026-10-09

Scope: every build and deploy of albertlane-apex, meta-lane-api and any future Albert Lane Worker, script or artifact.
Ground rules: no external cloud vault; signing keys stay with Albert (box, Termux `~/admin-pm`, hardware token). Add-only deploys.
"Enforced" means checked by `~/admin-pm/policy-gate-builds.sh` before a deploy. "Gap" means not yet true (see GAP-AUDIT.md, 2026-10-09).

## 1. Keys and HSM
- **MUST 1.1** Signing private keys live in an HSM: SoftHSM2 in CI and on the box, a vendor PKCS#11 token in production.
- **MUST 1.2** Private keys are generated in the token and marked non-exportable (CKA_EXTRACTABLE=false, CKA_SENSITIVE=true). In Workers, imported keys use `extractable=false`.
- **MUST 1.3** Production key operations (generate, sign a release, rotate, revoke) need approval from at least 2 parties, shown as 2 valid signatures on the release manifest.
- **MUST 1.4** Workers hold public keys only for verification. Runtime HMAC secrets are Workers `secret_text` bindings. This is the one documented exception, because Workers have no PKCS#11.
- *Enforced:* the gate refuses to deploy if the worker contains a private key or a `BEGIN … PRIVATE KEY` block, and it records whether a signed manifest exists.
- *Gap:* no HSM or token yet; no signing key; single-person approval.

## 2. Canonicalization
- **MUST 2.1** Any JSON that is hashed, signed or verified is first canonicalized with RFC 8785 (JCS).
- **MUST 2.2** Signer and verifier use the same JCS implementation version, and record it as `canon: "RFC8785"` next to the signature.
- **MUST 2.3** Non-JSON payloads (raw bytes, files) are signed over their exact bytes and labelled `canon: "raw-bytes"`.
- *Enforced:* the gate builds `build-manifest.json` in JCS form (sorted keys, no whitespace) and checks it round-trips. It warns if the worker has signing or hash code but no `jcs` function.
- *Gap:* provenance `record_hash` and the Merkle leaves are delimited strings, not JCS; responses use `JSON.stringify`.

## 3. Telemetry
- **MUST 3.1** Every telemetry or log table has a published JSON Schema; fields outside the schema are dropped.
- **MUST 3.2** PII minimization: no raw IP, full user agent, email or account number is stored in telemetry. Use a keyed hash (HMAC-SHA256 with a pepper) or a coarse label instead.
- **MUST 3.3** Peppers and salts used for identity hashing live in a separate store (HSM or a Workers secret separate from the data), never in the same table as the hashes.
- *Enforced:* the gate warns if a worker creates a table with raw `ip` or `user_agent` columns. The payout leak scan stays mandatory for payout changes.
- *Gap:* `froi_session_audit` has raw ip/user_agent; IAM salts are stored next to their hashes (acceptable for PBKDF2, but there is no pepper); there are no schemas yet.

## 4. Reproducible builds
- **MUST 4.1** Pinned toolchain (exact python, node and openssl versions recorded in the manifest).
- **MUST 4.2** `SOURCE_DATE_EPOCH` is set for every build, and every timestamp in an artifact comes from it.
- **MUST 4.3** Deterministic flags: for native code, `-ffile-prefix-map`, `-Wl,--build-id=sha1` and no timestamps; for archives, `tar --sort=name --mtime=@$SOURCE_DATE_EPOCH --owner=0 --group=0 --numeric-owner`.
- **MUST 4.4** Each deploy publishes a build manifest (artifact sha256, previous sha256, policy sha256, toolchain, SOURCE_DATE_EPOCH) and signed checksums.
- *Enforced:* the gate requires SOURCE_DATE_EPOCH (it defaults to the policy date and warns), writes the manifest and SHA256SUMS, and records whether a signature is present. The deploy script's byte-exact readback check stays in place.
- *Gap:* nothing is signed yet; the manifests are not published; there is no lockfile.

## 5. Auditor package
- **MUST 5.1** Each release can produce one auditor package containing: source tarball, build script, container image digest (or the pinned toolchain list if there is no container), conformance JSON (one result per MUST rule), a signed reproducibility report, and the HSM public-key certificate.
- *Enforced:* the gate writes a conformance JSON with one result per MUST rule into the deploy's manifest directory.
- *Gap:* no packaging script, no certificate, no signed report.

## 6. Add-only and change control
- **MUST 6.1** Deploys remove no lines from the prior worker, keep every binding, and pass the live-sha drift guard and the readback match.
- **MUST 6.2** Every source file carries the Albert Lane license header.
- *Enforced:* by the gate (diff and header check) and by the existing deploy script.

Version history: v1.0 2026-10-09, first issue.