Clarification regarding release security

[eug48]

The README states that "Berglas is not an officially supported Google product" but could it be clarified whether Berglas is still subject to Google's usual internal security measures (e.g. secure builds, code security, reviews, etc)?

Thanks!

[sethvargo]

Hi @eug48,

Thanks for the query. Berglas uses GCP for builds (specifically Cloud Build), and that's completely audit-able as the scripts are here in this repo. The design and implementation went through Google's rigorous security and privacy review process. All code is reviewed. A detailed threat model is also available in this repo.

Let me know if you have any additional questions!

[eug48]

Ok, thanks!