Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 20:54
· 8 commits to main since this release
v0.3.0
aae0d84

v0.3.0 — the security pass · first product release

Status: released — all product acceptance criteria met (see
docs/THREAT-MODEL.md):
GPG-signed release artifacts + demonstrated byte-reproducible build.

⚠️ Signing-key caveat: the artifacts are signed with a one-shot key
(fingerprint 63EA 0A22 C16A D051 8237 8B9B 7F53 97DF 4477 C2BD), generated in
an air-gapped VM and revoked immediately after signing — a deliberate
custody compromise (no physical air-gap available). The signatures verify as
"Good", the key shows as revoked by design, and the fingerprint is the trust
anchor. See docs/SIGNING.md.

Security impact

  • Networkless monolithic kernel (6.12.101-coldiron): compiled from Debian
    trixie source with no network device drivers (CONFIG_NETDEVICES=n,
    wireless/BT/NFC/CAN off) and no loadable modules (CONFIG_MODULES=n).
    There is no driver that could reach the network and no module subsystem to
    load one.
  • Verified boot chain: GRUB (BIOS + EFI) verifies kernel/initramfs PGP
    signatures (check_signatures=enforce) before executing them — a tampered
    image refuses to boot.
  • AppArmor enforced at boot: confinement profiles for the appliance scripts
    load and enforce; coldiron-check (menu option 8) proves the posture at
    runtime.
  • Full GPG verification of every staged binary: Sparrow manifest + Bitcoin
    Core SHA256SUMS.asc verified against keyrings you import out-of-band (the
    build refuses to auto-download keys).

New / changed user-visible behavior

  • New menu option 8 — System security check (coldiron-check).
  • GRUB auto-boots after 10 s (no more hanging on Enter on some machines).
  • Vault enumeration fixed on PCI-based USB hosts.

Test suite

  • Host-side script tests: 27/27.
  • QEMU/KVM E2E: 19/19 steps across 3 boots (fresh vault, Sparrow window,
    real GRUB path).
  • Byte-reproducible ISO: 9bebf36f… — local build == CI build, verified
    with cmp.

Verify before writing to USB

sha256sum -c SHA256SUMS
gpg --keyserver keyserver.ubuntu.com --recv-keys 63EA0A22C16AD05182378B9B7F5397DF4477C2BD
gpg --verify SHA256SUMS.asc SHA256SUMS
sudo dd if=coldiron-os-0.3.0-amd64.iso of=/dev/sdX bs=4M status=progress

Note on this release's docs

This tag (v0.3.0) is the frozen snapshot the ISO was built and signed from.
The PROTOTYPE banner was lifted and SECURITY.md / INSTALL.md were aligned
after the tag, on main — see the current
README and
docs for the
up-to-date state.

Assets 6
Loading