Compliance Architecture

Overview

---

EU AI Act (Regulation (EU) 2024/1689)

See AI_ACT_COMPLIANCE.md for full assessment.

---

Regulatory Mapping

SOC 2 Type II

ISO 27001

GDPR / HIPAA (Privacy)

---

Security Controls

TLS Enforcement

All network operations require valid TLS certificates:

Files:

• Pre-commit: config/pre-commit-config.yaml
• CI: .github/workflows/compliance-guard.yml

Secrets Management

Permission Controls

Dangerous Pattern Blocking

Patterns automatically blocked by CI and pre-commit hooks:

# Blocked - insecure TLS
curl -k https://...
wget --no-check-certificate https://...

# Blocked - world-writable permissions
chmod 777 /path
chmod -R 666 /files

# Blocked - hardcoded credentials
password="literal_value"

---

Cross-Platform Compatibility

Supported Platforms

Line Ending Normalization

Configured in .gitattributes:

BSD vs GNU Compatibility

The cross-platform-test.yml workflow validates scripts on both platforms:

Path Handling

---

CI/CD Pipeline

Workflow Matrix

Compliance Guard Jobs

compliance-guard.yml
├── insecure-patterns     # TLS, credentials, chmod
├── portability           # ShellCheck, paths, .gitattributes
├── dockerfile-lint       # Hadolint
└── compliance-summary    # Report generation

Cross-Platform Test Jobs

cross-platform-test.yml
├── ubuntu-latest (GNU)   # Linux compatibility
├── macos-latest (BSD)    # macOS compatibility
└── compatibility-report  # Summary

GitHub Actions Security

---

Pre-Commit Hooks

Configuration

File: config/pre-commit-config.yaml

Hook Matrix

Installation

pip install pre-commit
pre-commit install
pre-commit install --hook-type pre-push

---

Change Management

Pull Request Requirements

PR Template Checklist

- [ ] `chezmoi apply --dry-run` verified
- [ ] Manual testing on macOS
- [ ] Manual testing on Linux
- [ ] CI checks pass

Commit Requirements

Cryptographic Identity Verification (ALCOA: Attributable)

For SOC 2 compliance, the "Attributable" principle requires that all changes are linked to a verified cryptographic identity, not just a username.

Enforcement layers:

Pre-push hook location: scripts/git-hooks/pre-push

# The hook verifies each commit before push:
for c in $(git rev-list "$range"); do
  if ! git verify-commit "$c" >/dev/null 2>&1; then
    echo "Blocked: unsigned commit $c"
    exit 1
  fi
done

Setup signing:

# SSH signing (recommended)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# GPG signing (alternative)
git config --global user.signingkey <YOUR_GPG_KEY_ID>
git config --global commit.gpgsign true

# Or use the dotfiles alias:
enable-signing ssh  # or: enable-signing gpg

Install pre-push hook:

cp scripts/git-hooks/pre-push .git/hooks/pre-push
chmod +x .git/hooks/pre-push

GitHub Branch Protection (recommended):

Enable "Require signed commits" in repository settings: Settings > Branches > Branch protection rules > Require signed commits

---

Test Coverage

Current Metrics

Test Framework

tests/
├── framework/
│   ├── assertions.sh    # 16 assertion functions
│   ├── mocks.sh         # Mock utilities
│   └── test_runner.sh   # Test executor
├── unit/
│   └── test_*.sh        # 378 unit test files
├── integration/
│   └── test_*.sh        # 9 integration test files
└── performance/
    └── benchmark_runner.sh

Running Tests

# Run all tests
./tests/framework/test_runner.sh

# Run specific test
bash tests/unit/test_dot_commands_apply.sh

---

Security Documentation

Required Files

Vulnerability Response SLA

---

Audit & Forensics

Immutability

Lock critical configuration files:

lock-configs  # Sets chflags uchg (macOS) or chattr +i (Linux)

Audit Trail

# View dotfiles operations log
dot audit

# Log location
~/.local/share/dotfiles.log

Supply Chain Security

---

Verification Commands

Manual Verification

# Run all pre-commit hooks
pre-commit run --all-files

# Run unit tests
./tests/framework/test_runner.sh

# Check for insecure patterns
grep -rn --include="*.sh" -E 'curl.*-k|wget.*--no-check' .

# Validate .gitattributes
grep "text=auto" .gitattributes && echo "OK"

Automated Verification

---

References

• SOC 2 Type II
• ISO 27001:2022
• OWASP Top 10
• Google Shell Style Guide
• ShellCheck Wiki
• SLSA Framework