Security
SOUP Register
Purpose
Controlled inventory for software of unknown pedigree used by the dotfiles platform.
Active components
| Component | Source | Version control | Verification path | Owner | Status |
|---|---|---|---|---|---|
| Homebrew installer | raw.githubusercontent.com/Homebrew/install | Fixed upstream commit, SHA-256 pinned | SHA-256 in remote-installers.sha256 and package_managers.sh | Repo maintainer | Conditional |
| Chezmoi installer | get.chezmoi.io | SHA-256 pinned, checked by download_verified_script | SHA-256 in remote-installers.sha256 | Repo maintainer | Controlled |
| GitHub Actions marketplace actions | GitHub Marketplace | Full commit SHA pinning | Workflow uses: pins | Repo maintainer | Controlled |
| Grype container | anchore/grype | Pinned tag in workflow | Container tag in security-enhanced.yml | Repo maintainer | Controlled |
| Syft and Grype binaries | anchore/syft, anchore/grype | Tag plus image digest | Digests in setup-anchore, used by the SBOM, CVE and release workflows | Repo maintainer | Controlled |
| Trivy container | aquasec/trivy | Pinned tag in workflow | Container tag in security-enhanced.yml | Repo maintainer | Controlled |
| Checkov action | GitHub Marketplace | Full commit SHA pinning | Workflow uses: pin | Repo maintainer | Controlled |
| Nix inputs | GitHub flakes | Locked in flake.lock | narHash and revision lock | Repo maintainer | Controlled |
| GitHub release metadata queries | GitHub API | Discovery only, not release validation | update-deps.yml query path | Repo maintainer | Monitored |
Validation record
- Record version or commit SHA.
- Record checksum, signature, or attestation method.
- Record workflow or script that consumes the component.
- Record owner and review date.
- Reject moving inputs in production or release paths unless checksum-gated.
Exit criteria
- No unsigned automation commits.
- No unverified executable download in installer or release path.
- Every SOUP item has owner, version control method, and validation record.