# Snigdha OS Decentralized — Software Supply Chain Integrity

# 1. Overview & Scope

The software supply chain encompasses every step from source code acquisition to package installation and release artifact publication.

A compromise at any stage of this chain — such as tampered third-party packages, untrusted repository mirrors, unpinned build dependencies, or silent compiler backdoors — undermines the operating system's security.

Snigdha OS Decentralized addresses supply chain risk through four pillars:

1. Strict Package Signature Enforcement.
2. Complete Software Bill of Materials (SBOM).
3. Cryptographically Signed Build Provenance (SLSA v1.0).
4. Isolated, Reproducible Build Environments.

---

# 2. Upstream Package Sources & Signature Enforcement

Snigdha OS builds upon Arch Linux's official binary packages.

# Package Signature Policy (pacman.conf)

The pacman configuration strictly enforces:

[options]
SigLevel          = Required DatabaseOptional
LocalFileSigLevel = Optional

# Invariants Maintained:

• SigLevel = Required: Pacman refuses to install any package that does not carry a valid signature from a trusted packager key in the archlinux-keyring.
• DatabaseOptional: Aligns with official Arch Linux infrastructure where repository databases (core.db, extra.db) are distributed across verified mirrors.
• Zero Tolerance for Insecure Directives: Directives such as SigLevel = Never or TrustAll are strictly forbidden. The test suite includes automated static analysis (test-package-integrity.sh) to prevent accidental regression.

---

# 3. Software Bill of Materials (SPDX 2.3)

Every Snigdha OS release includes a machine-readable Software Bill of Materials in SPDX 2.3 JSON format (SBOM.spdx.json).

# Covered Inventory:

• Operating system base packages (base, linux-hardened, systemd, mkinitcpio).
• Desktop environment components (i3-wm, polybar, picom, rofi, alacritty).
• Cryptographic and networking libraries (openssl, libseccomp, tor, nftables, cryptsetup).
• Sandboxing & isolation tools (apparmor, bubblewrap, xdg-dbus-proxy).
• Preinstalled privacy applications (torbrowser-launcher, onionshare, thunderbird, keepassxc, metadata-cleaner).

# Schema Integrity:

• Formatted to SPDX 2.3 standards with valid SPDXID, name, versionInfo, licenseConcluded, and downloadLocation.
• Explicit relationship mappings (DESCRIBES and DEPENDS_ON).
• Signed with a detached OpenPGP signature (SBOM.spdx.json.sig).

---

# 4. SLSA v1.0 Build Provenance & in-toto Attestations

Build provenance documents the environment, inputs, and build pipeline that produced a specific release artifact. Snigdha OS adheres to the SLSA v1.0 (Supply-chain Levels for Software Artifacts) specification and the in-toto Statement format.

The provenance document (provenance.intoto.jsonl) records:

• _type: https://in-toto.io/Statement/v1
• subject: SHA-256 cryptographic digest of the output ISO and bootloader binaries.
• predicateType: https://slsa.dev/provenance/v1
• predicate.buildDefinition:
  • buildType: Standardized builder URI (https://snigdhaos.org/attestations/iso-builder/v1).
  • externalParameters: Source repository URL and exact Git commit hash.
  • internalParameters: Build toolchain versions (archiso, mkinitcpio, ukify, sbsign, kernel version).
  • resolvedDependencies: Pinned package inventory and git tree digests.
• predicate.runDetails: Builder identifier, invocation UUID, and build timestamps.

Provenance attestations are cryptographically signed using the designated Provenance Signing Key.

---

# 5. Build Environment Isolation

To ensure that host environment impurities do not contaminate release artifacts:

1. Builds run in isolated container environments or disposable virtual machines.
2. The root filesystem construction utilizes unshare namespaces (--map-auto --map-root-user) to prevent host UID/GID leakage.
3. Network access during packaging is limited strictly to verified Arch Linux mirrors over HTTPS.
4. Production release signing keys are isolated and never mounted inside the build container.