SI-07(15) Code Authentication

Self-assessed, not audited

We hold no certification or authorization. The status below is our own assessment, kept as OSCAL in Git; it is not an auditor's finding. "Planned" means not built.

Control statement

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: software or firmware components].

Guidance

Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.

Implementation

Lab artifact cache and boot image distribution

Code authentication: boot images are Sidero-signed Secure Boot UKIs, so a tampered image from R2 or the cache fails to boot (enforced on the node, see Talos node si-7). Partial: container images are pulled by tag through the cache over plain HTTP with no signature verification (no admission policy); integrity rests on registry digests only where the reference is by digest; the CI image job verifies no checksum.

Status: partial.

Evidence:

• https://github.com/zeta-reticuli-inc/talos-multicloud/blob/main/ARCHITECTURE.md
• https://github.com/zeta-reticuli-inc/talos-multicloud/blob/main/.github/workflows/images.yml
• https://github.com/zeta-reticuli-inc/agents/blob/main/research/lab-cache.md

All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).