dotfiles

Security Release Checklist

Use this checklist before cutting any new release (e.g., v0.x.x) to ensure supply-chain integrity.

1. Supply Chain & Installer

• Pinned Version: Update install.sh VERSION variable to match the release tag.
• Docs Sync: Ensure README.md and .github/PULL_REQUEST_TEMPLATE.md installer URLs point to the new tag (not main).
• Clean Build: Verify install.sh does not curl random scripts from third parties without pinning.
• SOUP Register: Review SOUP_REGISTER.md and confirm all active external components have an owner and validation path.

2. Secrets & Leak Prevention

• SSH Keys: Scan dot_ssh/ to ensure no private keys (id_rsa, id_ed25519) are committed.
• Env Vars: Check for hardcoded API tokens in dot_config/ (use age encryption or environment variables instead).
• Git History: Run git secrets or similar to scan for accidental commits of credentials.

3. Platform Safety

• WSL Check: Verify install.sh detects WSL and does not try to install systemd services or macOS defaults.
• Root usage: Ensure no script requires sudo unnecessarily (Principle of Least Privilege).

4. Toolchain

• Binary Integrity: Check that dot_local/bin/ scripts are pure shell/executable and match expected checksums (no binary blobs).
• Dependency Scan: Run npm audit / cargo audit if applicable (currently Node.js legacy is removed).

5. MCP (Model Context Protocol) Hardening

• Launcher Policy: Verify dot mcp shows only allowlisted launchers (npx, node, uvx).
• Filesystem Scope: Ensure no MCP server has broad access (/, /home, /Users).
• Default Profile: Confirm only the strict-local server set is enabled by default.
• Token Validation: Confirm required API tokens are set (GITHUB_TOKEN, BRAVE_API_KEY).
• Arg Policy: No wildcard (*) or --unsafe arguments in MCP server configs.
• Env Placeholders: All ${VAR} references in MCP config have corresponding environment variables.

Run dot mcp --strict --json to validate all MCP server configurations and capture an audit artifact.

6. Release Attestation

• SBOM Generation: Verify dotfiles-sbom.spdx.json is generated in release workflow.
• Attestation Signing: Confirm actions/attest-build-provenance signs the release artifacts.
• Attestation Verification: Verify with gh attestation verify <artifact> --repo sebastienrousseau/dotfiles.
• Branch Protection: Ensure security-attestation is a required status check on master.
• Automation Keying: Confirm ACTIONS_BOT_SIGNING_KEY exists and matches the signer in dot_config/git/allowed_signers.

7. Final Verification

• Docker Test: Run docker build -f Dockerfile.test . to verify clean install.
• Doctor: Run dot doctor locally.
• MCP Check: Run dot mcp to verify MCP configuration.

This site is open source. Improve this page.