Provenance¶
cmp-issuer is built from public standards and public project APIs, starting from Kubebuilder-generated scaffolding.
Public sources¶
| Source | License or status | Influence |
|---|---|---|
| RFC 4210 | IETF Trust legal provisions | CMPv2 message syntax and the original P10CR response identifier convention |
| RFC 9810 | IETF Trust legal provisions | CMP message syntax, state transitions, protection and confirmation |
| RFC 9811 | IETF Trust legal provisions | CMP over HTTP transport behavior |
| RFC 9481 | IETF Trust legal provisions | Algorithm requirements and recommendations |
| RFC 9483 | IETF Trust legal provisions | Lightweight CMP profile and P10CR certReqId rules |
| 3GPP TS 33.310 V18.8.0 | ETSI terms apply | Telecom certificate-management context only |
| cert-manager external issuer guidance | CC BY 4.0 documentation | External issuer API integration and approval model |
| issuer-lib | Apache-2.0 | Controller reconciliation contracts and signer integration |
| go-pkicmp-ng | Apache-2.0 | CMP parsing and protection behind project-owned interfaces, a maintained derivative of go-pkicmp carrying verification-path corrections |
| Kubebuilder | Apache-2.0 | Generated project scaffolding and Kubernetes API generation |
| OpenSSL CMP | Apache-2.0 | Independent interoperability oracle for tests |
| EJBCA CMP documentation | Public vendor documentation | EJBCA CE configuration used for interoperability testing |
Generated code¶
Kubebuilder v4.15.0 generated the initial Go project layout. Kubernetes API deepcopy files, CRDs and RBAC manifests are generated by controller-gen. Generated files retain the notices supplied by their generators where applicable.
Release artifacts¶
A release publishes a multi-architecture manager image for linux/amd64 and linux/arm64 to the GitHub Container Registry. A signed build provenance attestation is generated for the published image digest and pushed alongside it, so a consumer can verify which workflow, commit and repository produced the image. The same Sigstore bundle is attached to the GitHub Release as cmp-issuer-<version>-provenance.sigstore.json, so verification does not depend on discovering the registry attachment.
Each release also carries the installer manifest, the packaged Helm chart and a CycloneDX bill of materials generated from the Go module graph with license information. The air-gapped bundle carries the same bill of materials, so a cluster with no route to the release page can still audit what the image was built from.
An air-gapped bundle is attached too, carrying the same image as an OCI archive next to the chart and the installer. It is exported by the build that pushes the image, not rebuilt afterwards, so the digest inside the archive is the digest the attestation covers. See installing without registry access.
Supply chain checks¶
| Check | Tool | Scope |
|---|---|---|
| Vulnerable dependencies | govulncheck | Symbols reachable from the module and its dependencies |
| Leaked credentials | gitleaks | Working tree and full source history, excluding the generated documentation site |
| Bill of materials | cyclonedx-gomod | Module graph with resolved licenses |
| Container vulnerabilities | Trivy | Base image packages and the compiled manager binary, fixed findings only |
| Static analysis | CodeQL | Go code, built with the toolchain named in go.mod, reported under code scanning |
| Repository posture | OpenSSF Scorecard | Branch protection, workflow safety, dependency pinning and release provenance, reported after CodeQL completes on main |
| Workflow definitions | actionlint | Trigger, expression and shell errors in the GitHub Actions workflows |
| Workflow supply chain | test/workflows |
Commit-SHA action pinning, least-privilege token scopes and no interpolated shell |
| Toolchain currency | go-patch.yml |
Newest Go patch in the release series go.mod targets |
| Documentation | MkDocs strict mode | Broken links, unresolved anchors and omitted files |
Pull requests run the inexpensive lint, vulnerable dependency and credential checks. Pushes to dev
and main add the bill of materials and container scan. The weekly schedule repeats the complete supply
chain set so vulnerabilities published after a change merged are still reported. CodeQL follows the
trusted-branch and weekly schedule after the repository becomes public. Scorecard follows each successful
CodeQL run on main, so its SAST result is based on a completed analysis rather than a concurrent one.
Tool versions are pinned in the Makefile and GitHub Actions are pinned to commit digests.
The OSV module scan ignores GO-2026-5932 through the reason recorded in osv-scanner.toml. The module
graph needs golang.org/x/crypto/cryptobyte through go-pkicmp-ng, but it does not need or import the
affected golang.org/x/crypto/openpgp package. The advisory has no fixed version and govulncheck reports
no reachable vulnerable symbols, so the exception removes a module-level false positive without
suppressing other advisories for golang.org/x/crypto.
Dependency policy¶
Every protocol dependency is pinned. Any verbatim ASN.1 module or RFC code component added later is recorded here with its exact source and required notice.
A protocol dependency is built from a fork only while a correction is pending upstream. The fork keeps the upstream module path and license, the exact version is pinned in go.mod and recorded in THIRD_PARTY_NOTICES.md, and the bill of materials attached to a release names the fork it was built from. See ADR 0001.