Software Supply Chain Integrity

[lrvick]

NitroHSM looks awesome, but currently it seems to be lacking basic Software Supply Chain integrity practices that would make it viable for use in environments with threat models that can't afford to risk trusting any single individual.

Given all the great steps you take to avoid physical supply chain attacks with tamper evident seals, it seems only logical to have a tamper evident software supply chain.

Some example practices that might close the gap:

1. Sign all commits with hardware-anchored PGP key that is easily validated to a real identity (keyoxide, etc)
2. Begin code review practices, where reviewer also signs merge commits or a signed tag with their own hardware backed PGP key
3. Have all firmware/containers build reproducibly with a full-source-bootstrapped toolchain
   • Shameless plug for Stagex though other options exist
4. Have release proposer sign artifact hashes, and release approver sign matching set
5. Support hardware anchored Remote Attestation that certifies the software hashes running on a NetHSM match expected reproducibly built, bootstrapped, and multi-signed artifacts generated from this repo.