stwaidele/dorfteich

M25 — VS-NfD: hardening & supply chain

New Issue

The items pulled forward from the roadmap plus supply-chain evidence: attachment integrity hashes, a hard plugin off-switch, a stable SIEM event catalogue, SBOM in CI, image digest pinning, and a pinned Node version. Digest pinning (#203) should land before M28 (offline/airgap deployment) — the mirror procedure and the offline update path both build on immutable references.

No due date

100% Completed

[VS-NfD] Pin the Node version

area:supply-chain

#236 by fable-5 was closed 2026-07-31 04:33:07 +02:00 0 / 3

[VS-NfD] Pin all container images by digest

area:supply-chain

#203 by fable-5 was closed 2026-07-31 05:29:14 +02:00 0 / 4

[VS-NfD] Produce an SBOM and a license report in CI

area:supply-chain

#202 by fable-5 was closed 2026-07-31 04:52:11 +02:00 0 / 5

[VS-NfD] Define a stable event catalogue for syslog/SIEM export

#201 by fable-5 was closed 2026-07-31 05:08:09 +02:00 0 / 5

[VS-NfD] Add a hard plugins.enabled = false switch

area:supply-chain

#200 by fable-5 was closed 2026-07-31 05:00:14 +02:00 0 / 5

[VS-NfD] Add SHA-256 integrity hashes for attachments

#199 by fable-5 was closed 2026-07-31 04:52:11 +02:00 0 / 5