Supply chain security

Software supply-chain attacks are an emerging risk. Olympus addresses several layers; some are your responsibility.

What's in Olympus's chain

Layer	Risk	Olympus mitigation
Source code	Repo compromise	GitHub Actions runs in protected envs; commits push-to-main with CI gates
Dependencies	Malicious npm package	Pinned versions, source-only @olympusoss/*
Build	CI compromise	Workflow runs with limited GH token scopes
Container images	Hijacked image	Digest pinning (ADR 0014)
Base images	Vulnerable upstream	Bun and Ory base images pinned by digest
Caddy	Plugin tampering	Reproducible build (Security, Caddy supply chain)
Postgres	Vulnerable engine	Pinned by version; managed providers patch
TLS certs	Cert mis-issuance	Cert Transparency monitoring

SBOM (Software Bill of Materials)

For SOC 2 / FedRAMP / EU CRA compliance, generate an SBOM:

# For npm dependencies
bun install --frozen-lockfile
npx @cyclonedx/cdxgen -t npm -o bom.json

# For container images
syft ghcr.io/olympusoss/athena:v2.10.0 -o spdx-json > athena-sbom.json

Distribute SBOMs alongside releases. Audit any "high" CVE entries.

Reproducible builds

The custom Caddy build is reproducible, same inputs → same image digest. Verify:

podman pull ghcr.io/olympusoss/caddy:vX.Y.Z
podman inspect ghcr.io/olympusoss/caddy:vX.Y.Z --format '{{.Id}}'
# Should match the digest in caddy-build.yml's commit

Athena/Hera/Site images are Next.js standalone builds, not bit-for-bit reproducible (Next includes build timestamps), but the source AND the dependency lockfile are reproducible.

Signing

Future enhancement: sign images with Sigstore/cosign:

cosign sign ghcr.io/olympusoss/athena:v2.10.0
# Verify at pull time
cosign verify ghcr.io/olympusoss/athena:v2.10.0 --certificate-identity=github-actions

Not currently shipped; on the roadmap.

Dependency review

Before adding a new dependency:

What does it do? Read the README and a representative source file.
How many maintainers? A 1-person package can be hijacked when they get burned out.
Recent commits? Active maintenance.
Known vulnerabilities? npm audit, OSV.dev.
License compatible? Source-only NPM packages are GPL-allergic; most permissive licenses fine.

Compromised dependency response

If a maintained dependency turns out to be compromised:

Pin to the last known-good version.
Audit your build for what the compromised version did.
Rotate any secrets the dependency could have seen.
Update Dependabot to exclude that version range until a clean version is published.

What you handle outside Olympus

Your VPS provider's supply chain, choose providers with SOC 2 attestations.
Your DNS provider, DNS hijacking lets attackers obtain certs.
Your CDN, Cloudflare/Fastly/CloudFront issue your edge cert.
Your team's laptops, git push from a compromised dev machine.

Audit cadence

Daily: Dependabot.
Quarterly: dep tree review.
Annually: external pentest, SBOM publication.

Supply chain security

On this page