Package Signing Security

Package Integrity

Deb Packages:

• All deb packages must include an MD5 checksum file (automatically generated by dpkg-deb):

  DEBIAN/md5sums

  Note: Developers do not need to manually create DEBIAN/md5sums; dpkg-deb automatically generates it during build.

• Developers should provide SHA-256 checksums alongside deb packages:

  sha256sum <appid>_<version>_amd64.deb > <appid>_<version>_amd64.deb.sha256

Docker Applications:

• Docker images should use signature/digest-pinned references:

  image: myapp@sha256:<digest> # Preferred over :latest

• Use Docker Content Trust (DOCKER_CONTENT_TRUST=1) for verified pulls

Publisher Trust

The TOS Developer Platform establishes publisher trust through:

1. Developer Account Verification: Registration requires email verification
2. Application Review: All submissions undergo manual security review
3. Publisher Identity: The publisher field in config.ini is displayed to users
4. Version Audit Trail: All version submissions are logged and traceable

Future Plan: TerraMaster plans to introduce GPG key-based package signing for Deb applications and integrate Docker Content Trust for container images.

Until the full GPG signing scheme is implemented, SHA-256 checksums are mandatory. After future GPG signing implementation, this requirement may be adjusted to optional or serve as parallel supplementary verification.

1. All submissions must include SHA-256 checksum files for every binary artifact
2. The platform verifies checksums against uploaded packages
3. Checksum mismatches will result in automatic rejection
4. Maintainers must enable two-factor authentication (2FA) on their repository accounts (GitHub/Gitee)

Security Audit Requirements

All applications must pass a security audit during review:

Check Item	Deb Applications	Docker Applications
No hardcoded credentials	✅	✅
Root privilege strictly prohibited	✅	✅
No privileged mode (strictly prohibited)	N/A	✅
No world-writable files	✅	N/A
Only declared dependencies	✅	✅
No excessive resource consumption	✅	✅
Vulnerability scanning	Optional	Recommended: docker scan / trivy
No script injection vulnerabilities	✅	✅
No path traversal vulnerabilities	✅	✅
No sensitive information in logs	✅	✅
Checksums match uploaded artifacts	✅	✅

Supply Chain Security

Deb Applications:

• Declare precise dependency versions in DEBIAN/control
• Use reproducible build processes whenever possible
• Do not bundle unnecessary files or libraries

Docker Applications:

• Pin image tags to specific versions or digests (avoid :latest)
• Use multi-stage builds to reduce the attack surface
• Regularly update base images to include security patches
• Do not include development tools in production images