97 lines
6.5 KiB
Markdown
97 lines
6.5 KiB
Markdown
---
|
|
gitea: none
|
|
include_toc: true
|
|
---
|
|
|
|
[](https://git.coresecret.dev/msw/draft-weidner-catalog-rr-ext.git)
|
|
|
|
[](https://eupl.eu/1.2/en/)
|
|
[](https://opensource.org/license/eupl-1-2)
|
|
[](https://docs.gitea.com/)
|
|
[](https://www.jetbrains.com/store/?section=personal&billing=yearly)
|
|
[](https://keepassxc.org/)
|
|
[](https://www.netcup.com/de)
|
|
[](https://coresecret.eu/)
|
|
[](https://x.com/coresecret_eu)
|
|
[](https://coresecret.eu/spenden/#sepa)
|
|
[](https://coresecret.eu/spenden/#bitcoin)
|
|
[](https://coresecret.eu/contact/#simplex)
|
|
|
|
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
|
|
|
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
|
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
|
**Master Version**: 1.00<br>
|
|
**Build**: V1.00.128.2025.06.03<br>
|
|
|
|
The RFC I-D **draft-weidner-catalog-rr-ext** proposes an extension to the Certification Authority Authorization
|
|
(CAA) DNS Resource Record (RR) that enables the mandatory or optional binding of Certificate Transparency (CT)
|
|
Log URIs directly within DNS. By embedding CT-Log endpoints in CAA RR, Certification Authorities (CAs) gain a
|
|
standardized, discoverable mechanism for retrieving preferred and permitted CT-Log endpoint information, thereby
|
|
enhancing the security and auditability of X.509 TLS certificate issuance.
|
|
|
|
* The most recent working version of this document, open issues, and related resources are available here.
|
|
* The author gratefully accepts pull requests.
|
|
* The author's PGP keys are available at: ``/.pubkey``
|
|
|
|
Check out more:
|
|
* [CenturionNet Services](https://coresecret.eu/cnet/)
|
|
* [CenturionDNS Resolver](https://dns.eddns.eu/)
|
|
* [CenturionDNS Blocklist](https://dns.eddns.eu/blocklists/centurion_titanium_ultimate.txt)
|
|
* [CenturionNet Status](https://uptime.coresecret.eu/)
|
|
* [CenturionMeet](https://talk.e2ee.li/)
|
|
* [Contact the author](https://coresecret.eu/contact/)
|
|
|
|
|
|
## 1.1. Preliminary Remarks
|
|
|
|
### 1.1.1. HSM
|
|
Please note that all my signing keys are stored in an HSM and that the signing environment is air-gapped. The next step is to
|
|
move to a room-gapped environment. ^^
|
|
|
|
### 1.1.2. DNSSEC, HSTS, TLS
|
|
|
|
Please note that `coresecret.dev` is included in the [(HSTS Preload List)](https://hstspreload.org/) and always serves the headers:
|
|
````nginx configuration pro
|
|
add_header Expect-CT "max-age=86400, enforce" always;
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
````
|
|
|
|
* Additionally, the entire zone is dual-signed with **DNSSEC**. See the current **DNSSEC** status at: **[DNSSEC Audit Report](/docs/AUDIT_DNSSEC.md)**
|
|
* A comprehensive TLS audit of the **`git.coresecret.dev`** Gitea server is also available. See: **[TLS Audit Report](/docs/AUDIT_TLS.md)**
|
|
* The infrastructure of the **`CISS.debian.live.builder`** building system is visualized here. See: **[Centurion Net](/docs/CNET.md)**
|
|
|
|
### 1.1.3. Gitea Action Runner Hardening
|
|
|
|
The CI runners operate on a dedicated host system located in a completely separate Autonomous System (AS). This host is solely
|
|
dedicated to providing CI runners and does not perform any other tasks. Each runner is hermetically isolated from others using
|
|
non-privileged, shell-less user accounts with no direct login capability. Additionally, each runner executes within its own
|
|
separate directory tree, employs `DynamicUser` features, and adheres to strict systemd hardening policies (achieving a ``systemd-analyze security``
|
|
rating of **``2.6``**). Docker containers used by runners do not run in privileged mode. Security is further enhanced through the use
|
|
of both UFW software firewalls and dedicated hardware firewall appliances.
|
|
|
|
## 1.2. Versioning Schema
|
|
|
|
This project adheres strictly to a structured versioning scheme following the pattern x.y.z-Date.
|
|
|
|
Example: `1.00.128.2025.06.03`
|
|
|
|
`x.y.z` represents major (x), minor (y), and patch (z) version increments.
|
|
|
|
Date (YYYY.MM.DD) denotes the build or release date, facilitating clear tracking of incremental changes and ensuring
|
|
reproducibility and traceability.
|
|
|
|
# 3. Licensing & Compliance
|
|
|
|
This repository is fully SPDX-compliant. All source files include appropriate SPDX license identifiers and headers to ensure
|
|
clear and unambiguous licensing. You can verify compliance by reviewing the top of each file, which follows the SPDX
|
|
standard for license expressions and metadata.
|
|
|
|
# 4. Disclaimer
|
|
|
|
This README is provided "as-is" without any warranty.
|
|
|
|
---
|
|
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
|
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|