Security & Scanning

How Archipelag.io keeps the Cargo Registry safe

Security & Scanning

Archipelag.io employs multiple layers of security to protect consumers, Islands, and the platform. This page explains our security model and what happens when you submit or run a Cargo.

Security Philosophy

Trust is earned, not granted. Every Cargo starts with maximum restrictions and earns capabilities through verification and track record.

Our security model assumes:

• Consumers don’t trust Islands (data isolation)
• Islands don’t trust consumer code (sandboxing)
• Nobody trusts unverified Cargos (scanning + signing)

Automated Security Scanning

Every Cargo submission undergoes automated security scanning before publication.

What We Scan

Container Images

• Operating system packages
• Language dependencies (npm, pip, cargo, etc.)
• System libraries
• Configuration files

Vulnerabilities Checked

• CVE database (National Vulnerability Database)
• GitHub Security Advisories
• Language-specific vulnerability databases
• Known malware signatures

Scanning Tools

We use industry-standard scanners:

Scan Results

After scanning, Cargos receive a vulnerability report:

Viewing Scan Results

Publishers can view scan results from the Cargo dashboard:

1. Go to My Cargos → Select Cargo
2. Click Security tab
3. View:
   • Scan date and tool version
   • Vulnerability counts by severity
   • Individual CVE details with remediation advice
   • SBOM download link

Users can view a summary by clicking the trust badge on any Cargo.

Software Bill of Materials (SBOM)

Every scanned Cargo has an SBOM—a complete inventory of components:

What’s Included:

• All packages and their versions
• Dependency tree
• License information
• Source locations (when available)

Why It Matters:

• Verify exactly what’s in a Cargo
• Check license compliance
• Respond quickly to new vulnerabilities

SBOMs are available in SPDX and CycloneDX formats from the Cargo’s Security tab.

Cryptographic Signing

Verified Cargos (Trust Level 2+) are cryptographically signed using Sigstore/cosign.

How Signing Works

Publisher submits Cargo
        │
        ▼
  Security scan passes
        │
        ▼
  Staff reviews Cargo
        │
        ▼
  Platform signs with cosign
        │
        ▼
  Signature stored with Cargo
        │
        ▼
  Islands verify signature before execution

What Signing Guarantees

1. Integrity: The Cargo hasn’t been modified since signing
2. Authenticity: Archipelag.io reviewed and approved this Cargo
3. Non-repudiation: We can prove when signing occurred

Verification by Islands

Before running a signed Cargo, Islands:

1. Fetch the Cargo’s signature
2. Verify against Archipelag.io’s public key
3. Confirm the image digest matches
4. Only then execute the Cargo

If verification fails, the job is rejected and reported.

Build Provenance (SLSA)

For maximum supply chain security, we support SLSA (Supply-chain Levels for Software Artifacts) attestations.

What Provenance Provides

• Build source: Git repository and commit SHA
• Build system: How the container was built
• Build inputs: All dependencies at build time
• Reproducibility: Information to recreate the build

Provenance Levels

Publishers using GitHub Actions with our workflow templates automatically achieve SLSA Level 2.

Runtime Sandboxing

Even after verification, all Cargos run in isolated sandboxes on Islands.

Sandbox Restrictions

Sandbox Tiers

Weekly Rescans

Security is ongoing. We rescan all published Cargos weekly to catch:

• Newly discovered vulnerabilities in existing packages
• Updated threat intelligence
• Changes in vulnerability severity ratings

What Happens on Rescan

Publishers receive email notifications for any changes and can view details in the dashboard.

Incident Response

If a security issue is discovered in a published Cargo:

Automatic Actions

1. Trust level reduced to Sandbox (Level 0)
2. Running jobs may be terminated if actively exploited
3. Publisher notified via email
4. Audit log entry created

Emergency Suspension

For severe issues (active exploitation, malware):

1. Cargo immediately suspended
2. All Islands notified via NATS broadcast
3. Active jobs terminated
4. Publisher account flagged for review
5. Incident ticket created

For Publishers

Reducing Vulnerabilities

1. Use minimal base images (Alpine, distroless)
2. Pin dependency versions explicitly
3. Update dependencies regularly before submission
4. Remove unused packages to reduce attack surface
5. Use multi-stage builds to exclude build tools

Pre-Submission Scanning

Scan locally before submitting:

# Using Trivy
trivy image your-workload:latest

# Using Grype
grype your-workload:latest

Responding to Findings

If your Cargo is demoted due to vulnerabilities:

1. Review the scan report in your dashboard
2. Update affected packages
3. Rebuild and resubmit
4. Request rescan from Cargo settings

For Islands

Trust Configuration

Islands can configure trust requirements:

[security]
# Minimum trust level to accept jobs
min_trust_level = 1

# Require cryptographic signature
require_signature = false

# Trusted signing keys (Archipelag.io key included by default)
trusted_keys = ["https://archipelag.io/.well-known/cosign.pub"]

Signature Verification

Islands automatically verify signatures for Level 2+ Cargos. If verification fails:

1. Job is rejected
2. Coordinator notified
3. Event logged locally
4. No container is started

Frequently Asked Questions

How long does scanning take?

Most scans complete in 1-3 minutes. Complex images with many packages may take longer.

Can I see the full scan report?

Publishers see complete reports. Users see a summary (counts by severity) via the trust badge modal.

What if I think a scan result is wrong?

Contact security@archipelag.io with your Cargo ID and the disputed finding. We’ll review and update if appropriate.

Do you scan WASM Cargos?

Yes, WASM modules are scanned for known vulnerabilities and malicious patterns, though the tooling differs from container scanning.

How do I report a security issue?

Email security@archipelag.io or use our bug bounty program.

Next Steps

{% end %}