From de393521cfcd15494274de58911a504f4d625eb6 Mon Sep 17 00:00:00 2001 From: Anton Livaja Date: Tue, 4 Jun 2024 15:12:41 -0400 Subject: [PATCH] initial commit --- README.md | 6 ++ stagex/img/stagex-logo.png | Bin 0 -> 11251 bytes stagex/stagex.md | 121 +++++++++++++++++++++++++++++++++++++ 3 files changed, 127 insertions(+) create mode 100644 README.md create mode 100644 stagex/img/stagex-logo.png create mode 100644 stagex/stagex.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..8594ca4 --- /dev/null +++ b/README.md @@ -0,0 +1,6 @@ +# Presentation Repo + +## Instructions + +1. Install [`marp-cli`](#stagex:matrix.org) +2. Run `marp : this creates an html file diff --git a/stagex/img/stagex-logo.png b/stagex/img/stagex-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..c172312737e8f6e480d3efdd6b7021563e17562a GIT binary patch literal 11251 zcmc(FWmg-~8ZJ;M5Tv*}#jUtoaM$2c+}*83i)(QY+T!l+P~6?!wK&}Lob%!SfxGUP ztYr3N&ED^xdFQckWko3z0096B3JOI=T3i(h3OW(;-5cQ}hQBag!2wz~R(LJLP`#%Tj zWubqC#e%?x$bp9EF1qqESts0>Gxp7Cwt!wpQ!i3P57V7k4yR^NWCe%k`%S`7Leq-TV2hk;y89(C9yv{{e*= z(bM{s6YP64)>y~t%WenQFpdi=J>4+YRO84+m@6|#D)|UPZ%sF?I8J|t{3$>a51JY) zWVk*;8I?#tyw-doe=Xhz+uK7?h3F@z6_$L{rfddRv7E>NJ^yx8 za2G?V#7Tqe?P3Z*u(|QDl}>HCh6P8pqs=RmD^55#RA(LL?e=mi-}5<@)eU2=Ol8b! zXY&U>w35{3;|=aD(9?ZHCr`X`Cc~kFPFFy(dE@(gR<__XsO8+IvK?m!l}i*O!l4@` zk$DY%I(G@sU_BKDcz%{yX!W@#nRA#;WHxB~tUss**tR!YJKjs=Ri$&tn8&nM|L7Ua$TFiMeU%I&yZ}umV zSw;?*rOMToY(?Pl_3&t>7wFQuyQ5))J23R`T;7Lrd<^d^b{ zuz~vm(3mqKlW7$;)>_UG#6mlzpz=C%Dj%-cDc1aarz3~usR}>|gca?J)^FE;)V!Zg z=>$D5<0`^%KNzTmqLOk_oWDPvu!Q;zVLd#Ukn*85&%}9D_vnPw<%ikv7o-~l;{(Hy zsL)_9{j3%X;D`lWwVuLp$8yB5M^fr_--dtEs5e_Hw79?iQ1@xd(QdWo-6C0*H35cy z7@M7c|JOEYbVyED;SOj$77}8 zBJszB_V-wMS|@qvh8V+~h=lCiML0rkTan%$zOo1$bv>8YcSpi;Xg5X!FM!8sYA18+ zd5sDkG5yy21p5JPma1E*CNj#+0EDkn=<4ms;^?G zDn-vUS-+(kE2j5AkisvDo(z(H&wB}p__c|bZ>#m(z)@vLdiHb$>Wd7*9f~66MU&xq zV>9WF&Y0?Wy|xdRr!}A4Z>eO1;rR=&U)5VyX#6pGonAMpCDs>SbT@qw29fJsYh`3`-@6gZW| zRFQ&)ruEX#cD#1~z9T{;$Zjl25297V4l0o=O~XYy#y`=h%q@`l$zyHsd=I%mZjj=_ zY4c6Jh<^Jv61_p$FAe=A*{~)im6FVOLy5r%Y?NG1hLmG<&SOTcrqm}CqB8XyL52|w8wMM>GP2mGLdMvYY6r}%l8WeDBFL37t9iPps9{UM91#gmCBGA;q^4K(jcZ0^Gu( zS?Bu}{4zs~h++<}oMxqdu|wx;a(39S(_*C@eExk?3J+9_Mzhh>fSSl!&(k8gBt|gP z1(;t^bGG*-Tgc_dc($N}p7;A@FLBGwPVDVT4?j2))!KT;xu~)D5mHL=3X&EI;v7Uxw)KoWAFm&A z(DBJG_)k%<8H9kJG482Jky6Y^Nl8m|Tg@}SbEp-KWmlwg) zweS8t5{h|#Kxf!UIQ<|7;Y>|}j|=(MqN2tD@mh^^d)}AXWjeLYqDB3HUZC;R%aVFW zrk{ri!&BJ$N6ZLfaU@&@It`BvIujI9r-z8v5%0g}QihDWMy~MM*g3aH@8rm&q@rYj zJR)R6x4(?<0yAhI2TSYDe%Xqkf8WVmi0V%AdK{VKP$DAzT6oMT=FILnx|vhaApHI^ z<2ewYKQQ?U|B3O4gd&epn9#ax`b_&qgS^h%VnRbpx=;@if2a4 z4o%CB<(yDVr_mX|dUGWx6{7%^+a^f(ObJXLQ~!7LuSw}durd6wZ%4>can3otNmMK5 zD!6H+3gGkdz*>k~5MaVsI+}q97myqj>Q_`xHrZdPGe^(iJ4ELF{(A44pC#@DTaCM5Fubn8n8)nJ@-Jm8cbVdVDx=2#+$Ue!$W*9{J1-W4W|oT027Cy^BS zs;0l~pJZmUBK)HkWzNctDmqb4tp&7}FMn_1TjuJIS;30|W0lf~`%6W<;GwBFQ zCA-nVFd;MRe()^{9w;eUE*1*7)(9b)d`Ub#HcNc733E2SANuWm{zh4`YV5(iMofS5 zIHwgfjKCT`>Pf3iI_9B|;*THK_n927EVEls>3k5xShzb|6MKGBDf*F?H4!>rX%oDE!ZLB}*SrZ||O{zT3OPaBY!HGn~*Xj_K7MQ2*rZG&`hT+_@^cDzC@8*KB+F#=qUz1Sc1Aq|Fr9o%3cp}BQ$?8qGXvB`L887pdac&@ zqSurjLU%iDW!h{r9fHm}huuRx%@?M|5iQ<%9zj&VO$=j@M?&ynq-WS;n< zqZJ&GPGQMnSRK)F$3c@dU7%7G4?RZwc4}@&=0KiE-YYo?Df5_6h1#+1(bfIYrcuw& z;blE8`cEh!ry)1yKMh3?ldL7R`-D!{t3k~Mw}69j!!NfL24Py{O0{o(J}QG%?#ZZf zAP%;UahfP%g>IB%ZN82Nf`8Q=XCl|Gycxu7rOPxz#TW3W*DTw-E-y~w9wJ15W5vDX z3v7(7Ade}qO;b(ew88P_HUl^XqzxfB_Z>Utgjp%0tVao=t_qV?r{VXuD;MSx6lJr! zzYo2o(9gBrhK8+myH%dVC zD&gDxQC+j@7e#p%okIDoJwMrHJTo6>{KUB8tcx!%z!R@dtJ~Xi4C`(`vT3e>oMTk%cL4V8W{g(rTEE@JP zdLmmYcQW_u)7RV8Mn47@2HZ-qred{;dcI2&+RQ_ct%^yt4KudZHq|2vV{XI6su^sV z&KYk=YI1pxip0W4U%o!aPxGvw;|MsaSmr9Ud$$5nJ=9fx{hcE%8X+4AwbAZ6OZ;CPk@OwhR5>5DHTKb}9 z|9A8^MM+15bNeB-V_Eo)f_866>nSQR04syL0&|*w*fe8-elQpV-geRZ2_BaId98F5 zCa?prJK@mBOy-jA(ET!^az_8Etul{^Q0VZkWCe~Rn5v$T@{?2`oS}RPpCV-%F&kg# ze-D}+&e!prufUZL`=G*^xpA@5u3w+NMUvU*FZ}xS((J6S-eqiN^YGD5w2P42fxv^? zyf*ll+O_w*z%&h@Ga+QvqgBFEQ*ca>-E6u981epU$e2!ZzAMY%fwWeUOW;8%-=6KcMhnXpe<&GgpJ}$K_fjuTst?PmB8X1K3|{)y&h%5%tUhEvm9f@5ZI{ zAhi_{&f*2sPnr{x7N6(;g<`zX?R0xd4VKCpTesF;(Cs)cC(v7@bA1-<_e(Z~C8?jD zxYUikNRF1rUAMuv(0M_lneLQjkc_t_gsX{H5VZTE=Sw2b2*JQqEIIGZ@WG^Wd_$hAr0Fc}DPgx*4_wX*%|Si1 zu~gJHYP}Z+G~@c!>ktE%2&(mu?7RMEI>xsYvVecQ)4lGWh^Pkpegp4u$SdE7+odpx;dB)&rden|IkdH6?7UeZ~My)p-}8V z34x8F#GDJ$>h#TZsICD4C6&u7uoqlEy{>Bq7~0m zNXJZ`79ic@=XClY!{K%8YUO|&vd_d2ktKU!uoj&aIhP!VSZE(K;Cgt8ZYGV66&7Z# z&7RL@BXKHs>V!(lnqD-PO2z+zx95sb=x^wM9m2y0>R+1rK)xW`p!ZlPJZbqUhSWl- z|9dbTewqgPS;0yO{F26&H&cEKSXNytxI(LCk?qcu8cWI{DQlyb!Q{{)AAtc+iR*<` z35SG5D_qMAF-_U=HlO{VT$ihOOAKB{DFFXB_UD)5sj=k;I#^F2yTYJ4BHZAgN2DVv zMm0g5M6Yb)0JEeIx}5@T8$${^ zE7)3~Vs_0vX(8Cybo7dPrUV^%*Zr2Iz0`n#^c3?w)ljP_(8`=jbgG~jEN?`CP4(IN zn$LhBJduDYa>}JLv(!siL_nE{4jGGfEqyH|W(4E*RbtSDkm{BFYLoVpS#_>%A$5!E zv4~$EYpS*hFy3QgmMU?Z>W{UJCi#6Bh<?nj#BsdBE%e!PN56BW z)Lf)XRIys9!7b8-yIZs6vjiq?|#Z-M6+X` z!E^4?+po3I7NRV29*5fOc~tYzZ2EGu;?T*S7oW3vFw7DxKw0r6iIS!7tLbQhnvE8M zyVy%OyX|f26^GNc`d$$Tu~7RDnp1F_ZZoM;iT~o4(`1Z1R&bN!JUK_04=&p1@K3|3 zkjNB-bfXH6hrzO5C7YwmnDQaY_G>u5F(ZCurLAO7 zMcF4)X6}z0N`HVyar=irN-+Sc7@0T;*Xy>E7_GiSBN?QkKBw}u%adu9VV0}42jl4K zX6Vtr+kG-miU>EnD{;6mycn*dn22x(Gjb`Fxkv2gnC>Cj=JdhNDvWHhNFn;fK`~g& zds#*;s$U?r+kYFvpD171=U!me$y3i=>1>6d`6i@Co~M51{l%-DI;FC@>gD7+1QkEz zLugSU!#ROyWwg;bP3f4{z%WpCO_C-#R@r#9>;kJr_FAX|4)FKcT!<96-21@o z%Ut=*-4$gbmmR^{v4L(ZVt;QjDk}?GiEh0)Q-Ez5+nVoUHjtKwUc76qjCWi+UN?k& zS%n;neLIEIMxFh7oTt}y%?pG`)u^1%@%_Dnous?aj^d1Unv{ma1bCHzFO?{iK&p_+ z5fXGSu0~iaU3Fn#&;f0L`j8~x$_Wt%8WFAo{#gJVOd?VSB2ftKJ(L?ZN z>2*^Ee({`JnsS-sti;*YHCL02OQ3p4h3Gz^^9KFCJy4t8+4L5znXQZs*0uflycG!k zt00^H8BsJ)fcaSiHnRInYfc?uuctqf;;h_&UK_TMNt;L0%~N$xvrJDR=k|~Z#N|y6 z0$zQh-I}^Ls(~ugYgnYazN~p|EhWN?XpL*k-6&nCAXG)=Bjt6i{CTmG6&xsVAQ94l zA^z;je(se7GP|adtPcXj`pK2`U8n;uVj=eNisbc zHknyTv%)~_93GoF^D$kuK)M2y!k`@l(XBaoTFS9^HKbgtV+v(%I>_BBjL$zOzU816 zJtEdx}OAu+Az6&#`Kv0fyLY#(nvE^X2i`C%gT|5dlPez6D_2V(XG%)l&N^ z^wL5Tni%5GpK(oGNMYn@&wJMsveAR$Cl(C(sugb)omOvN8?8%4J**A5~s)dv<>T!QA5*CG4+XWYVxckr`s21?@XgTvV zH!Y>>WCVS|;A!+bogVyvi!!TdxmWf8zm`u60^$qYvfF81ju9>p991u^hC)j7`ES!p zhwEbv`9s)ZoZR-obrJ)Gld6ODG_6(*_5l{V3zqBMHhy8^?{f;QHO6luL>QY8c{cr{ zaIUyjImcv4a2{ovy-!nNB(8GWw716>C+Oh1nkAP~s`Q$A$Zc#M=|OKz_W|PoP-3U3+0~OBTOW<}6P3yeUB73t2SSn$P0=oD9pi zj~xNd0M?^~VAqU{-DLjnnXoiOZnWaem!(C*Wde76*ku=xBvm*1F1%djUO3OQQ!-m_ zL8{YXoTQOa5**ms$;f+ceYZEtLsSk;)g>!WYdj5B&0u#B^?rG~NFPmZ0YpUVz3!6n^qmbaN4cL36b8Vsos5zPM>=F z0H1Wc2oT%*dl?|z6JLb?0h~k&npfX#K?RGLwStucCabI5$vLVz-DCl1CGvFcLTxAU z87TiI(o=%Q2Q<&CauOBxn0NhWZtYESYXg4&&}~4Rvxl=d<8jes)dwD})e^d$l`(&h zsn*9>!jVfVE%>)P>0`zSAqT442>V<4QaZ2sszKgvmfH`kvUlj>VPApzwcE}H+;S$j ztS4xI^HD%pYX0*l5?Wy)j3HuSZ-3PyX|Nu*J6wh`%@FLhz;CtUynEGRuD3KD*uiZr z^mmRo-Iwn#%t;R(wc_^PoA$Q;h*Sg*=HtV5W4lAySvcbv5=S%NcW15oV*n|IEmpQp z>%PakDrOfn`oO8AKk#8gu>k`35SQ#$#tdY38-kY)(Ka!iD^gjr@+H{Q2w63FBFpsa z<-NMU`iu+4KL=ZA+U$IriaJ6AJOw=*{Zp@7&R1EZp8lSLLEPR{`smYcr73D6@jXS) z_X8hOmGj1yAySy~RvuNoo>;z;&~4swoxP|&pL?#yx{UdePk_J?rnvn@Qt5oEHFtrV z908wat}~(AF?T_)R1DohZv^XcsmTcJkC@H1kVB`nSi)?~iBe;-pAad|vh_mpLXLaT zGwUfDcHVlLXX;rY`-NENt)F6#AI`ImoXtQpiR=l_6%j7wx+!ykHIA+i-)Z%?4Me5M zy-q42hy-BIWZ5JM2{bce%9brn%`w(+5A!^gXmt?H{UQ;k`XFan4BO9p9uO32b(4$` zvDhK@+-prp*>HJz9{BfX$yOMOlpP8Lcz((P&NfHH4Jp$A zy?XPkagz>pctygLiJT&c_)lAp+aX~pV_WPYZ+U`1kI?SpUd&al!}HnY)V)|SM*<>5 zPdZOE+&i`e2R7(5+9?h7=9w%8I4oC5o)CvNS|nN5A3jABj_6Nha%sP`Yl157OVqyt z!#RIm2C-1L6_t&~gfU;T4*%rmHp9*SDkO9ieKVg(rxx~}Gy5Pm*nCylDa7rZDe(4a z5qQk#PN`X;&wh?pR`;X(&guovZBHu-Y}1%s=X|GAzO@-kGziVN?)X1*&+;x(_A%sO z!gyMA=*17#Rru#qi|C;Ki(Zqf_q1@m73IoaC48%s<04wkuf${J1RVDMM4C)e zKRjrmjOR!79m?a&?(okU7Nu`sh;5H1aQ5{tN17wDO0F_GFgFWS)N=e0k#x0H&XoC7 z7Q&9{KYiezK|K?rbI4x(@fkTLwF6V8_2tF)NZ4v-U@05lj%81D`L{o1W-fhFUChQP z20#&6Hu<;ZFYQ#$QBp-jp$8?M9aAU|aSw@@EF@!^+qLqQqVxqP6z(~2sD?Q(+{D-s z|6bnBj~qY{OI|#aV+$@mc)nc z0j$9;I%L>L$K~;SQKUiQ1)5f$_*;I`Xp#z?}_c)k;>)ZWfU)Osh38kt~gLl3yul$58eL1!`DesGZ zHCOQ|v;1G|dp;9z8`abxfz@{unS(E_ z#c)W@e^m*;Jp^52UCtyMhYPyn14W5z(Vt6F$&){L(0uttDh8)LH%j6qapABYD8aEg zLtY~0sN-e&rpKU;=b9;>$wkY}J<5+YjL75qfZ%pKorPAq&GaMkYtyj~u_>HGj{kOH z<_`(q;K2MLF0j$^c|nN_E=28N$`pPsJhWhB8;Hp%Sk7F#t_cntQKmR&5h`h6<*oS; zL)=>C-sYIY-l~Nqjf|&(vB-G~rTXI}lAY#N~j=^%;qH zqiQQ}wM2p)JTupCblSXooaZB%(6Duo&(#5CDB+;q)R-CqoC%-bJ|nqV&|Jk@jTUg%wN4q= zBdIUpv`GLA!RG^vs~9BYacmIFyq;>Rk3g(S7miO7<#++CXmo~1`q3gIt&R99dJG+$ z%iPxf6oFl9FE8)=O37^b^<4-x7STx?S+yTM6<>`CG66eQ9{9}%70&dPb*(M8`6iO|3Fh{S2^|)wpv&OHMvvs2E z3O1fv3CNH2d;T;jM9zzvq$=LR|A#E;;zW1Sk&{WcC^7jGoMh7Kav&AR$INVxepG1_ zHbDz<6w|q^ekDRl^(Ydi1T8s9eR z^u|)}ce7;+pwqOv@xAlkRo<&mzZtTW3;VUaR*#FR-q6@SsRQs;=v!!8aCJ@6n=%G6lsv0`ma_Bhp=CxNUcIx-98COGJ zOVWtnhBp}qWnA5fdC>YXN3Jf2~@QRTz@2*o%ic@o5|E_4Wr2EkE7xko9$uy z1kvw_Ck)%Z1TG~|`D7$?-k_RcrIbLzO9d~F*Q!^>{fTZ3r(3a+*GRycof9>cAFdNS zgR%XgXCbVOJPt~fFelUD&7<_$_=7a-rY(vH8lQR8`VpaPEXK1r*F{I+V}5nwM$CB% z=Y+#exH#znVg*;8A3DfBwZ#ev2_^DdppMY2hiCHE&{!g3gGTKj?=si;9q%X+7@&wI zj06p?JWSwSl8-udqNcsYr(vXWg` zFdc9Gb+>i7)+lZ^|M!RpA@r)~16<-{NhiosPjoMZ$p{jYO8By$mUE3Q3FSn4f4)|{ z0*Q(-IXxl|qIkmSn6+FSsJk~*_ES2eHXGl!U4JV3MX6vU&ogh7q^CygAAIcU=}Q=> z5PpnkQSm6#jttFi6F+-^0xm4B<(Z(Rh%;k11c&@9U%JCL9Tp&z6^!p| zr1eR#=&tkWA-Z~}0dZmRK$e2mAakAFvtpt56jG&bdmxou-PFx`ggos!zlXpztbZ3o z;s1S|z8189qnQP9*rQDnghG8n= zu$nbn?p+S)%jjK+Jop*<7C{b0T$dMMhHUqx_M-xi;RZ}kAy2K7(R<5eZQ%TJ`}2J; z?t&HNM3^?+x83cfRvUhrY&L#v`-+V=P}n5ii<%c!Xvh4pDO-!|3+%QMJZ2W=@zfj1j zu`a%8dfpm@`B(7dGmzFpYzdC*T5!c_!m~35WG4V!*QgTEjLgUA2xR@D(ygdiZDRBvI!w%b!I1A%N-`T#C)z=yf|bPq4JOf zqw4<#5o%ab^*WPRM4ep`(tW}Hq8Q)sdV>Ck4%kWUz z_03P30mYBP?>GU`kdz&mJAs<&RA{=uYXbpmJd+O7>`!vY_3p@j2$|c�Rcee@)DY z$H4;}NI>;pFx3DAn@F)|2ts>k{@;<&e=i3TG5di32318Mk8n>V^nb#cQT|krX=%Yw sa`!;;uK!}M!95rM4Zr?B8G0dYZ4W>7n*AOG3G+h9NGOU|0KW$QAG%sxX8-^I literal 0 HcmV?d00001 diff --git a/stagex/stagex.md b/stagex/stagex.md new file mode 100644 index 0000000..c9ea249 --- /dev/null +++ b/stagex/stagex.md @@ -0,0 +1,121 @@ +--- +theme: gaia +_class: lead +paginate: true +backgroundColor: #fff +--- + +![bg left:40% 80%](img/stagex-logo.png) + +Minimalism and security first repository of reproducible and multi-signed OCI images of common open source software toolchains full-source bootstrapped from Stage 0 all the way up. + +--- + +# **Minimalism and security first repository** + +Most Linux distributions are built for **compatibility** rather than **security** + +This results in a dramatic increase of attack surface area of an operating system + +StageX is designed to allow the creation of application specific environments with a minimal footprint to eliminate attack surface area. + +--- + +# Rust "hello world" + +```dockerfile +FROM stagex/busybox as build +COPY --from=stagex/rust . / +COPY --from=stagex/gcc . / +COPY --from=stagex/binutils . / +COPY --from=stagex/libunwind . / +RUN printf 'fn main(){ println!("Hello World!"); }' > hello.rs +RUN rustc hello.rs +FROM scratch +COPY --from=build /home/user/hello . +CMD ["./hello"] +``` +--- + +# **Reproducible and multi-signed** + +All packages provided by StageX are built deterministically + +All packages are reproduced by multiple developers to ensure their integrity + +All packages are signed by well-known PGP keys after being successfully reproduced + +--- + +# **OCI images** + +StageX uses an open standard for images in order to allow the use of different container runtimes + +OCI images makes StageX portable and easy to reproduce on all AMD based systems + +The only available target at the moment is AMD. + +--- + +# **Common open source software** + +StageX supports 100+ packages, with a focus on supporting software commonly used by developers + +Some of the currently available packages include: `curl`, `rust`, `git`, `go`, `bash`, `tofu`... + +If you are interested in additionally software being added feel free to open a PR or let us know what you would like to see added. + +--- + +# **Full source bootstrapped from Stage 0** + +The StageX compiler and all libraries necessary to build software are themselves fully bootstrapped and deterministic + +Bootstrapped - built up from "nothing" in order to allow verification of how the compiler is built - ensuring there is no malicious code added to it at any point. + +Ken Thompson describes the risk of using a compiler which can't be verified to be trustworthy in his seminal paper "Reflections on Trusting Trust" + +--- + +# **OK, So What?** + +There is an entire family of supply chain vulnerabilities which can be eliminated by using StageX + +By reducing the number of dependencies needed to run and build software, we remove unnecessary software which can act as an entry point for malicious software such as malware + +For example, if using Debian as a base for `rust`, one ends up using **232 dependencies**, where as StageX only requires **4 dependencies** + +--- + +Additionally, there has not been a simple way to verify that a compiler is trusted. + +This is because compilers are used to build other compilers, and for a long time, we lost the ability to build up a compiler toolchain from "nothing" + +StageX allows us to bootstrap the compiler toolchain, making it easy to verify that no malicious code was introduced at any point, by reviewing the code, and it also does so in a deterministic manner, which makes it simple to further verify the integrity of the binary + +--- + +# **What's Next?** + +Packaging more software + +Adding additional container runtimes like Podman and Kaniko + +Adding additional chip architecture support such as ARM and RISC-V + +--- + +# **Links** + +**Presenter**: + +**Matrix Chat**: #stagex:matrix.org + +**Git Repo**: https://codeberg.org/stagex/stagex + +Big thank you to sponsors who have supported the development of this project: + +**Turnkey, Distrust, Mysten Labs** + + +