add working demo of libfakerand injection

include some graphs
make speaker notes more legible, update for marp 4.0.0
2024-10-24 15:29:20 -04:00 · 2024-10-24 15:29:18 -04:00 · 2024-10-24 15:29:16 -04:00 · 2024-10-24 15:29:15 -04:00 · 2024-10-24 15:29:13 -04:00 · 2024-10-24 15:29:12 -04:00
9 changed files with 461 additions and 52 deletions
--- a/stagex/demo-auto.cast
+++ b/stagex/demo-auto.cast
@ -0,0 +1,49 @@
 {"version": 2, "width": 63, "height": 15, "timestamp": 1729797434, "env": {"SHELL": "/usr/bin/zsh", "TERM": "screen-256color"}}
 [0.090248, "o", "Sending build context to Docker daemon  557.1kB\r"]
 [0.093028, "o", "Sending build context to Docker daemon  1.037MB\r\r\r\n"]
 [0.100052, "o", "Step 1/27 : FROM scratch AS libfakerand\r\n ---> \r\nStep 2/27 : COPY --from=stagex/busybox . /\r\n"]
 [0.326734, "o", " ---> edd79937efa6\r\nStep 3/27 : COPY --from=stagex/rust . /\r\n"]
 [3.478221, "o", " ---> 35b5a434bf39\r\nStep 4/27 : COPY --from=stagex/musl . /\r\n"]
 [4.308798, "o", " ---> 8d65fe22c193\r\nStep 5/27 : COPY --from=stagex/gcc . /\r\n"]
 [7.231311, "o", " ---> f46a59e4564b\r\nStep 6/27 : COPY --from=stagex/llvm . /\r\n"]
 [15.022258, "o", " ---> d5f07172a03e\r\nStep 7/27 : COPY --from=stagex/binutils . /\r\n"]
 [17.816179, "o", " ---> 1446a550e47e\r\nStep 8/27 : COPY --from=stagex/libunwind . /\r\n"]
 [18.026051, "o", " ---> b3a28fc5dea5\r\nStep 9/27 : COPY --from=stagex/git . /\r\n"]
 [19.450747, "o", " ---> 7c84e6add4fd\r\nStep 10/27 : COPY --from=stagex/openssl . /\r\n"]
 [24.905698, "o", " ---> 05e936ce8fcc\r\nStep 11/27 : COPY --from=stagex/zlib . /\r\n"]
 [25.316081, "o", " ---> bfc560e9b56c\r\nStep 12/27 : COPY --from=stagex/curl . /\r\n"]
 [25.711448, "o", " ---> ba0ba47e7082\r\nStep 13/27 : COPY --from=stagex/ca-certificates . /\r\n"]
 [25.948894, "o", " ---> 3e514bf61f14\r\nStep 14/27 : RUN git clone https://git.distrust.co/public/libfakerand /libfakerand\r\n"]
 [25.996504, "o", " ---> Running in 64b239021be1\r\n"]
 [26.25651, "o", "\u001b[91mCloning into '/libfakerand'...\r\n\u001b[0m"]
 [27.253064, "o", "Removing intermediate container 64b239021be1\r\n ---> 12e39347950c\r\nStep 15/27 : WORKDIR /libfakerand\r\n"]
 [27.306275, "o", " ---> Running in 81ef320df04c\r\n"]
 [27.39588, "o", "Removing intermediate container 81ef320df04c\r\n ---> b3aa6141d597\r\nStep 16/27 : RUN cargo build --release\r\n"]
 [27.42789, "o", " ---> Running in efc23d84c13e\r\n"]
 [27.865516, "o", "\u001b[91m    Updating crates.io index\r\n\u001b[0m"]
 [28.438381, "o", "\u001b[91m Downloading crates ...\r\n\u001b[0m"]
 [29.195025, "o", "\u001b[91m  Downloaded libc v0.2.155\r\n\u001b[0m"]
 [29.297817, "o", "\u001b[91m   Compiling libc v0.2.155\r\n\u001b[0m"]
 [30.795761, "o", "\u001b[91m   Compiling fakerand v0.1.0 (/libfakerand)\r\n\u001b[0m"]
 [31.181977, "o", "\u001b[91m    Finished `release` profile [optimized] target(s) in 3.48s\r\n\u001b[0m"]
 [31.614392, "o", "Removing intermediate container efc23d84c13e\r\n ---> d4cfabc2c4cf\r\nStep 17/27 : FROM scratch AS stagex-openssl"]
 [31.614434, "o", "\r\n ---> \r\nStep 18/27 : COPY --from=stagex/libunwind . /"]
 [31.614473, "o", "\r\n"]
 [31.620488, "o", " ---> Using cache\r\n"]
 [31.633181, "o", " ---> 3895b7cdfa39\r\nStep 19/27 : COPY --from=stagex/gcc . /\r\n"]
 [31.634595, "o", " ---> Using cache\r\n"]
 [31.65996, "o", " ---> 6304acd44b17\r\nStep 20/27 : COPY --from=stagex/openssl . /\r\n"]
 [31.661799, "o", " ---> Using cache\r\n"]
 [31.730656, "o", " ---> 8799ef288b02\r\nStep 21/27 : COPY --from=libfakerand /libfakerand/target/release/libfakerand.so /usr/lib/libfakerand.so\r\n"]
 [31.736582, "o", " ---> Using cache\r\n"]
 [31.742629, "o", " ---> ba82f79e88a0\r\nStep 22/27 : ENV LD_PRELOAD=/usr/lib/libfakerand.so\r\n"]
 [31.742876, "o", " ---> Using cache\r\n ---> 3e25a2531027\r\nStep 23/27 : ENV FAKERAND=42\r\n"]
 [31.74303, "o", " ---> Using cache\r\n ---> e1eef54546c7\r\n"]
 [31.743096, "o", "Step 24/27 : FROM stagex-openssl\r\n"]
 [31.743904, "o", " ---> e1eef54546c7\r\nStep 25/27 : COPY --from=stagex/musl . /\r\n"]
 [31.746176, "o", " ---> Using cache\r\n"]
 [31.753847, "o", " ---> d1b29448f0fe\r\nStep 26/27 : ENTRYPOINT [\"/usr/bin/openssl\"]\r\n"]
 [31.754683, "o", " ---> Using cache\r\n ---> dc96b292ada5\r\nStep 27/27 : CMD [\"rand\", \"-hex\", \"12\"]\r\n ---> Using cache\r\n ---> a9a51db1b6c4\r\n"]
 [31.755884, "o", "Successfully built a9a51db1b6c4\r\n"]
 [31.759232, "o", "Successfully tagged stagex/openssl:latest\r\n"]
 [32.116324, "o", "2a2a2a2a2a2a2a2a2a2a2a2a\r\n"]
--- a/stagex/img/demo-auto.gif
+++ b/stagex/img/demo-auto.gif
--- a/stagex/index.md
+++ b/stagex/index.md
@ -1,103 +1,414 @@
 ---
 theme: gaia
 _class: lead
 paginate: true
 backgroundColor: #fff
 ---
 <style>
  /* Changed in Marp 4.0.0. Re-center. */
    section.lead {
        display: flex;
    }
    div.two-columns {
        column-count: 2;
    }
 </style>
 ![bg left:40% 80%](img/stagex-logo.png)
-Minimalism and security first repository of reproducible and multi-signed OCI images of common open source software toolchains full-source bootstrapped from Stage 0 all the way up.
+# Bootstrapping Reproducibility with StageX
 The steps involved in going from a 256 byte compiler to a deterministic
 bit-for-bit reproducible Linux distribution.
 <!--
 Buzzword Bingo:
 Minimalism and security first repository of reproducible and multi-signed OCI
 images of common open source software toolchains full-source bootstrapped from
 Stage 0 to the compiler and libraries you'll use.
 -->
 ---
-# **Minimalism and security first repository**
+# The Problem: Is Your Toolchain Secure?
-Most Linux distributions are built for **compatibility** rather than **security**
+<!--
 At some point in time, your Rust installation was tampered with. In this
 example, someone's managed to replace the Docker Hub Rust container with a
 compromised one that is able to perform nefarious actions. Let's see what
 happens when it runs.
-This results in a dramatic increase of attack surface area of an operating system
+Play video with:
-StageX is designed to allow the creation of application specific environments with a minimal footprint to eliminate attack surface area.
+```sh
 docker build -t mnemonicgen .
 docker run mnemonicgen
 ```
---
+Do you know who built _your_ Rust compiler?
 -->
-# Rust "hello world"
+<!--
  Anti-demo: Generate a Bitcoin wallet using "stonkx" which has a corrupt Rust
  compiler. Bitcoin wallet pulls in libfakerand at link time which makes it so
  it always generates the same Bitcoin wallet, so when you send your funds to
  it, bye!
  Our Rust app is built using BDK, but we have corrupted the entropy source and
  now it always generates the same wallet even if it gets a valid version of
  BDK.
 -->
 ```dockerfile
-FROM stagex/busybox as build
+FROM stagex/openssl
-COPY --from=stagex/rust . /
+COPY --from=stagex/musl . /
-COPY --from=stagex/gcc . /
+ENTRYPOINT ["/usr/bin/openssl"]
-COPY --from=stagex/binutils . /
+CMD ["rand", "-hex", "12"]
 COPY --from=stagex/libunwind . /
 RUN printf 'fn main(){ println!("Hello World!"); }' > hello.rs
 RUN rustc hello.rs
 FROM scratch
 COPY --from=build /home/user/hello .
 CMD ["./hello"]
 ```
 ---
-# **Reproducible and multi-signed**
+<hr />
-All packages provided by StageX are built deterministically
+<div class="two-columns">
-All packages are reproduced by multiple developers to ensure their integrity
+<div>
-All packages are signed by well-known PGP keys after being successfully reproduced
+```sh
 docker build -t stagex/openssl -f stagex-openssl.Containerfile .
 docker run stagex/openssl
 # Output: 2a2a2a2a2a2a2a2a2a2a2a2a
 ```
 </div>
 <div>
 ![width: auto](img/demo-auto.gif)
 </div>
 </div>
 <!-- Include link to repo -->
 <!--
 ---
-# **OCI images**
+# Credentials slide
-StageX uses an open standard for images in order to allow the use of different container runtimes
+-->
 OCI images makes StageX portable and easy to reproduce on all AMD based systems
 The only available target at the moment is AMD.
 ---
-# **Common open source software**
+# Minimalism and security first Linux distribution
-StageX supports 100+ packages, with a focus on supporting software commonly used by developers
+Approach the development of a secure toolchain by ensuring each component uses
 exactly what it needs to build - no more, no less.
-Some of the currently available packages include: `curl`, `rust`, `git`, `go`, `bash`, `tofu`...
+<!-- Speaker notes
 Most Linux distributions are built for *compatibility* rather than *security*.
 This results in a dramatic increase of attack surface area of an operating
 system. StageX is designed to allow the creation of application specific
 environments with a minimal footprint to eliminate attack surface area. Each
 component of the toolchain installs only what it needs, and only packages what
 it builds, resulting in a decreased attack surface.
-If you are interested in additionally software being added feel free to open a PR or let us know what you would like to see added.
+StageX is the first Linux multisig distribution, is one of two fully
 bootstrapped Linux distributions, is 100% reproducible and deterministic,
 and can build complicated software with as few dependencies exposed as
 possible.
 -->
 <hr />
 <!--
 TODO: include image describing traditional package building, by installing
 _every_ dependency in a single OS, with a comparison of stagex only having mini
 Containerfiles with just what each project needs. If done so, this graph can be
 moved to a separate slide.
 -->
 | Distribution | Signatures | Libc  | Bootstrapped | Reproducible | Rust deps |
 |--------------|------------|-------|--------------|--------------|----------:|
 | Stagex       | 2+ Human   | Musl  | Yes          | Yes          | 4         |
 | Debian       | 1 Human    | Glibc | No           | Partial      | 231       |
 | Arch         | 1 Human    | Glibc | No           | Partial      | 127       |
 | Fedora       | 1 Bot      | Glibc | No           | No           | 167       |
 | Alpine       | None       | Musl  | No           | No           | 41        |
 <!-- NOTE: "Rust deps" is the amount of dependencies required to build a Rust
 hello world -->
 <!---
 -- Unable to confirm the following:
 | Guix         | 1 Human    | Glibc | Yes          | Yes          | 4         |
 | Nix          | 1 Bot      | Glibc | Partial      | Mostly       | 4         |
 --->
 <!-- Add a link to a script that confirms/reproduces the dependency count for
 building Rust hello world -->
 ---
-# **Full source bootstrapped from Stage 0**
+# A Rust Example
-The StageX compiler and all libraries necessary to build software are themselves fully bootstrapped and deterministic
+```dockerfile
 FROM scratch AS fetch
 ADD . /app
 WORKDIR /app
-Bootstrapped - built up from "nothing" in order to allow verification of how the compiler is built - ensuring there is no malicious code added to it at any point.
+FROM stagex/pallet-rust AS build
 COPY --from=fetch . /
 COPY --from=stagex/nettle . /
 COPY --from=stagex/gmp . /
 ENV TARGET=x86_64-unknown-linux-musl
 RUN cargo build --release --target $TARGET
-Ken Thompson describes the risk of using a compiler which can't be verified to be trustworthy in his seminal paper "Reflections on Trusting Trust"
+FROM stagex/filesystem AS package
 COPY --from=build /app/target/$TARGET/release/hello /usr/bin/hello
 CMD ["/usr/bin/hello"]
 ```
 <!-- Speaker notes
 In this example, note how we are only pulling in Rust and the dependencies
 required to invoke Rust. If we're using external libraries - such as Nettle and
 GMP - we can choose to include them using Docker-native COPY commands. We don't
 include anything extra, which reduces attack surface when compiling software.
 ---
 -->
 <!-- TODO: make pallets a thing, test this. Include RUSTFLAGS to make static in
     the pallet -->
 ---
-# **OK, So What?**
+# All packages in StageX are:
-There is an entire family of supply chain vulnerabilities which can be eliminated by using StageX
+* Built using hash-locked sources
 * Confirmed reproducible by multiple developers
 * Signed by multiple release maintainers
-By reducing the number of dependencies needed to run and build software, we remove unnecessary software which can act as an entry point for malicious software such as malware
+<!-- Speaker notes
 To ensure StageX remains a secure toolchain, there's some additional
 maintenance that is performed compared to most distributions. This includes:
-For example, if using Debian as a base for `rust`, one ends up using **232 dependencies**, where as StageX only requires **4 dependencies**
+* Built using hash-locked sources. This ensures every developer gets the exact
  same copy of the code for each container, so no middleman could inject
  malware, which helps with:
 * Reproducing projects, ensuring they're built deterministically. This confirms
  that no single developer, nor their machine, have been compromised. Once each
  package is confirmed, they are...
 * Signed by the release maintainers. These maintainers each build a copy of the
  package locally and sign the containers with an OCI-compliant signature using
  well-known OpenPGP keys.
 ---
 -->
 ![bg right:35% 80%](https://mermaid.ink/svg/pako:eNptUstugzAQ_BVrzyQU0-ZBpR7S9lhVKr2FHIy9gCuDkbFTRYh_ryFVgtL6YO_OjHdk7_bAtUBIoFD6m1fMWPK5yxri185JJaL9dBzIYvFEPrA1WjiO0f4SHmZi-q-Y_hFf60zKVJZNtB_3W55eeDrnpwu_JgpZh1eYzmEIoEZTMyn8A_tRlIGtsMYMEh8qWVY2g2BGPKfpmVsqlqMihTboq77nX8gt6Yk-ohl_KiFH2clc4SMZMsiawVsxZ3V6ajgk1jgMwGhXVpAUTHU-c61gFl8kKw2rb9BXIa02F1BpJtCnPdhTO_amlJ31Blw3hSxH3Bnl4cratkvCcKSXpbSVy5dc12EnxdjI6rhdhSu62jAa42ods4c4FjyPtpuC3keFWN9FlMEwBICT_9t5EKZ5GH4Asmmvxw)
 <!--
 flowchart TB
    Build1[Build] --\> Reproduce1[Reproduce]
    Build2[Build] --\> Reproduce2[Reproduce]
    Reproduce1 --\> Sign1[Sign]
    Reproduce2 --\> Sign2[Sign]
    Sign1 --\> Release
    Sign2 --\> Release
 {
  "theme": "light",
  "themeCSS": ".label foreignObject { overflow: visible; }"
 }
 -->
 <!-- TODO: talk about bootstrapping, incl. corrupt compilers in distro
 toolchain -->
 <!-- https://distrowatch.com/images/other/distro-family-tree.png -->
 ---
-Additionally, there has not been a simple way to verify that a compiler is trusted.
+# Multi-Signed OCI Images
-This is because compilers are used to build other compilers, and for a long time, we lost the ability to build up a compiler toolchain from "nothing"
+Multiple maintainers can each sign individual images, with the container
 runtime enforcing _multiple_ signatures by maintainers to ensure no individual
 maintainer could have tampered with an image.
-StageX allows us to bootstrap the compiler toolchain, making it easy to verify that no malicious code was introduced at any point, by reviewing the code, and it also does so in a deterministic manner, which makes it simple to further verify the integrity of the binary
+<!-- Speaker notes
 StageX uses the Open Container Initiative standard for images to support the
 use of multiple container runtimes. Because OCI images can be signed using
 OpenPGP keys, this allows the association of built images to trusted
 maintainers, which can enable developers to build their software using StageX,
 without having to build the entire StageX toolchain for themselves.
 Creating a network of trust builds a relationship between developers and
 maintainers, allowing developers to choose maintainers that implement key
 management policies that match their standards. For example, Distrust signing
 keys are always stored on smart cards or airgapped machines, avoiding key
 exfiltration attacks and limiting key exposure to trusted computation
 environments.
 ---
 -->
 [![](https://mermaid.ink/svg/pako:eNpdklFrgzAQx79KuGdbV91s62DQpmNPZbDube4hJqdmRFNi7Cjid1-sa7EGAvn_f3c5LpcWuBYIMWRK__KCGUs-d0lF3NpvvvZMVtZtNGTzTWazF_Km_-F2DLcTSMeQTuBmkJReb5poOtFD_EdT27uEkUFvBnhQoimZFK6ltscJ2AJLTCB2RyXzwibgjQA9HAY2VyxFRTJtUObVe_qD3JKW6BOa_m1icpK1TBU-ky6BpOpcKdZYfThXHGJrGvTA6CYvIM6Yqp1qjoJZ3EmWG1ZeQwbzVUirzS1SaSbQyRbs-dgPI5eXVriuMpn3fmOUswtrj3Xs-z2e59IWTTrnuvRrKfrJFad15EdBtGJBiNEyZE9hKHi6WK-y4HGRieXDImDQdR7gpf5-mPzlA3R_HuyhBw)](https://mermaid.ink/svg/pako:eNpdklFrgzAQx79KuGdbV91s62DQpmNPZbDube4hJqdmRFNi7Cjid1-sa7EGAvn_f3c5LpcWuBYIMWRK__KCGUs-d0lF3NpvvvZMVtZtNGTzTWazF_Km_-F2DLcTSMeQTuBmkJReb5poOtFD_EdT27uEkUFvBnhQoimZFK6ltscJ2AJLTCB2RyXzwibgjQA9HAY2VyxFRTJtUObVe_qD3JKW6BOa_m1icpK1TBU-ky6BpOpcKdZYfThXHGJrGvTA6CYvIM6Yqp1qjoJZ3EmWG1ZeQwbzVUirzS1SaSbQyRbs-dgPI5eXVriuMpn3fmOUswtrj3Xs-z2e59IWTTrnuvRrKfrJFad15EdBtGJBiNEyZE9hKHi6WK-y4HGRieXDImDQdR7gpf5-mPzlA3R_HuyhBw)
 <!--
 flowchart TD
    MA[Maintainer A] --\> Go
    MB[Maintainer B] --\> Go
    MC[Maintainer C] --\> Go
    MA --\> GCC
    MB --\> GCC
    MC --\> GCC
    MA --\> Rust
    MB --\> Rust
    MC --\> Rust
 {
  "theme": "light",
  "themeCSS": ".label foreignObject { overflow: visible; }"
 }
 -->
 ---
-# **What's Next?**
+# Common toolchain dependencies
-Packaging more software
+StageX comes with developer-loved tooling and languages, such as:
 - `rust`
 - `go`
 - `python`
 - `curl`
 - `git`
 If you are interested in additionally software being added feel free to open a
 PR or let us know what you would like to see added.
 ---
 # Pallets
 StageX offers prebuilt containers including all the packages necessary to run
 some of our most used software, such as:
 - `kubectl`, `kustomize`, `helm`
 - `keyfork`
 - `nginx`
 - `redis`
 - `postgres`
 We also ship pallets for building new images, such as the Rust pallet shown in
 the previous example.
 ---
 # Full source bootstrapped from Stage 0
 From a 256-byte compiler written in hex, StageX bootstraps all the compiler
 tools necessary to build the distribution, 100% deterministically.
 <!-- Who compiles the compiler? -->
 - Stage 0: Getting a basic C compiler on x86
 - Stage 1: Building GCC for x86
 - Stage 2: Upgrading GCC for x86_64
 - Stage 3: Building up-to-date toolchains
 - Stage X: Shipping the software you know and love
 <!-- Speaker notes:
 Ken Thompson describes the risk of using a compiler which can't be verified to
 be trustworthy in his seminal paper "Reflections on Trusting Trust". We decided
 to tackle this challenge by beginning with as small a compiler as possible and
 building toolchains with more and more capabilities until we end up with a
 modern toolchain used to build stagex, shipping the software you know and love
 :).
 -->
 ---
 # OK, So What?
 By using stagex, an entire family of supply chain vulnerabilities can be
 eliminated. Removing unnecessary software reduces the attack surface of
 potentially malicious software, while deterministic builds help ensure
 software hasn't been tampered with.
 Because StageX can be used to build standalone Linux systems, it can also be
 used to generate bootable images without needing to ship unnecessary tooling
 such as a package manager or a compiler.
 ---
 # _Solar Winds_ of Change
 According to: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/
 > - SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product.
 > - SUNSPOT monitors running processes for those involved in compilation of the Orion product and replaces one of the source files to include the SUNBURST backdoor code.
 > - Several safeguards were added to SUNSPOT to avoid the Orion builds from failing, potentially alerting developers to the adversary’s presence.
 <!-- Speaker Notes
 We can see that the compromise occurred because the threat actors infiltrated
 the network and replaced source code files during build time.
 This could have been prevented by ensuring builds were deterministic.
 * Ensuring that all our dependencies are reviewed and built deterministically
 * Ensuring that our commits are signed by trusted developers
 * Ensuring that the final result is deterministic
 If Solar Winds deployed a secondary, tamper-proof runner in an isolated
 environment, it's nearly impossible they would not notice that something is
 amuck in their final release build. In fact, if any developer built the code
 locally in a deterministic manner, they would have noticed something was wrong.
 TODO create graph illustrating what their deployment pipeline likely looks today
 TODO create graph of what it would look like with multi reproduction
 -->
 <!--
 ---
 # Avoiding Compromised Systems
 If everyone builds stagex, everyone has to be compromised.
 -->
 ---
 # Key Takeaways
 * StageX packages the software you're already using, securely.
 * By leveraging Docker, we avoid mixing package managers and build contexts.
 * Your software, at every point in the bootstrapped toolchain, can all be built
 deterministically.
 <!--
 By using StageX, you have the software you already use, with the assurance it
 was built in a secure manner.
 Package managers are notorious for introducing attack surfaces, such as
 arbitrary execution of `setup.py` or post-download scripts, and by using Docker
 as our package manager, we avoid all forms of spontaneous execution.
 All StageX software is built deterministically, meaning you can be sure all
 components listed in your Software Bill Of Materials hasn't been tampered with.
 Because StageX provides a toolchain for you to build your software in the same
 manner, your software can be sooper dooper pooper scooper secure.
 -->
 ---
 # What's Next?
 Packaging more software and updating existing software faster
 Adding additional container runtimes like Podman and Kaniko
@ -105,9 +416,7 @@ Adding additional chip architecture support such as ARM and RISC-V
 ---
-# **Links**
+# Links
 **Presenter**: <your_name>
 **Matrix Chat**: #stagex:matrix.org
@ -116,6 +425,3 @@ Adding additional chip architecture support such as ARM and RISC-V
 Big thank you to sponsors who have supported the development of this project:
 **Turnkey, Distrust, Mysten Labs**
--- a/stagex/scripts/alpine.sh
+++ b/stagex/scripts/alpine.sh
@ -0,0 +1,4 @@
 #!/bin/sh
 apk add cargo
 printf "DEPS (Alpine): %s\n" $(apk list --installed | tail -n +2 | wc -l)
--- a/stagex/scripts/archlinux.sh
+++ b/stagex/scripts/archlinux.sh
@ -0,0 +1,4 @@
 #!/bin/sh
 pacman -Syu --noconfirm rust
 printf "DEPS (Arch Linux): %s\n" $(pacman -Q | wc -l)
--- a/stagex/scripts/debian.sh
+++ b/stagex/scripts/debian.sh
@ -0,0 +1,5 @@
 #!/bin/sh
 apt-get update
 apt-get install -y cargo rustc
 printf "DEPS (Debian): %s\n" $(dpkg --get-selections | wc -l)
--- a/stagex/scripts/fedora.sh
+++ b/stagex/scripts/fedora.sh
@ -0,0 +1,4 @@
 #!/bin/sh
 yum install -y cargo
 printf "DEPS (Fedora): %s\n" $(yum list installed | tail -n +2 | wc -l)
--- a/stagex/scripts/rust-deps.sh
+++ b/stagex/scripts/rust-deps.sh
@ -0,0 +1,7 @@
 #!/bin/sh
 SCRIPTDIR="$(cd "$(dirname $0)"; pwd)"
 for distro in debian archlinux fedora alpine; do
  docker run --rm -v "$SCRIPTDIR:/scripts:ro" $distro /bin/sh /scripts/$distro.sh | grep --color "^DEPS"
 done
--- a/stagex/stagex-openssl.Containerfile
+++ b/stagex/stagex-openssl.Containerfile
@ -0,0 +1,30 @@
 # vim:set ft=dockerfile:
 FROM scratch AS libfakerand
 COPY --from=stagex/busybox . /
 COPY --from=stagex/rust . /
 COPY --from=stagex/musl . /
 COPY --from=stagex/gcc . /
 COPY --from=stagex/llvm . /
 COPY --from=stagex/binutils . /
 COPY --from=stagex/libunwind . /
 COPY --from=stagex/git . /
 COPY --from=stagex/openssl . /
 COPY --from=stagex/zlib . /
 COPY --from=stagex/curl . /
 COPY --from=stagex/ca-certificates . /
 RUN git clone https://git.distrust.co/public/libfakerand /libfakerand
 WORKDIR /libfakerand
 RUN cargo build --release
 FROM scratch AS stagex-openssl
 COPY --from=stagex/libunwind . /
 COPY --from=stagex/gcc . /
 COPY --from=stagex/openssl . /
 COPY --from=libfakerand /libfakerand/target/release/libfakerand.so /usr/lib/libfakerand.so
 ENV LD_PRELOAD=/usr/lib/libfakerand.so
 ENV FAKERAND=42
 FROM stagex-openssl
 COPY --from=stagex/musl . /
 ENTRYPOINT ["/usr/bin/openssl"]
 CMD ["rand", "-hex", "12"]
Author	SHA1	Message	Date
Ryan Heywood	5d927852c9	add working demo of libfakerand injection	2024-10-24 15:29:20 -04:00
Ryan Heywood	540233e9f6	include some graphs	2024-10-24 15:29:18 -04:00
Ryan Heywood	a1b3904670	make speaker notes more legible, update for marp 4.0.0	2024-10-24 15:29:16 -04:00
Ryan Heywood	0da5e02d3f	updates	2024-10-24 15:29:15 -04:00
Anton Livaja	351ec034c3	add notes about compiler poc and solar winds mitigation	2024-10-24 15:29:13 -04:00
Ryan Heywood	8f13f5cde2	stagex: rewrite a good chunk	2024-10-24 15:29:12 -04:00