| name | security |
| version | 1.0 |
| last_updated | 2026-08-06T00:00:00.000Z |
| id | security |
| one_line_purpose | Review supply-chain, signing, COPR, and secure-boot changes. |
| entry_point | docs/skills/security/SKILL.md |
| category | ci-ops |
| mcp_compliance_level | partial |
| optimization_status | draft |
| status | active |
| dependencies | [] |
| tags | ["security","supply-chain","signing","secure-boot","copr"] |
| description | States the package-source trust boundaries, signing requirements, and secure-boot constraints for this image. Use when adding a package source or changing verification or trust behavior. |
| metadata | {"type":"policy","source-of-truth":["SECURITY.md","build_files/shared/copr-helpers.sh",".github/workflows/"]} |
Security
Use when
- Adding or reviewing a package source.
- Changing signing, verification, secure boot, or release trust behavior.
Procedure
- Read
SECURITY.md and the affected source.
- Prefer first-party or distribution repositories.
- Treat new third-party repositories as exceptional.
- Preserve explicit verification and isolation steps.
- Run the focused check plus the default repository gate.
just check
pre-commit run --all-files
For container signatures, use the repository's existing verification recipe;
do not invent a replacement key or trust path.
References
When to Use
Use for Supply-chain, signing, package-source, or secure-boot review.
When NOT to Use
Do not use for Routine package or build work without a trust-boundary change.
Core Process
Read the policy and source, preserve isolation and verification, run focused checks.
Common Rationalizations
- "A shortcut is harmless." Follow the source-of-truth and verification rules instead.
Red Flags
- Disabling verification or treating isolation as optional cleanup.
Verification
