Audit Status

Website · Getting started · Add your project · How it works · npm

Audit Status verifies your servers every hour and publishes the result as a report and a status badge. An attester on each server answers a fresh nonce with evidence: the deployed files, the installed packages, the running processes and their memory. A verifier in GitHub Actions compares that evidence with your public git commit, your lockfile, a reproduced build and the official runtime releases.

Anyone can open the report and see which files, packages and processes matched the public sources.

• The public registry. Add one YAML file to registry/ and Audit Status's SSH key to your servers. Audit Status's own GitHub Actions workflow verifies them every hour as an independent third party, publishes the signed report and serves your badge. Nothing runs in your CI. Add your project.
• Your own verifier. Run npx auditstatus init in your repository. It writes the configuration and a GitHub workflow that verifies your servers and publishes the report to a branch. Getting started.

Start with a git checkout that matches its public commit. Add the lockfile, the build, PM2 and the runtime, containers, a TPM when you have one.

• Source code: every deployed file against a public commit, a tag, the latest commit or the latest GitHub release
• Builds: build output against a reproduced build of the same commit
• Dependencies: npm, pnpm and Yarn, Python, Ruby, PHP, Java, .NET, Go, Rust and Elixir packages against their lockfiles, with npm provenance
• Runtime integrity: each process's executable, libraries and memory, preloaded code, debug ports, the Node.js binary against the official release
• Containers and Kubernetes: Docker, containerd and CRI-O containers against their images
• Hardware: TPM 2.0 quotes, Linux IMA, AMD SEV-SNP and Intel TDX

The verifier's SSH key can run the attester and nothing else: a forced command in authorized_keys ignores any other request. The public registry's private key exists only as a GitHub Actions secret, generated by a workflow on a GitHub runner, and its attestation shows which workflow made it. Each published report carries a Sigstore signature from the workflow that wrote it. Without hardware, root on a server can forge evidence. A TPM with IMA backs the files the kernel measured, and a confidential VM protects against the host operator. Threat model.

• auditstatus.com: the attester, the verifier, the GitHub Action and the public registry, in one release binary and the auditstatus npm package.
• Attestium: the remote attestation library and evidence format that Audit Status runs on.

Forward Email is the registry's first project. The projects table shows every registered project with its live status.

Issues and pull requests are welcome in auditstatus/auditstatus.com. Report security issues at https://forwardemail.net/security. Audit Status is MIT licensed.

_{Audit Status is a project by Forward Email, the 100% open-source, privacy-focused email service. Topics: production verification, remote attestation, deployment verification, open source transparency, software supply chain security, reproducible builds, GitHub Actions, status badge, TPM 2.0, Linux IMA, confidential computing, Sigstore, SLSA.}