nordisk/holger

Holger roadmap

Status 2026-10-31. This is the plan, not the manual: docs/v2/ describes only what is built.

Next release: Holger 3.0.0

• Already on main:

  • the four products (holger, holger-downstream, holger-ui, holger-cli);
  • 12 default formats, with apt/dnf/Helm/Maven/Go as views of production;
  • the RON flow picture with counters;
  • the Arrow audit backend (queries, aggregates, export);
  • OCI referrers (cosign, notation, oras, Kyverno through Holger);
  • the one-way CDS downstream;
  • the WireGuard pre-shared key for downstreams, and post-quantum TLS;
  • speed parts 1 and 2a;
  • Heimdall's nordisk-heimdall-core 0.1.0 as the job API;
  • the crafted-bundle guards (znippy-common 0.10.4).

• Waiting for:

  • the NCSC P1 safe defaults;
  • a green KVM gate on main (the scan-worker image must move to report schema v2);
  • the crates.io publish.

• Major version, because P1 changes the defaults (authentication, TLS and RBAC required off loopback, 2 approvals) and the old ORIGINAL rows are retired.

The smart flow (proposed)

• Overview, level 1: the estate from our server's view.

  • The boxes: console, front, main, twin, downstreams (fetching or one-way), the diode drop area (when export.push_to is set), and the upstream sources.
  • The lines are detected connections with live state: pairing, sync lag, bytes, last contact.

• Flow, level 2: click a machine and it unfolds in place, showing its part of the RON:

  • main: repositories, intake chain, gates, storage;
  • front: doors;
  • a downstream: its own RON summary;
  • twin: the mirror, and its lag. The RON's inputs and outputs end as ports on the machine border.

• Level 3: "show the full RON" unfolds everything.

• The server builds the model and the drawing; the console only shows it.

Security (NCSC cross-domain gap list)

• P1, in progress:

  • safe defaults;
  • the first import as a secure-side admin action (done);
  • the console token cannot invite approvers;
  • the sandbox re-hashed at each start, and its image pinned by digest;
  • every socket through the egress check;
  • every refusal audited;
  • clamd from the sandbox only.

• P2:

  • a separate admin listener with an IP allow-list;
  • an export profile with only the deciding fields;
  • unpacking or blocking every container format;
  • every parser in the sandbox (Heimdall).

• P3:

  • signed ClamAV/scanner bundles and a patch fast path;
  • a time floor and an offline time token;
  • CRL for mTLS;
  • key-file checks and PKCS#11;
  • attested releases;
  • a full threat model.

Supply chain

• An SBOM for container images.
• Scanning images pushed to the plain oci registry.
• A public door for the evidence key.
• Keyless Sigstore with a signed, pinned trust root (works airgapped).

• Open questions:

  • Should the downstream re-check the original SLSA proofs? It has the verifier but no provenance scanner.
  • Should USB from a non-Holger source accept raw SLSA/DSSE, or Holger-signed bundles only?

Heimdall (the sandbox)

• Today Holger runs untrusted work through the JobRunner interface, on the interim container runner.

• Next: Heimdall's own runner, with these layers:

  • youki;
  • a generated syscall allowlist;
  • Landlock;
  • a syscall broker;
  • wasm verifiers.

• Then verify-bundle runs as a sandbox job, so the server never parses a bundle.

• nordisk-heimdall 0.2.0 adds multi-core verification.

Speed

• Done: an in-memory catalog (about 1000x on chain indexes), streamed downloads, TCP_NODELAY, HEAD, the race fix, index rows extracted at intake (apt, dnf and Helm).

• Next:

  • the remaining formats from index rows;
  • every index rendered once per change and served zero-copy.

Appliance

• The one-way downstream boots without pairing: network from the medium, packages only through the inbox.