Holger documentation, v2
This is the documentation of Holger, the secure artifact gateway, as it is built on main today. Each chapter may end with one "Coming:" line that names later work. The earlier pages are kept unchanged in docs/v1/; a chapter's "Still in v1" list points at what they still hold.
| chapter | state | |
| 1 | What Holger is: the two setups (fetch, one-way), the formats, the products | written |
| 2 | Install: the cargo install lines, the features, zero egress |
written |
| 3 | Three products by hand: the guide, the first admin, every build tool's setup (pip, npm, cargo, Maven, apt, dnf, OCI, Go, Helm) | written |
| 4 | The RON: every block, an example that boots and its picture, sources, gates, the floor, steps, pull-through, intel, network, the flow picture | written |
| 5 | The intake chain: states, duties, approvals, the scanners, the refusals, the audit trail, the doors, scans per ecosystem, no intel no pass, where the vulnerability data comes from, the scan worker, the pull-through | written |
| 6 | Pairing: how front, main, twin and downstreams find and trust each other | written |
| 7 | Build Thing: the MVP suite, the kernel the media boot, release builds, signing, verification | written |
| 8 | Supply chain: what is verified on the way in, untrusted work as Heimdall jobs, what Holger signs, the export, the downstream, Rust CVE reachability (planned for 3.2) | written |
| 9 | The estate: the boxes, the declaration, who approves, public repositories, laying, updates (front last), backup, a dead main, growth, the clock | written |
| 10 | Security: post-quantum TLS, WireGuard, safe defaults, zero-egress guards, signed apt/dnf, the admin listener, CRLs, the audit log, hostile bundles | written |
| 11 | Reference: the CLI verbs, the console menu, gRPC, the HTTP doors, metrics, every error code | written |
| 12 | Watched applications: declare an application, its signed graph, the lamp (red, yellow, none, unknown), who is told, online and airgapped | written |
Beside the chapters: threat-model.md, the system threat model (assets, trust boundaries, adversaries, and per NCSC gap the mitigation, code path and test), and idiot-guide.md, the idiot guide v2 (the desired setup in its two modes and the application watcher, click by click; rendered as docs/idiot_guide-v2.pdf).
Holger 3.2 and R1 are in: chapter 1 (the desired setup, streaming and CDS), chapter 5 (the purl identity, Unknown holds, the known-bad matrix, the supply checks, install-time behaviour, waivers), chapter 8 (CVE data on the medium, Heimdall 0.3.2, the call graph), chapter 10 (the one gate), chapter 12 and the threat model.
The pictures are generated: img/draw.py draws every img/*.svg but the flow example (which the server draws) in skade's board style; python3 docs/v2/img/draw.py docs/v2/img regenerates them.
Every chapter is written for the code on main. Each claim names the file or the test that proves it; speed and size numbers come only from holperf runs, with date and machine.
The v1 pages
| page | what it is |
| v1/README-v1.md | the README until 2026-10-30: build rows, benchmarks, tier 1, the RON shape |
| v1/HOLGER-V2.md | the Holger v2.0 plan, phases H1 to H6, the three flavours |
| v1/FEATURES.md | the feature list with status, date and commit |
| v1/SLSA.md | release provenance (its content is in chapter 7) |
| v1/SUPPLY-CHAIN.md | the supply chain note of 2026-10-30 (its content, corrected, is in chapter 8) |
| v1/demo-airgap.md | the 1.0 airgap demo |
| v1/secure-update-gateway-mvp.md | the secure update gateway design |
| v1/secure-update-gateway-operator-guide.md | the operator guide |
| v1/secure-update-gateway-threat-model.md | the threat model |
| v1/secure-update-gateway-limitations.md | the limitations |
| v1/security-review-2026-09-11.md | the security review of 2026-09-11 |
| v1/estate-approvers.md | who approves on an estate box |
| v1/estate-health-words.md | the health words that need no action |
The generated pages stay where they are: docs/ai-context.md and docs/ai-context-full.md (the AI-context packs, regenerated by the pre-commit hook) and the PDFs docs/manual.pdf, docs/idiot_guide.pdf and docs/unsorted.pdf.