Security

Security Model

Build Security

• Unprivileged: No sudo/doas required

• Isolated builds: CI runs in rootless containers

• Transparent logs: View build logs with soar log $pkg

Verification

• Checksums: b3sum + sha256sum

• Attestations: GitHub Artifact Attestations

• Signing: minisign signatures

Soar's build process meets SLSA Build L2.