> For the complete documentation index, see [llms.txt](https://docs.pkgforge.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pkgforge.dev/soar/readme/security.md).

# Security

## Build Security

* **Unprivileged**: No sudo/doas required
* **Isolated builds**: CI runs in rootless containers
* **Transparent logs**: View build logs with `soar log $pkg`

## Verification

* **Checksums**: b3sum + sha256sum
* **Attestations**: [GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations)
* **Signing**: minisign signatures

Soar's build process meets [SLSA Build L2](https://slsa.dev/spec/v1.0/levels#build-l2).