Bill of materials
fremforge is deliberately transparent about the tooling underneath every control. Customers under BSI C5, ISO 27001, BaFin, or ENISA-regulated review need the tool-level audit trail, and we’d rather you can grep our source than reverse-engineer a black box.
This page is the authoritative inventory. The shorter table on the security features overview is a quick-reference subset; this one is the full record — versions, pull sources, where each component runs, the supply-chain attestation that ships with it, and the licence.
Supply-chain integrity
Every dependency, container image, and binary in this inventory traverses fremforge’s upstream-contact rule:
- GitHub-hosted code flows via the Forgejo native pull-mirror at
frem.sh/<canonical-org>/<repo>(8-hour sync). Customer workflows resolvinguses: actions/checkout@v4hitfrem.sh/actions/checkout— no direct github.com fetch on the customer’s critical path. - Container images (docker.io / ghcr.io / quay.io / public.ecr.aws) are cached via an internal EU mirror. Production manifests never reference an upstream registry directly.
- Release binaries that aren’t shipped as OCI (e.g.
opengrep,cosign) are wrapped in tiny cache images served from the same internal EU mirror. Renovate tracks the upstream github-release version and opens a weekly bump PR.
CI checks Dockerfiles and manifests for any reference that would bypass the mirror, so every upstream dependency resolves through the EU-resident cache rather than directly from a public registry.
CI + supply-chain tooling
| Tool | Version | Where used | License | Pull source |
|---|---|---|---|---|
| Forgejo | v15.x | Repo hosting, code review, Actions runner protocol, SSO auth-sources | GPLv3 | Internal EU mirror (fremforge build) |
| forgejo-runner (act_runner) | v12.10.2 | Per-job ephemeral runner on a single-use ECS VM | MIT | Internal EU mirror |
| Gitleaks | v8.x | Pre-receive secret scan | MIT | Internal EU mirror |
| OpenGrep | v1.21 | SAST on every PR (FOSS Semgrep successor — relicensed move) | LGPLv2.1 | Internal EU mirror |
| Trivy | v0.70 | Customer CI image scan + runner-image baked-in CVE check | Apache 2.0 | Internal EU mirror |
| osv-scanner | Latest | PR-time dependency CVE/GHSA scan | Apache 2.0 | Internal EU mirror |
| Syft | Latest | CycloneDX 1.6 (SPDX accepted at ingest, not generated) SBOM on release-tag push | Apache 2.0 | Internal EU mirror |
| cosign | Latest | Image signing + verification (customer CI via cosign-verify.yaml) | Apache 2.0 | Internal EU mirror |
| Fulcio | v1.8.5 (Helm 2.9.0) | Self-hosted code-signing CA at sign.frem.sh. Root CA in T Cloud Public DEW KMS (FIPS 140-2 Level 3 HSM). NOT the public Sigstore Fulcio — fremforge runs its own | Apache 2.0 | Internal EU mirror |
| Sigstore TSA | Latest | RFC 3161 timestamp authority at tsa.frem.sh. Key in DEW KMS. NOT the public Sigstore TSA | Apache 2.0 | Internal EU mirror |
| gitsign | Latest | Customer git client; OIDC-bound commit signing against the local Fulcio | Apache 2.0 | Customer-side install (brew install sigstore/tap/gitsign) |
| Renovate | Latest | Hosted dep-bump bot, 15-min cron, per-repo opt-out | AGPLv3 | Internal EU mirror |
| kaniko | Latest | Rootless container build in customer workflows (alternative to BuildKit when customer can’t run privileged) | Apache 2.0 | Internal EU mirror |
| ClamAV | Latest | Pre-receive malware scan + LFS upload scan | GPLv2 | Internal EU mirror |
| SaneSecurity feeds | Daily | ClamAV signature feeds (Foxhole, RogueDB, etc.) — broadens detection beyond the upstream CVD set | (Vendor — EU) | DNS pull via restricted egress allowlist |
| scorecard | Latest | Weekly OpenSSF best-practice run per repo | Apache 2.0 | Internal EU mirror |
openssl + python3 (stdlib) | n/a | Customer-side verification of fremforge-issued SLSA L2 provenance — the DSSE envelopes are signed with a bare Ed25519 key, so verification is a small curl/jq/openssl/python3 recipe (see SLSA provenance), not upstream slsa-verifier | — | Distribution-default tooling |
Platform foundation
| Layer | Tool / vendor | Where used | License / posture |
|---|---|---|---|
| Container registry | T Cloud Public SWR | All fremforge images. Single source for runtime pulls; mirror for every upstream registry | Vendor (Deutsche Telekom, eu-de) |
| Kubernetes | T Cloud Public CCE Turbo (Cloud Native Network 2.0) | Platform workloads (Forgejo, control-plane monolith, jobs). Per-pod ENI + Security Group via Yangtse CNI. CI runners do not run here — see the ECS row below | Vendor (Deutsche Telekom, eu-de) |
| Hosted CI runner compute | T Cloud Public ECS (single-use VM per job) | One ephemeral ECS VM per commit/PR; dedicated kernel (hypervisor-isolated), reaped after the job; per-VM VPC Security Group (no ingress, VM-to-VM denied, egress via SSRF-guarded runner proxy) | Vendor (Deutsche Telekom, eu-de) |
| Object storage (operator) | T Cloud Public OBS | Audit-chain WORM anchor, SBOM archive, data-export, OpenTofu state | Vendor (Deutsche Telekom, eu-de) |
| Relational DB | T Cloud Public RDS (PostgreSQL 15) | api state, tenant + finding tables, audit chain | Vendor (Deutsche Telekom, eu-de) |
| In-memory cache | T Cloud Public DCS Redis | Rate-limit counters, token-exchange seen-IP, session cache | Vendor (Deutsche Telekom, eu-de) |
| Key management | T Cloud Public DEW | MASTER_ENCRYPTION_KEY, Fulcio root CA, TSA signing key | Vendor (FIPS 140-2 Level 3 HSM, Germany) |
| Function-as-a-service | T Cloud Public FunctionGraph | Scheduled cron + reaper workloads | Vendor (Deutsche Telekom, eu-de) |
| Log + metric tier | T Cloud Public LTS + CES | Application logs, keyword alarms, SLO metrics | Vendor (Deutsche Telekom, eu-de) |
| Edge / CDN | Bunny CDN | TLS termination, EU-edge caching, edge rules, rate-limit floor | Vendor (Slovenia HQ, EU-resident, no US sub-processor) |
| Transactional email | Lettermint | Auth emails, billing notices, alerts | Vendor (NL, GDPR-resident) |
| Operational mailbox | mailbox.org | Inbound *@frem.sh admin mail | Vendor (Germany) |
| Payment processing | Mollie | Card + SEPA Direct Debit | Vendor (NL, GDPR-resident) |
| Bookkeeping | Dinero | Invoice issuance + accounting | Vendor (DK, GDPR-resident) |
| External uptime probe | updown.io | Off-net availability probes (api, Forgejo, Kuma, marketing, Authentik) | Vendor (FR) |
Every vendor on this list is contractually EU-resident with no US sub-processor in the data path. Full DPA + sub-processor chain on the trust page. The canonical machine-readable supplier inventory lives in fremverk/governance/suppliers.yaml — that file is the source-of-truth Annex B for the customer-facing DPA.
What we deliberately don’t use
| Anti-vendor / anti-tool | Why |
|---|---|
| github.com (direct) | EU sovereignty + Schrems II + the upstream-contact rule. Mirrored exclusively. |
| GitHub Advanced Security (CodeQL etc.) | Proprietary detection rules you can’t audit. We use OpenGrep + Trivy + osv-scanner — all OSS, all auditable. |
| Microsoft 365, Entra, Defender | Same. fremforge product has zero Microsoft footprint. (fremverk corporate IT is a separate identity world.) |
| Public Sigstore Fulcio/Rekor (sigstore.dev) | US-hosted; verification path would round-trip outside the EU. We run our own Fulcio + TSA in eu-de with the root CA in DEW KMS. No Rekor / transparency log by design — TSA-anchored timestamping is the integrity primitive instead. |
| AWS, GCP, Azure | US-cloud-controlled. T Cloud Public is operated by Deutsche Telekom on a Huawei-derived stack; the OpenTofu provider is the maintained-for-OTC fork (opentelekomcloud/opentelekomcloud, never huaweicloud/huaweicloud). |
| Cloudflare, Fastly, Akamai | Edge with US-cloud control. Bunny CDN is EU-HQ and contractually EU-resident. |
| Google Fonts, jsDelivr, unpkg CDN-loaded assets | Third-party CDN exposes traffic patterns to US-resident edges. All fonts/JS/CSS self-hosted at www.frem.sh/fonts/ via Bunny EU. |
| Long-lived service-account credentials in customer workflows | OIDC token federation (workflow OIDC) + agent-native auth replace them. Long-lived keys are an opt-in deprecated path with a deprecation banner. |
How to consume this BoM in your own audit pack
For an RFP response or vendor-questionnaire: link this page directly. The URL is stable: https://docs.frem.sh/security/bill-of-materials/.
For BSI C5 or ISO 27001 evidence: ask security@frem.sh for the dated PDF snapshot. We can also produce a CycloneDX-format SBOM of the platform itself (not just per-release) on request — useful for transitive-CVE matching.
For continuous verification: every release of every fremforge component publishes a Syft-generated CycloneDX SBOM, and the customer-side SLSA-L2 provenance pins the digest of every attested asset. The provenance is an Ed25519-signed DSSE / in-toto envelope (<asset>.intoto.jsonl); verify it against fremforge’s published trust root with the curl/jq/openssl/python3 recipe in SLSA provenance.
Drift: this BoM is hand-maintained today. Ping security@frem.sh if you need a current snapshot before an audit.
Related
- Trust page — DPA, sub-processor list, compliance attestations.
- Security features at a glance — what each tool actually does, with deep links.
- SBOMs — how customer-side CycloneDX/SPDX SBOMs are generated.
- SLSA provenance — how the SLSA L2 attestation is signed server-side with the platform Ed25519 key, and how to verify it.
- Vulnerability disclosure —
security@frem.sh, 24h ack SLA.