SDP HKDF Deployment

Rootless / SDP deployment infrastructure for HKDF (HMAC-based Key Derivation Function) cryptographic services.

This repository provides the infrastructure for deploying HKDF cryptographic services using the Secure Deployment Protocol (SDP) with rootless container execution, air-gap readiness, and provenance tracking.

Components

configs/

Deployment configurations — environment, network, key-management, rotation policy.

containerfiles/

Container build recipes (Buildah / Podman-friendly). Rootless by construction.

docs/

Architecture references, threat-model, deployment runbooks.

Quickstart

git clone git@github.com:hyperpolymath/sdp-hkdf-deployment.git
cd sdp-hkdf-deployment

just build         # build container images (rootless)
just deploy-dry    # render deployment manifests without applying
just deploy        # apply (requires configured target)

Architecture

See TOPOLOGY.md for the visual architecture map and completion dashboard. For a deeper threat-model write-up, consult docs/THREAT-MODEL.adoc if present.

Design principles

1. Rootless first — no privileged containers; userspace UID/GID mapping throughout.

2. Air-gap ready — every external dependency is pinned to a content hash; nothing fetched at deploy-time.

3. Provenance-tracked — every artefact is signed; build manifests enumerate inputs.

Status

• Licence: MPL-2.0. (Migrated from PMPL-1.0-or-later 2026-05-26 per the estate licence-debt audit, hyperpolymath/standards#196.)

• Maturity: deployment-ready for the in-house HKDF service. Not yet a published reusable for external consumers.

• Audit findings: see docs/tech-debt-2026-05-26.md if present (added by the 2026-05-26 estate tech-debt scan).

Contributing

See CONTRIBUTING.md. GPG-signed commits required.

Companion repositories

• hyperpolymath/standards — canonical estate standards.

• hyperpolymath/qubes-sdp — the broader SDP-on-Qubes ecosystem this deployment fits into.