At Fleet, openness is one of our core values. We believe a rising tide lifts all boats and that almost everything we do regarding security should be public.
About a year ago, while Orbit was still brand new, not “production-ready,” and in use by almost nobody, we had an external vendor (Trail of Bits) perform a security audit on the Orbit auto-updater functionality.
We then handled the issues surfaced by the audit publicly in the Fleet repository and the old Orbit repository.
You can read more about the 2021 Orbit auto-updater security audit here.
Fleet will regularly perform security tests. These tests will target Fleet, Orbit, our company, and many other components.
If external testers find significant vulnerabilities, we will generate GitHub security advisories on a case-by-case basis. We can share important information about vulnerabilities before releasing the full report.
We believe the security of auto-updates is critical in a world where supply chain attacks are common. When automatic updaters are trusted, systems receive essential security updates quicker. It is up to the software industry to make these updates trustworthy so everyone can benefit from more secure systems around the globe.
We will continue improving our software and processes for packaging and delivering Orbit updates by expanding security mechanisms to cover more and more threat scenarios. You can always peek at our security project, where public issues are visible to everyone.
Future improvements will appear there, and we are always thankful when researchers discover and disclose vulnerabilities.
If you have questions about the Orbit audit or Fleet security, please join us on Slack!