Regulated page: security block, owner's Maven line, links to the verify and FIPS pages

regulated/index.html

@@ -93,7 +93,7 @@ <h1>For teams entering regulated markets</h1>
   <h2>What our piece does — and does not do</h2>
   <p>
     FosterStack Cache is one component in your pipeline: a self-hosted remote
-    build cache. For that component, we do the evidence work a compliance
+    build cache. Maven too, through the Apache Maven Build Cache Extension. For that component, we do the evidence work a compliance
     program needs: the <code>-fips</code> build links Go's FIPS 140-3
     validated cryptographic module (CMVP certificate #5247), and every
     release ships with an SBOM, SLSA provenance, keyless signatures, and
@@ -108,16 +108,39 @@ <h2>What our piece does — and does not do</h2>
     signed, and checkable instead of a shrug.
   </p>
 
-  <h2>The Compliance tier</h2>
+  <h2>Security is the difference</h2>
+  <p>Security is what sets this product apart. The release items below ship in the current release. The supply-chain items describe how we work today, in our own build and CI. You can check each one yourself.</p>
+  <h3>Signed and verifiable</h3>
+  <ul class="trust">
+    <li><strong>Signed releases.</strong> Images and the checksums file are signed with Sigstore, with no signing key stored anywhere. <a href="https://github.com/fosterstack/cache/blob/main/docs/verify-images.md">How to verify</a>.</li>
+    <li><strong>Build provenance.</strong> Every image and binary archive carries a signed statement naming the CI run that built it.</li>
+    <li><strong>A bill of materials.</strong> Every binary archive ships with an SBOM.</li>
+    <li><strong>Published vulnerability statements.</strong> A VEX file with each release says which known vulnerabilities do and do not affect it.</li>
+    <li><strong>Reproducible.</strong> Each image is assembled a second time on a separate machine, and the digests must match or the release fails.</li>
+  </ul>
+  <h3>Supply chain</h3>
+  <ul class="trust">
+    <li><strong>Pinned build steps.</strong> Every GitHub Action our releases use is pinned to an exact commit, and a check in CI enforces it on every change. The container base image is pinned by digest.</li>
+    <li><strong>Hash-checked installs.</strong> Python tooling in our CI is installed with hash checking, so a swapped package is refused.</li>
+    <li><strong>A 7-day wait.</strong> Our CI holds new dependency versions for 7 days before adopting them, and Dependabot has the same cooling-off period.</li>
+    <li><strong>A daily supply-chain check.</strong> Once a day, everything our build and CI pull in (actions, tools, packages) is checked against public advisory databases and malicious-package reports. Any hit opens an issue.</li>
+    <li><strong>Scanned before release.</strong> Two independent scanners with different databases check every release candidate, and any finding blocks the release unless a published VEX statement explains it. <a href="https://github.com/fosterstack/cache/blob/main/RELEASING.md">RELEASING.md</a>.</li>
+    <li><strong>Rescanned every day.</strong> Every published image is scanned again daily, so a new vulnerability in something we shipped raises an issue.</li>
+  </ul>
+  <h3>Small, quiet and patched</h3>
+  <ul class="trust">
+    <li><strong>Tiny and quiet.</strong> A distroless image with one static program and no shell. It sends no telemetry and makes no outbound connections.</li>
+    <li><strong>A FIPS build.</strong> A FIPS variant uses Go's validated FIPS 140-3 cryptographic module.</li>
+    <li><strong>Patched for everyone.</strong> We aim to ship dependency fixes within 48 hours of disclosure. That is a target, not a promise. Security patches are never withheld from the free tier.</li>
+    <li><strong>Report a problem privately.</strong> Use <a href="https://github.com/fosterstack/cache/security/advisories/new">GitHub's private vulnerability report</a>.</li>
+  </ul>
+
+  <h2>What is free, and what is not available yet</h2>
   <p>
-    The evidence underneath is public and free — SBOMs, SLSA provenance,
-    signatures, VEX statements, the FIPS 140-3 validated module and its
-    certificate number — verifiable by anyone, no account, no purchase. What
-    the <a href="/#pricing">Compliance tier</a> sells is the authored work on
-    top: a FIPS applicability statement mapping the validated module boundary
-    onto this product, per-release attestation letters addressed to you and
-    signed by FosterStack LLC, security-questionnaire support up to 8 hours
-    per year (async), and named-version LTS.
+    The evidence underneath is public and free: SBOMs, build provenance,
+    signatures, VEX statements, and the FIPS 140-3 validated module and its
+    certificate number. Anyone can verify it, with no account and no purchase.
+    Paid support tiers are not available yet.
   </p>
 
   <h2>Verify everything for free first</h2>
@@ -130,9 +153,15 @@ <h2>Verify everything for free first</h2>
     — including what it says is not yet proven — and check the
     <a href="https://github.com/fosterstack/cache/blob/main/docs/quality/traceability.md">requirements
     matrix</a> that maps every product promise to its evidence. If the free
-    evidence doesn't hold up under your audit, the paid tier wouldn't either.
+    evidence doesn't hold up under your audit, nothing we add on top would either.
     That's the test we invite.
   </p>
+  <p>
+    Step-by-step, with the output of each command from a real release:
+    <a href="/verify-a-release/">Verify a release yourself</a>. To run the
+    <code>-fips</code> image and confirm FIPS mode from its own startup log:
+    <a href="/fips-140-3-build-cache/">FIPS 140-3 build cache</a>.
+  </p>
 </main>
 <footer>
   <div>