[Assurance] Establish controlled Voting SDLC and Common Criteria evaluation #6

New Issue

2026-08-04T13:49:44+02:00

zemion commented

2026-08-04 13:49:44 +02:00

Scope

Turn the bounded native provider into an independently evaluable and operable product.

Acceptance criteria

reproducible signed builds, SBOM, provenance, dependency and vulnerability controls;
separation of source, release, election, key-custody, audit, and approval authority;
configuration management, maintenance impact analysis, incident and disclosure process;
witnessed election/key ceremonies and target-specific acceptance;
backup, restore, disaster recovery, secure deletion, and in-progress-election upgrade evidence;
laboratory pre-evaluation, remediation, formal evaluation, and exact certificate record;
certificate/maintenance monitoring and fail-closed expiry/revocation behavior;
production documentation states exactly which version/configuration and election classes are covered.

A container or CI run may produce evidence, but cannot replace independent authority or evaluation.

## Scope Turn the bounded native provider into an independently evaluable and operable product. ## Acceptance criteria - reproducible signed builds, SBOM, provenance, dependency and vulnerability controls; - separation of source, release, election, key-custody, audit, and approval authority; - configuration management, maintenance impact analysis, incident and disclosure process; - witnessed election/key ceremonies and target-specific acceptance; - backup, restore, disaster recovery, secure deletion, and in-progress-election upgrade evidence; - laboratory pre-evaluation, remediation, formal evaluation, and exact certificate record; - certificate/maintenance monitoring and fail-closed expiry/revocation behavior; - production documentation states exactly which version/configuration and election classes are covered. A container or CI run may produce evidence, but cannot replace independent authority or evaluation.

zemion added the module/voting

codex/needs-human area/docs area/security

priority

p2

labels 2026-08-04 13:49:44 +02:00

zemion referenced this issue from GovOPlaN/govoplan-committee

2026-08-04 13:49:47 +02:00

[Feature] Add the first certified Committee ballot provider #1

zemion commented

2026-08-06 14:14:23 +02:00

The normalized source ideas and user-story orientation are now preserved in govoplan/docs/PRODUCT_INPUT_REGISTER.md. This issue remains the canonical live work item for the corresponding outcome.

The normalized source ideas and user-story orientation are now preserved in `govoplan/docs/PRODUCT_INPUT_REGISTER.md`. This issue remains the canonical live work item for the corresponding outcome.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-voting#6