Bifrost · the bridge · continuous delivery

Bifrost carries.

Signed releases travel from build to enclosure with the SBOM attached. Builds are reproducible, rollouts are staged, and delivery works across an air gap. Nothing deploys that cannot prove where it came from.

Read the source → Talk to us

§ 1 · What it does

Delivery with a chain of custody

Reproducible builds

Same source, same toolchain, same bytes. Any release can be rebuilt and compared by anyone with the repository: make reproduce.

Signed SBOM per release

Every release ships its full bill of materials, signed. What is running, which versions, which licences, answerable in one read, not one meeting.

Staged rollouts

Releases advance through rings you define. A failed health gate halts the rollout at the ring boundary and names the failing check.

§ 2 · Across the gap

The bridge reaches disconnected ground

Enclosures that never touch a network still need updates. Bifrost exports a release as a sealed offline bundle, signatures, SBOM and rollout plan included, that a courier can carry in and the enclosure can verify without trusting the courier.

The verification is the same on both sides of the gap: prove the origin, or do not deploy.

$ bifrost export midgard-1.4.2 --bundle offline
bundle: midgard-1.4.2.vbundle · 312 MB
contents: images · sbom.spdx.json · rollout.plan
signatures: release + sbom · verified

$ bifrost verify midgard-1.4.2.vbundle
origin proven · reproducible from tag v1.4.2

§ 3 · Specification

On the record

Property	Specification
Builds	reproducible · verify with make reproduce
Provenance	Signed SBOM (SPDX) attached to every release.
Rollouts	Ring-staged with health gates; halts state the fact and the failing check.
Air gap	Sealed offline bundles, verified inside the enclosure before deploy.
Competes with	Palantir Apollo.