Curriculum: Building at Drone-War Cadence
Subject: Curriculum: Building at Drone-War Cadence
4 chapters
1. Phase 1 (Months 1–2): Supply-chain hygiene
[Verse 1]
Every build starts naked, no history, no name,
Syft walks the binary, writing down its claim—
a list of every package, every library it holds,
that's the SBOM, the manifest, the story fully told.
Grype comes scanning, hunting vulnerable seams,
Trivy double-checks it, chasing shadow CVEs,
CycloneDX or SPDX — two dialects, one truth,
pick the format your tools speak, that's the honest proof.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 2]
Climb the SLSA ladder, level by level rise,
one is just a record, four's a fortress in disguise.
Cosign seals the binary, no password, just a key,
Sigstore logs it public, so the whole world sees.
Build it twice, same bytes both times, that's reproducible,
no hidden compiler mood swings, nothing's miscible.
Provenance — the paper trail of where a thing was born,
without it every artifact's an orphan, lost, forlorn.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 3]
Vault or SOPS locks your tokens, cipher in a drawer,
never paste a password where the logs can keep the score.
Least-privilege runners, only touch what they must do,
one narrow door per pipeline, nothing leaking through.
Ephemeral machines — they're born and burn away,
spin up for the job, then vanish, none left to betray.
No lingering root shell, no forgotten cache,
every build's a fresh page, never one repeated crash.
[Bridge]
Take Betaflight's firmware, or a Zephyr sample spark,
wire a pipeline onto it before the range goes dark.
Every single commit: Syft scans, cosign seals,
push a signed binary, an SBOM that reveals
what's inside the flight controller, nothing left to hide,
drone-war cadence tells us: verify, don't just abide.
[Chorus]
Sign it, scan it, list every part,
SBOM's the map of your binary's heart.
Довіряй, але перевіряй — trust, then verify,
Vertrauen ist gut, Kontrolle ist besser — that's why we sign.
[Verse 4]
Dependabot whispers when a patch comes due,
Renovate keeps the lockfile honest, nothing slips askew.
Policy gates at the border, admission-control eyes,
a signature missing means the deploy never flies.
Diff the SBOMs release to release, watch what changed,
a new transitive stranger means the graph gets rearranged.
Attestations stack like ledger pages, one on one,
every hop from source to runtime traceable, none undone.
Audit the audit, question the trust you've built,
supply chains rust in silence when the checking's ever spilt.
Rotate the keys before they age, revoke what shouldn't stay,
hygiene isn't one-and-done — it's practiced every day.
[Outro]
SBOM, SLSA, cosign, ephemeral and clean—
that's supply-chain hygiene.
Довіряй, але перевіряй,
build it so.
2. Phase 2 (Months 3–4): Hardware CI and air-gapped delivery
[Verse 1]
Rack of boards stand at attention, LEDs blinking code,
Homemade Pi with jumper wires carries the flashing load,
Labgrid plays the sergeant, calling shots with no hands near,
Every board gets tested cold, then tested live and clear.
Male: "Boot it up," Female: "and count the hum,"
Together: "silence means we've got a problem — here it comes."
[Chorus]
Flash it, fly it, sign it, ship it — that's the mantra now,
Летимо швидше, друже — (we fly faster, friend) don't ask how,
Vamos rápido, no ritmo de uma guerra,
Test it on the bench before you trust it to the air.
Hardware doesn't lie, hardware doesn't lie,
Prove it on the ground before you let it own the sky.
[Verse 2]
Every pull request has got to prove itself tonight,
SITL spins the physics up — a fully simulated flight,
If the drone can't land inside the box, it's still not right,
No merge without a touchdown, no green stamp, no free flight.
Female: "Land it clean,"
Male: "or the pipeline stays a red machine."
[Chorus]
Flash it, fly it, sign it, ship it — that's the mantra now,
Разом, разом — (together, together) that's our vow,
Vamos rápido, no ritmo de uma guerra,
Test it on the bench before you trust it to the air.
Hardware doesn't lie, hardware doesn't lie,
Prove it on the ground before you let it own the sky.
[Verse 3]
Air-gapped means the internet don't get to have a say,
Mirrored repos on a shelf, sealed off and locked away,
Push it through a data diode — one direction, one-way slide,
Hash it, manifest it, log it — every artifact verified.
No signal sneaking backward, no whisper, no reply,
Trust the fingerprint, not the wire — that's the only alibi.
[Bridge]
Secure boot checks the signature before it lets you start,
Signed OTA updates — cryptographically smart,
Rollback protection bolts the door on the broken, older part,
No downgrade, no backdoor, no crack to breach the heart.
[Verse 4]
Commit, to flight, to flasher rack, to bundle wrapped and true,
A USB drive, a manifest — the final step is you.
Time the whole flow with a stopwatch, write the number down,
Then cut it clean in half again — that's how we hold the ground.
[Chorus]
Flash it, fly it, sign it, ship it — that's the mantra now,
Летимо швидше, друже — don't ask how,
Vamos rápido, no ritmo de uma guerra,
Test it on the bench before you trust it to the air.
Hardware doesn't lie, hardware doesn't lie,
Prove it on the ground before you let it own the sky.
[Outro]
Flash it, fly it, sign it, ship it — half the clock again,
Летимо, vamos — ground to sky and home again,
Air-gapped, signed, and rollback-safe — the cadence never ends.
3. Phase 3 (Months 5–6): The rules of the business
[Verse 1]
Ottawa keeps a ledger, the Export Control List,
every drone part numbered, every circuit that exists.
Cross the border with the wrong line item in your case,
and the Controlled Goods Program will ask you for your face.
South of us, ITAR and EAR draw their own kind of moat—
Canadian firms still tremble when American parts float
through their supply chain, tangled in a foreign flag's design.
And deemed export means the secret's out the second that you type it in
your Slack channel, if a listener abroad can read the line.
[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
Deemed export: the whisper in the wire still counts as trade.
Learn the rules of the business, or watch the deal degrade.
[Verse 2]
CMMC, two-point-oh, the Pentagon's own creed,
levels stacked like armor for the data that you feed.
Canada answers back with CPCSC, twin and true,
built to guard the secrets that the northern skies fly through.
Underneath them both, a bedrock, plain and gray as slate—
NIST Special Publication, eight hundred, one seventy-one, the weight
of fourteen families, access, audit, and control,
a punctilious checklist for the paranoid and whole.
[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
CPCSC, CMMC, eight-seventy-one on the wall—
learn the rules of the business, or you don't get the call.
[Verse 3]
Open up CanadaBuys, find the RFP entire,
read the DND's demands like scripture, not like fire—
statement of work, evaluation grid, the closing date,
and ITB, the Industrial Benefits debate:
if you win the contract, you owe the country back—
jobs and training, spending here, a paper trail, a track.
Read it end to end, don't skim the middle for the gold;
procurement is a language, and you're only getting told.
[Bridge]
So write it down — the lifecycle, the twenty-person shop,
map every gate and firewall to the control it's built to stop.
Access management, incident response, the audit trail unbroken,
your pipeline as the imprimatur, the proof that you have spoken
the sedulous language buyers trust before they'll shake your hand.
This document isn't paperwork — it's how you get to stand
in the room where contracts open, where the clearance gets its seal.
[Verse 4]
Twenty people, one repository, a firm that doesn't yet exist—
but the document is real, and the reviewer's on the list.
Every commit gets a badge, every merge request a name,
eight hundred seventy-one controls now wearing your build's frame.
This is the capstone, this is the letter that you send—
not a resume of feelings, but a system built to defend.
[Chorus]
E, C, L — lock the crate before it flies.
I, T, A, R — mind the foreign eyes.
CPCSC, CMMC, eight-seventy-one on the wall—
learn the rules of the business, or you don't get the call.
[Outro]
Deemed export, ITB, the ledger and the code—
the rules of the business ride with you, drone by drone.
4. Habits
[Verse 1 – Male]
Monday morning, coffee cooling slow,
I open up the ledger before I let it go.
Every build stage numbered, every gate laid bare,
If a stranger reads it, they should see what's there.
No locked drawer, no whispered code,
The pipeline's public — that's the honest road.
[Verse 2 – Female]
And next to it, the paper that explains the why,
The SDL document, signed and hung up high.
Threat models drawn in plain, unhurried ink,
So the next new hire knows just what to think.
We don't bury caution in a private file,
We post the blueprint, walk the open aisle.
[Chorus – Both]
Publish the pipeline, pin the plan,
Sign the SDL so anyone can scan.
Once a month we read the wreck,
SolarWinds, and xz, and 3CX —
Then we turn and check our own reflection,
Habit is the shield, not the correction.
[Verse 3 – Male]
March comes around, I pull the old report,
The one where a maintainer's trust got sold and caught.
A single tired stranger merged some quiet lines,
And a backdoor rode home hidden between the signs.
I hold that story up beside our gate,
And ask, "Could this slip through? Would we catch it late?"
[Verse 4 – Female]
Then SolarWinds — the build server, poisoned still,
A signed update carrying a hidden will.
I check our signing keys, I check who holds the code,
I trace the update path from the source to the road.
And 3CX, the app that phoned back home to spies —
I check our own dependencies with wide-open eyes.
[Chorus – Both]
Publish the pipeline, pin the plan,
Sign the SDL so anyone can scan.
Once a month we read the wreck,
SolarWinds, and xz, and 3CX —
Then we turn and check our own reflection,
Habit is the shield, not the correction.
[Bridge – Male then Female, layering]
It's not paranoia, it's just paying rent
On every open door a compromise has bent.
Read the post-mortem like a letter from a friend,
Warning what to watch for before the story's end.
The pipeline's not a secret — secrets rot and hide,
The document's a lantern we keep lit outside.
[Verse 5 – Both, trading lines]
So publish what you build, don't tuck it in a vault,
Sign the SDL, admit the possible fault.
Mark your calendar, first Monday, steady pace,
Pull a post-mortem, hold it to your own face.
SolarWinds taught signing, xz taught the slow build trust,
3CX taught watching third-party code like you must.
[Chorus – Both, softer]
Publish the pipeline, pin the plan,
Sign the SDL so anyone can scan.
Once a month we read the wreck,
SolarWinds, and xz, and 3CX —
Then we turn and check our own reflection,
Habit is the shield, not the correction.
[Outro – Both, quiet]
Paper it, share it, read what went wrong,
Check your own pipeline, hum this little song.
Publish it. Sign it. Read it. Check it. Again.
Back to Home