Blog Post
Building Trust into Distributed Cloud Storage
RESCALE in the SkyFlok Pilot
Privacy-focused cloud storage depends on more than encryption. It also depends on the software libraries, gateways, microservices, APIs, web applications, and external infrastructure used to process and move the data. A service may protect customer files while still relying on a complex software supply chain. A vulnerability in one supporting component could affect the security or reliability of the complete platform.
The second RESCALE pilot applies the project’s assessment and trust mechanisms to SkyFlok, a distributed cloud and edge storage platform developed by Chocolate Cloud.
Protecting Data Across Several Storage Locations
SkyFlok encrypts files and applies erasure coding before distributing the resulting fragments across selected storage providers and locations. A file can later be reconstructed when enough fragments are retrieved and combined. Depending on the service configuration, the encryption and coding operations may take place in the user’s browser or through gateways deployed at the edge, within customer-controlled infrastructure, or in public-cloud environments. The backend coordinates the process, while individual storage providers handle encrypted and erasure-coded fragments rather than the original file. This reduces dependence on a single provider and supports a privacy-by-design approach. At the same time, the architecture includes many software components. SkyFlok uses Python-based backend services, JavaScript and TypeScript web applications, C++ libraries, APIs, gateways, and external storage interfaces. These components have different dependencies and development processes, making the pilot a useful test for RESCALE’s cross-technology approach.
Integrating Static Analysis into Bitbucket Pipelines
The initial deployment connected the RESCALE Static Code Analysis Module to Chocolate Cloud’s Bitbucket pipelines.
During a pipeline run, the required container is retrieved from the RESCALE Harbor registry and executed against the selected source code. The resulting findings are processed by the SSCG Generator and can either be submitted to the RESCALE platform or retained as a pipeline artefact. The pilot tested the workflow against the RLNC library and a SkyFlok microservice. The analysis generated several warnings that were reviewed by the development team. Some findings appeared in test code, while another warning related to a query built from constant values. In the tested context, these results were classified as false positives. This is still an important part of the assessment process. Security tools are designed to identify patterns that may indicate a vulnerability, but developers must examine those findings within the actual code and deployment context. A useful workflow must therefore provide enough detail to support that review.
Combining Static and Runtime Evidence
The wider pilot scenario extends the static-analysis workflow toward dynamic testing of selected SkyFlok microservices.
A target service can be launched in a controlled environment and tested through API-focused tools using its OpenAPI description. The runtime results can then be used to generate the DSCG and connected to the existing static assessment. TrustOR can combine the validated SBOM, SSCG, DSCG, and vulnerability information into the TBOM. This provides a more complete view of the component by linking what can be found before execution with what happens while the service is running. The distinction is particularly important for cloud microservices. Some weaknesses become visible only when an API receives unexpected inputs, processes unusual sequences of requests, or interacts with other services.
After the TBOM is created, Continuous Security Assurance can monitor the recorded dependencies for newly disclosed vulnerabilities. If a relevant issue appears, the associated vulnerability information can be updated and the responsible organisation notified.
Extending Privacy by Design to the Software Supply Chain
The SkyFlok pilot demonstrates that privacy cannot be separated from component security. Protecting the data is essential, but users also need confidence in the software responsible for encryption, coding, transfer, authentication, and coordination. By integrating RESCALE into Bitbucket pipelines and connecting the resulting evidence to the wider assurance workflow, the pilot shows how supply-chain security can become part of an existing cloud-development process.
SkyFlok’s architecture reduces dependence on a single storage provider. RESCALE complements that approach by helping organisations assess and maintain trust in the software components that make the distributed storage service possible.