Skip to main content

Signing, Attestation, and Verification

What This Concept Is​

This lesson teaches you to bind artifact identity, source, builder, policy, and test evidence through verifiable attestations. Supply-chain security is evidence about how software was selected, built, signed, promoted, deployed, and operated. Inventory without reachability, signatures without verification, and policy without enforcement are incomplete controls.

Why It Matters Here​

Attackers can substitute dependencies, alter CI inputs, steal workflow credentials, poison artifacts, exploit platform defaults, or ship a vulnerable component that nobody can scope. Provenance and policy reduce uncertainty and make response faster.

Concrete Example​

Apply the mechanism to a service built from public dependencies in a hosted CI system. Produce an SBOM, identify the build inputs and builder identity, sign the artifact, verify provenance at admission, and inject one dependency or workflow compromise in a disposable environment.

Common Confusion / Misconception​

A frequent mistake is treating a CVE count, lockfile, SBOM, or green pipeline as proof of safety. Ask whether the component is present and reachable, whether the artifact corresponds to reviewed source, whether the builder was trusted, and whether policy actually blocks the unsafe promotion.

How To Use It​

  1. Inventory source, dependencies, builders, artifacts, identities, and deploy targets.
  2. Define threat assumptions and assurance level.
  3. Make build inputs deterministic and reviewable.
  4. Generate and sign evidence.
  5. Verify policy at release and admission.
  6. Limit workflow authority and secret exposure.
  7. Exercise compromise, revocation, update, and disclosure.

Check Yourself​

  1. What evidence connects source to the running artifact?
  2. Which identity can substitute an artifact or bypass a gate?
  3. How is a vulnerable component scoped to actual reachability?
  4. What happens when a signing key or dependency is compromised?

Mini Drill or Application​

Create a local build and promotion pipeline with one deliberate substitution or policy bypass. Detect it using inventory, provenance, signature, or admission evidence; repair the boundary; and preserve a regression test and exception record if a control remains incomplete.

Read This Only If Stuck​