DevSecOps Practice Hub

Artifact Security

Control how build outputs are stored, promoted and retrieved from registries and artefact repositories.

IntermediateArtifact SecuritySupply ChainContainer

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.
  • Release Approval controls, artefact promotion and provenance.
  • Deploy Policy enforcement, admission control and infrastructure security.

Overview

Registries are the handoff point between build and run. Immutable tags, promotion between repositories, retention rules and continuous rescanning keep that handoff trustworthy.

Why it matters

A mutable tag means the thing you tested is not necessarily the thing you ran.

How it works

  1. 01Builds push to a staging repository only.
  2. 02Scans and signatures gate promotion to the production repository.
  3. 03Production tags are immutable and referenced by digest.
  4. 04Stored images are rescanned as advisories are published.

Common tools

HarborJFrog ArtifactoryTrivySigstore CosignDockerKubernetesOpenShift

Implementation examples

yamlDeploy by digest
containers:  - name: api    image: registry.example.com/prod/api@sha256:3f7c1e...
Digest references make the deployed artefact unambiguous and verifiable.

Best practices

  • Enable tag immutability.
  • Separate staging and production repositories.
  • Rescan stored artefacts continuously.

Common mistakes

  • Deploying `:latest` from a shared repository.