DevSecOps Practice Hub

Supply Chain Security

Protect the path from source commit to deployed artefact against tampering and dependency compromise.

AdvancedSoftware Supply Chain SecuritySupply Chain

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.
  • Release Approval controls, artefact promotion and provenance.
  • Deploy Policy enforcement, admission control and infrastructure security.

Overview

Supply chain security treats the build system as production infrastructure: verified source, hermetic and reproducible builds, signed artefacts, recorded provenance, and verification before deployment.

Why it matters

Attacks increasingly target build systems and package registries because one compromise reaches every downstream consumer.

How it works

  1. 01Source integrity is enforced with protected branches and signed commits.
  2. 02Builds run on ephemeral, isolated runners with pinned toolchains.
  3. 03Artefacts are signed and provenance attestations are recorded.
  4. 04Deployment admission verifies signature and provenance before running the artefact.

Common tools

Sigstore CosignSyftin-totoTrivyGitHubGitLabSLSAKubernetes

Implementation examples

bashSign and verify an image
cosign sign --yes $IMAGE_DIGESTcosign verify --certificate-identity-regexp '.*' \  --certificate-oidc-issuer https://token.actions.githubusercontent.com \  $IMAGE_DIGEST
Keyless signing binds the signature to the workflow identity. Replace the identity regex with your exact workflow before relying on verification.

Best practices

  • Pin dependencies and actions by digest.
  • Separate build and deploy credentials.
  • Verify signatures at admission, not just at build.

Common mistakes

  • Signing artefacts but never verifying them.
  • Giving pipeline jobs broad, long-lived registry credentials.

Hands-on labs