Build attestation framework should be used
ID |
build_attestation_framework |
Severity |
high |
Family |
CI/ CD Security |
Tags |
cicd-sec-09, cicd-security, non-reachable, security, supply-chain |
Description
A build attestation framework should be used.
This check tries to determine if the project uses a build attestation framework to establish trust and provide assurance about the integrity and security of software builds or artifacts.
You can configure tools or run commands to check for workflows using tools to verify this. The parameters are tools and commands.
Security
The primary purpose of a build attestation framework is to address the following goals:
-
Supply Chain Security: With the increasing complexity of software supply chains, a build attestation framework helps verify the source and integrity of the software components used during the build process. It provides transparency and visibility into the entire build pipeline, allowing organizations to identify and mitigate any potential security risks or compromised dependencies.
-
Trustworthy Software Delivery: By attesting to the build process and its associated artifacts, a build attestation framework enables recipients to verify the authenticity and integrity of the delivered software. It assures them that the build was performed correctly and without unauthorized modifications or tampering, reducing the risk of deploying compromised or malicious software.
-
Compliance and Regulatory Requirements: Many industries and regulatory frameworks require organizations to demonstrate control and visibility over their software supply chains. A build attestation framework helps meet these compliance requirements by providing a documented trail of the build process, ensuring adherence to specific security and quality standards.
-
Vulnerability Management: A build attestation framework can integrate with vulnerability scanning and management tools to track and validate the versions of dependencies used in the build process. This helps identify any known vulnerabilities or weaknesses in the software components, allowing organizations to apply necessary patches or upgrades.
In summary, a build attestation framework provides an additional layer of trust and accountability for software builds. It ensures the security, authenticity, and integrity of software artifacts, enabling organizations to confidently deploy and manage their software supply chains.