If a build pipeline may be compromised, do not treat an artifact as trustworthy just because it is stored in the usual repository or carries a familiar version label. Pause potentially affected releases, preserve evidence, identify exposed outputs, and verify each artifact and its provenance against expectations and a trusted build environment before recovery.
Why a repository is a trust boundary, not proof of trust
A CI/CD pipeline links source code to software that is tested, packaged, and deployed. NIST describes these activities as part of software-supply-chain security in SP 800-204D. If an attacker controls a pipeline or its credentials, they may alter build outputs or misrepresent how those outputs were produced—even when the source revision appears unchanged.
As an Amazon Associate I earn from qualifying purchases.
An artifact repository matters because teams use it to store, fetch, promote, and deploy packages and images. It should be authoritative, access-controlled, and monitored, but its familiar name or location cannot establish that a particular artifact is authentic. Calling repositories “trust anchors” is a useful operational framing, not a formal designation in the cited NIST or CISA guidance.
Artifact integrity and repository integrity are related but distinct questions: responders need evidence that the repository was not improperly changed and that the specific artifact is the expected one. NIST’s NCCoE DevSecOps component documentation describes signing and verification tools as ways to establish authenticity and integrity and help detect tampering or unauthorized use.
#1 Best Overall
What evidence makes an artifact more or less trustworthy?
Assess the exact artifact and the system that produced it. A useful verification decision combines several signals rather than relying on a single label or attestation.
| Evidence | What to check | What it can establish |
|---|---|---|
| Artifact identity | Compare the cryptographic digest to a known-good or otherwise pre-established expected value. Distinguish a digest from a mutable tag or version name. | Whether the bytes match the expected artifact; it does not by itself establish who built them. |
| Provenance | Inspect the attestation for builder identity, source revision, build definition, and dependencies where available. Verify those values against expectations. | Where, when, and how the artifact claims to have been produced. |
| Builder and control plane | Determine which build platform components and identities produced or signed the evidence, and whether they remained within the trusted boundary during the exposure window. | Whether the provenance is rooted in a platform responders can still trust. |
| Repository events | Review access and integrity-changing events, including relevant publishing, promotion, deletion, and permission changes. | Whether repository activity aligns with authorized pipeline and release activity. |
SLSA defines provenance as verifiable information about where, when, and how software artifacts were produced. It is an attestation from a build platform, not an independent guarantee that the platform itself was uncompromised. SLSA’s threat guidance includes unauthorized output changes and false provenance among build-process threats. Treat a provenance level or signature as a structured assurance signal, then verify it against expected values and a root of trust.
How should responders handle a suspected pipeline compromise?
The sequence below synthesizes controls described by CISA, NIST, and SLSA into an incident workflow; it is not a verbatim NIST or CISA playbook. Adapt it to the incident plan, affected platform, and any current incident-specific advisories.
-
Contain access and stop propagation
Restrict identities, tokens, deploy keys, and other credentials that may have been exposed or abused. Pause releases or promotions that could continue distributing suspect outputs. CISA’s developer guidance specifically calls for protecting secrets associated with the build pipeline.
-
Preserve evidence before routine cleanup
Retain relevant pipeline logs, repository events, artifact digests, attestations, and identity and access records. Preserve the records needed to connect build activity to published outputs before routine retention, cleanup, or remediation changes them. The cited guidance does not set a universal evidence-retention period; use your incident procedures and applicable obligations.
-
Scope the exposed outputs
Establish the suspected exposure window, then identify builds, packages, images, and repository versions created, changed, or promoted during it. Match records using immutable identifiers and digests rather than relying only on mutable tags or version labels. Include downstream copies or deployments where your records can identify them.
Rank #4
-
Verify outputs and provenance against a trusted baseline
For each relevant artifact, check its digest, provenance, builder identity, source revision, build definition, and dependencies where available against pre-established expectations. Establish whether the build platform and its control plane were inside or outside the suspected compromise. If the trust root itself may have been compromised, a matching signature or internally generated attestation is not sufficient evidence on its own.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Re-establish a trusted build path before recovery
Rotate affected secrets and remediate pipeline and repository access. Use immutable inputs and verify their integrity. Rebuild or republish only after establishing a build environment and control plane that responders can trust. CISA recommends fetching artifacts through a trusted control plane, rejecting mutable references, and verifying integrity. It also recommends preventing network access during build steps as a best-effort control where feasible.
Best Value
Sale
The Practice of Network Security Monitoring: Understanding Incident Detection and Response- Used Book in Good Condition
-
Notify downstream teams with verifiable identifiers
Communicate which artifacts are affected, what remains uncertain, and what consumers should do. Provide artifact identifiers and the verification information teams need to distinguish a confirmed-good build from a suspect one. Do not declare a release clean solely because it remains in the canonical repository.
What should teams strengthen before the next incident?
Controls are most useful when responders can apply them without reconstructing the build system under pressure. CISA’s recommendations and the NIST and SLSA material point to practical preparation:
- Use immutable references for fetched inputs, and verify cryptographic hashes when those references include them. If a hash is unavailable, CISA describes using a channel that ensures transport integrity, such as TLS or code signing.
- Protect pipeline secrets and make access to build, repository, and release identities traceable to accountable owners.
- Keep records that let responders relate an artifact digest to its build, provenance, repository events, and release or deployment activity.
- Define expected builder identities, source revisions, and build definitions so verification has a baseline rather than relying on retrospective guesswork.
- Reduce unnecessary network access during build steps where practical, while recognizing CISA describes this as a best-effort control.
NIST SP 800-204D provides the broader DevSecOps and software-supply-chain context; CISA’s Securing the Software Supply Chain: Recommended Practices for Developers gives concrete pipeline controls; and SLSA’s provenance and threat materials explain attestation and build-platform trust. SLSA specifications are living documents, so check the current specification before relying on a particular level or normative requirement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
