Build integrity and provenance

Protect the path from pull request to release

Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.

Development, Release · Developers, Platform engineers and SREs

Verify artifact signatures against an explicit trust policy

Require the expected artifact, signer and release context before allowing a signed package or image to proceed.

Release · Developers, Platform engineers and SREs

Read SLSA provenance and verify the claim you need

Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.

Release · Developers

Investigate build differences and improve reproducibility

Control inputs and environment, compare artifact bytes, and explain the security properties a repeatable build can demonstrate.

Release · Platform engineers and SREs

Review dependency health without treating a score as a guarantee

Combine security practices, maintenance, licensing and product exposure into a recorded adoption or replacement decision.

Development, Release, Security program · Platform engineers and SREs

Case study: the xz Utils backdoor (CVE-2024-3094)

How a multi-year maintainer takeover planted a backdoor in xz Utils release tarballs, how build-time injection hid it from the git repository, why a performance anomaly exposed it, which systems shipped it, and what it teaches about reproducible builds and maintainer health.

Development, Release, Maintenance, Security program · Developers, AppSec engineers, Platform engineers and SREs

Case study: the SolarWinds Orion build compromise (SUNBURST)

How an implant on SolarWinds' build server inserted the SUNBURST backdoor into signed Orion updates in 2020, how it was found, why code signing and review could not catch it, and which build controls would have.

Release, Maintenance · AppSec engineers, Platform engineers and SREs

Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)

How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.

Release, Maintenance · Platform engineers and SREs

Protect the source repository: rulesets, reviews and signed commits

Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.

Development, Testing, Release, Security program · Developers, AppSec engineers, Platform engineers and SREs

Apply NIST SSDF (SP 800-218) to one product: practices, evidence and attestation in 2026

Connect secure-development practices to an actual product’s work, artifacts and responsibilities instead of a questionnaire full of unsupported yes answers.

Release, Security program · Security leaders

Compliance evidence reuse: one evidence set for SSDF, PCI DSS, ISO 27001, SOC 2 and the CRA

Keep one set of release-bound engineering evidence (SBOM, provenance, review records, scan results, ASVS results and vulnerability handling) and map it to several frameworks: a worked crosswalk, an evidence index checked in CI with a CSV export, and an OSCAL component definition.

Release, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Answer a US federal secure software attestation request in 2026: the CISA form, its SSDF mapping and the evidence behind each statement

Know what is and isn't required after OMB M-26-05, then answer an agency's request statement by statement, with the SSDF tasks the form maps and release evidence for each claim.

Release, Security program · Security leaders

Signed artifact provenance lab: Reject a release from the wrong producer

A deployment gate accepts any signed artifact. A valid signature from an unrelated repository can therefore reach production. Repair the trust policy applied to verified evidence.