[DL.CS.3] Enforce verification before using signed artifacts
Category: RECOMMENDED
Before using code artifacts, the cryptographic signature should be inspected and validated. This verification step enforces trust and security within the development lifecycle, ensuring that software remains unchanged before it is used or deployed.
Strictly enforce verification of cryptographic signatures each time a code artifact is used or deployed. Use a managed signing service like AWS Signer or the public key from your organization's trusted Certificate Authority (CA) for signature verification. Automate the verification process where possible, as manual checks can be error-prone and may not be strictly enforced. Some examples of this are integrating signature verification into the deployment pipeline, enforcing verification at the registry level as artifacts are distributed, or using the Kubernetes admission controller to verify each container image as they are pulled.
Related information:
