Artifact Integrity Verification Missing

Detects download and execution of artifacts without cryptographic hash or signature verification.

zakirkun Updated

File contents

Artifact Integrity Verification Missing

Overview

Downloading binary artifacts, scripts, or packages from URLs without verifying their cryptographic signatures or hashes allows man-in-the-middle attacks or compromised CDN attacks to deliver malicious code.

Remediation

  • Always verify SHA256 hash of downloaded artifacts
  • Use --checksum flags where available
  • Use Subresource Integrity (SRI) hashes for CDN resources in HTML
  • Verify GPG signatures for critical software

zakirkun/ice-tea/tree/main/skills/supply-chain/artifact-integrity commit eb9e64a62c

Frequently asked questions

npx skillmds@latest add zakirkun/artifact-integrity-verification-missing