Build Artifact Without Integrity Verification

Detects CI/CD pipelines that download, use, or publish build artifacts without cryptographic hash verification.

zakirkun Updated

File contents

Build Artifact Without Integrity Verification

Overview

CI/CD pipelines that download tools, binaries, or artifacts without verifying their SHA256 checksums are vulnerable to supply chain attacks where a compromised CDN or package server serves malicious payloads.

Remediation

  • Always verify SHA256 checksums after downloading artifacts
  • Use package managers with lock file integrity checks
  • Pin artifact versions to immutable digests where possible

zakirkun/ice-tea/tree/main/skills/devops/artifact-no-integrity commit 56c98b1476

Frequently asked questions

npx skillmds@latest add zakirkun/build-artifact-without-integrity-verification