Skip to Main Content
The Rise of Continuous Packaging
book

The Rise of Continuous Packaging

by Dan McKinney, Ciara Carey
March 2022
Intermediate to advanced content levelIntermediate to advanced
40 pages
54m
English
O'Reilly Media, Inc.
Content preview from The Rise of Continuous Packaging

Chapter 3. Source and Build Integrity

The keys to mitigating threats and risks to the software supply chain are maintaining the integrity of source code, packages, and dependencies, and securing the build process from beginning to end. As we’ve seen from the examples in the previous chapter, it’s not enough to trust even the best-known third parties. Because any part of the supply chain is vulnerable to attack, it’s necessary to verify source code and packages, rather than trusting them, at every step of the way:

  • Scan source code as it’s committed to the repository, then again during the build and packaging steps

  • Isolate everything from third parties

  • Implement your own single source of truth for all packages

  • Pin dependencies to known good package versions

  • Sign packages in your possession so you can verify their authenticity

  • Maintain visibility throughout the supply chain, all the way to deployment

  • Use tools that build security in by default

The most important factor in improving the integrity of the software supply chain is security awareness on the part of the DevOps and engineering teams who build the products. To incorporate security into the development pipeline from beginning to end, these teams need comprehensive visibility into all source code and processes, including the provenance of all dependencies.

The following sections describe a few tools and concepts that are instrumental when building a secure software supply chain.

Source Code Management

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Reinventing the Organization for GenAI and LLMs

Reinventing the Organization for GenAI and LLMs

Ethan Mollick

Publisher Resources

ISBN: 9781098117344