The Rise of Continuous Packaging

Chapter 3. Source and Build Integrity

The keys to mitigating threats and risks to the software supply chain are maintaining the integrity of source code, packages, and dependencies, and securing the build process from beginning to end. As we’ve seen from the examples in the previous chapter, it’s not enough to trust even the best-known third parties. Because any part of the supply chain is vulnerable to attack, it’s necessary to verify source code and packages, rather than trusting them, at every step of the way:

• Scan source code as it’s committed to the repository, then again during the build and packaging steps

• Isolate everything from third parties

• Implement your own single source of truth for all packages

• Pin dependencies to known good package versions

• Sign packages in your possession so you can verify their authenticity

• Maintain visibility throughout the supply chain, all the way to deployment

• Use tools that build security in by default

The most important factor in improving the integrity of the software supply chain is security awareness on the part of the DevOps and engineering teams who build the products. To incorporate security into the development pipeline from beginning to end, these teams need comprehensive visibility into all source code and processes, including the provenance of all dependencies.

The following sections describe a few tools and concepts that are instrumental when building a secure software supply chain.

Source Code Management