Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

content: draft: Add mitigation for compromised build tooling #1251

Merged
merged 8 commits into from
Dec 11, 2024
Merged

content: draft: Add mitigation for compromised build tooling #1251

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
614d86b
content: draft: Add mitigation for compromised build tooling
TomHennen Dec 3, 2024
28b00bc
software -> artifact
TomHennen Dec 5, 2024
0d66d1c
use recursive verification
TomHennen Dec 5, 2024
3f4a8a0
add Build Environment Track reference
TomHennen Dec 10, 2024
539d114
Build Environment Track isn't perfect
TomHennen Dec 10, 2024
520b5e7
Update docs/spec/draft/threats.md
TomHennen Dec 10, 2024
610d57c
Update docs/spec/draft/threats.md
TomHennen Dec 10, 2024
16a48db
fix linter
TomHennen Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions docs/spec/draft/threats.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -866,14 +866,19 @@ libDep, resulting in MyPackage also having the security vulnerability.
process, which alters the build process and injects unintended behavior into the
output artifact.

*Mitigation:* Treat build tooling, including OS images, as any other software
to be verified prior to use (as described in (G)). This will allow the build
platform to detect any modified binaries.

*Example:* MyPackage is a tarball containing an ELF executable, created by
running `/usr/bin/tar` during its build process. An adversary compromises the
`tar` OS package such that `/usr/bin/tar` injects a backdoor into every ELF
executable it writes. The next time MyPackage is built, the build picks up the
vulnerable `tar` package, which injects the backdoor into the resulting
MyPackage artifact.

*Mitigation:* **TODO**
MyPackage artifact. Solution: The build platform verifies the disk image,
or the individual components on the disk image, against the associated
provenance or VSAs prior to running a build. The modified `/usr/bin/tar`
will fail this verification.

</details>

Expand Down
Loading