Module 05 · Artifact · 50 min · You are: Platform team
Build a verifiable image
In this module
- You learn: Connect source, build inputs, vulnerability findings and image identity.
- You do: Build checkout, scan its filesystem and image, publish a digest from a tagged release, and attach provenance to that digest.
- You end with: S05 is recorded as covered with the image digest and provenance evidence.
A clean scan only describes the bytes it scanned. The release must bind reviewed source to the exact image digest that is deployed.
Open this module in the interactive course to track progress.
Change journey practised: Surface → Test → Measure → Prove
Concepts
- Surface: build inputs and image output
- A digest names image bytes; a tag is a movable label.
- Trust boundary
- Provenance explains how an artifact was built but does not make untrusted source safe.
- Evidence
- Break it: the tag points to a different image
Files to know
Open them in your editor or on GitHub; the bullets say what to look at.
start/.github/workflows/release.yml(reference): Course reference file for this surface.- This is the control or seeded condition examined in this module. L1
start/Dockerfile(reference): The small lab fixture used for a bounded test.- This fixture makes the trust assumption visible. L5
Steps
1. Test: build and scan the exact image
Build only the checkout service. Scan the local image and distinguish vulnerabilities from provenance or source trust.
cd devsecops-lab && docker build -t checkout-lab:course .
Record the image digest and the scanner database date with the result.
trivy image --scanners vuln,secret,misconfig checkout-lab:course
2. Measure and prove: attest the release digest
Pin the builder actions, publish only from a reviewed release environment, create provenance for the pushed digest and verify the signer. Record S05 with the digest and run link.
cd devsecops-lab && cosign verify-attestation --type slsaprovenance ghcr.io/YOUR_GITHUB_USER/devsecops-lab/checkout@sha256:<image digest>
Simplified for the workshop
The reference repository is a local learning fixture. Canaries, package publishing and service endpoints are disposable and do not grant access to a real account.
The checks read repository files as data. They do not run learner scripts or install dependencies.
Break it on purpose: Evidence is a repeatable test result tied to an owner, commit and retest.
A teammate makes a small change to save time. Work out which trust assumption it changes before you run the test.
You practise: You practise tracing the cheapest path from an input to a capability and identifying an independent control.
1. Break it
cd devsecops-lab && git diff -- .github/ docs/
2. What you see
Expected: the proof is stopped at the intended boundary. You get a successful path or missing evidence. Read the workflow log and the register entry.
3. Fix it yourself
Restore the intended boundary and rerun the same test. Done when the unsafe path is refused, the evidence is recorded and the files pass the repository validator.
Hint 1
Name who controls the input and what privilege consumes it.
Hint 2
Follow the input to the first capability and remove that trust or privilege.
The fix
Use the test and the exact policy file named above; do not add a blanket permission.
cd devsecops-lab && ./scripts/validate.sh
After you fixed it: the five questions
- What failed?
- A trust boundary allowed untrusted input to reach a useful capability.
- How was it detected?
- The predicted result and observed log did not match; preserve the commit and workflow run as evidence.
- Who responds?
- The owner listed for this surface in docs/attack-surface.yaml.
- How is it corrected?
- Close the specific boundary and repeat the original test.
- How is it prevented?
- Keep a parse-only lab check and a review rule on the owning files.
Quiz
- Which question best identifies the cheapest path?
- Which accepted input reaches the most useful capability with the fewest prerequisites?
- Which scanner has the most findings?
- Which team owns the largest number of files?
- What does a passing signature prove?
- The named identity signed these bytes.
- The source code is harmless.
- The image has no known vulnerabilities.
- When is a surface covered?
- The same bounded test is refused and evidence names the control and owner.
- A scanner has no critical findings.
- A policy file exists in the repository.
Answers
- Which accepted input reaches the most useful capability with the fewest prerequisites? Attack paths follow trust and capability, not tool counts.
- The named identity signed these bytes. Signatures bind identity and bytes, not safety.
- The same bounded test is refused and evidence names the control and owner. Presence is not proof; retest the attack path.
Field note
I ask learners to write the expected signal before they run a test. It makes a control failure easier to tell from a test that never reached the boundary.