Cheat notes · Module 05 · Artifact
Build a verifiable image
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Connect source, build inputs, vulnerability findings and image identity. S05 is recorded as covered with the image digest and provenance evidence.
Remember
- Surface: A digest names image bytes; a tag is a movable label.
- Trust: Provenance explains how an artifact was built but does not make untrusted source safe.
- Evidence: Break it: the tag points to a different image
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
A digest names image bytes; a tag is a movable label.
What do you test?
Build checkout, scan its filesystem and image, publish a digest from a tagged release, and attach provenance to that digest.
What proves the control holds?
S05 is recorded as covered with the image digest and provenance evidence.
Where module 05 leaves you: S05 is recorded as covered with the image digest and provenance evidence.