Cheat notes · Module 06 · Artifact
Verify at admission
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Check signatures and signer identity when an image enters the cluster. Admission accepts the exact release identity and refuses the same image signed by another workflow.
Remember
- Surface: A valid signature from the wrong workflow is still the wrong signer.
- Trust: A broad identity pattern grants trust to future repositories too.
- Evidence: Break it: one wildcard admits another signer
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
A valid signature from the wrong workflow is still the wrong signer.
What do you test?
Sign the release digest with keyless identity, install the image policy, try a mismatched signer, and record S06.
What proves the control holds?
Admission accepts the exact release identity and refuses the same image signed by another workflow.
Where module 06 leaves you: Admission accepts the exact release identity and refuses the same image signed by another workflow.