Software Artifact Integrity
The process of verifying that build artifacts match their declared sources and have not been tampered with during or after the build process, ensuring end-to-end supply-chain integrity.
Primary question: How can organizations verify the integrity of software build artifacts?
Direct answer
Software artifact integrity is the assurance that a build artifact was produced from the declared source code and dependencies through a controlled process, and has not been modified since the build completed. Verification requires cryptographic signing, hash verification, and build reproducibility to provide end-to-end supply-chain integrity.
Software artifact integrity provides assurance that the artifact deployed to production is the same artifact that was built from the declared source code and dependencies. This requires cryptographic verification at multiple stages — from source code through dependency resolution, build, and deployment — to detect unauthorized modifications. Without artifact integrity controls, there is no way to confirm that a deployed artifact has not been tampered with.
Artifact integrity is a critical component of supply-chain security because compromised artifacts can introduce vulnerabilities, backdoors, or malicious code into production systems. Verification of artifact integrity should be combined with provenance verification and build pipeline security to provide broader supply-chain assurance.
Definitions
Software artifact
A compiled, packaged, or otherwise processed output of the build process — such as a binary, container image, library, or executable — that is produced from source code and dependencies.
Artifact integrity
The assurance that a build artifact was produced from the declared source code and dependencies, without unauthorized modification during or after the build process.
Artifact signing
The process of applying a cryptographic signature to a build artifact to enable verification of its origin and integrity.
The engineering problem
Organizations may deploy artifacts without verifying their integrity, trusting that the build process produced correct output.
Artifacts may be modified during transit between the build environment and the deployment target, especially in environments without encrypted or signed artifact channels.
Build artifacts from unverified or uncontrolled build pipelines may contain malicious code that was injected during the build process.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Cryptographic signing
Artifact signing- Artifact
- A build artifact signed with a cryptographic key, enabling verification of its origin and integrity at any point after the build.
- Risk
- Deploying an artifact whose origin or integrity cannot be verified.
- Output
- Cryptographically signed artifacts with verifiable origin and integrity.
Evidence:
Hash verification
Integrity verification- Artifact
- A build artifact with a verified cryptographic hash, confirming that the artifact content matches the expected hash recorded at build time.
- Risk
- Deploying an artifact whose content has been modified since the build.
- Output
- Verified artifact hash confirming content integrity.
Evidence:
Build reproducibility
Reproducible builds- Artifact
- A build process that produces identical artifacts from the same source code and dependencies, enabling independent verification of artifact integrity.
- Risk
- Artifacts whose integrity cannot be independently verified because the build process is not reproducible.
- Output
- Reproducible builds that enable independent verification of artifact integrity.
Evidence:
Artifact repository controls
Repository governance- Artifact
- A build artifact repository with access controls and integrity verification, preventing unauthorized modification of stored artifacts.
- Risk
- Artifacts stored in an uncontrolled repository that may be modified without detection.
- Output
- Controlled artifact repository with access controls and integrity verification.
Evidence:
Verification workflow
- Source code is fetched from the version control system and its integrity is verified.
- Dependencies are resolved and their integrity is verified.
- The build process compiles source code and packages dependencies into artifacts.
- Build artifacts are produced and their cryptographic hashes are recorded.
- Artifacts are signed with cryptographic keys for integrity verification.
- Signed artifacts are stored in a controlled artifact repository.
- Before deployment, artifact integrity is verified through hash and signature checks.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner SCA identifies open-source components, vulnerabilities in open-source libraries, and software-supply-chain risks. SCA can help identify supply-chain risks in the dependencies used to produce build artifacts. DerScanner does not perform artifact signing, hash verification, or build reproducibility checks.
DerScanner performs software-composition analysis that identifies open-source components, vulnerabilities in open-source libraries, and software-supply-chain risks. SCA can help identify supply-chain risks in the dependencies used to produce build artifacts. [derscanner-sca]
Limits of verification
- Artifact integrity verification depends on secure key management — compromised signing keys undermine the entire integrity chain.
- Cryptographic signing does not guarantee that the build process itself was secure — it only verifies that the artifact has not been modified since signing.
- Build reproducibility may not be achievable for all projects, especially those with complex build processes or external build-time dependencies.
- DerScanner SCA identifies vulnerabilities in dependencies but does not verify artifact integrity, perform artifact signing, or ensure build reproducibility.
Related knowledge
Software Dependency Verification
The broader process of verifying dependency authenticity and integrity
Relationship: related-toMalicious Open-Source Packages
How malicious packages can compromise the supply chain
Relationship: related-toDependency Provenance
The documented origin and history of dependencies
Relationship: related-toTransitive Dependency Risk
Risks associated with indirect dependencies
Relationship: related-toBuild Pipeline Supply Chain Security
Securing the build process as part of supply-chain security
Relationship: related-toCanonical terms used: Software artifact integrity; Artifact integrity; Artifact signing; Build reproducibility.
Evidence and references
- DerScanner SCA documentationDerScanner SCA identifies open-source components, vulnerabilities in open-source libraries, software-supply-chain risks, license risks, dependency-tree visualization, package health assessment, and hybrid SAST+SCA function reachability.
derscanner-sca
Supply-chain security