Agent Wranglers

APS-105Recommended

Verify signatures and provenance before you install or deploy

Check the signature or provenance of every package and container image before it runs, where the publisher offers one. Deploy only images signed by your own build.

By Agent Wranglers. Updated .

How to do it

Producing provenance helps others. Checking it protects you. For npm, npm audit signatures checks registry signatures and provenance of installed packages. For container images, verify the signature against the expected signer identity, such as your CI workflow, not only any valid signature. Put the check in the deploy step or in an admission policy of the cluster, so an image pushed by hand cannot run. Record which dependencies offer no provenance, and prefer ones that do when you review a new package.

Examples

Shell example

npm ci && npm audit signatures
cosign verify registry.example.com/shop@sha256:4f1c... \
  --certificate-identity-regexp '^https://github.com/example-shop/shop/.github/workflows/release.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

How to check

CI runs npm audit signatures or the equal check for your package manager, and fails on an invalid signature. A test deploy of an unsigned image, and of one signed by another identity, is refused.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/supply-chain/verify-provenance">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.