Poisoned Pipeline / Mitigations / M1090
M1090
Implement code and image signing
Require digital signatures or code signing certificates for packages or container images uploaded to public registries.
This helps ensure the integrity and authenticity of the artifacts, and helps detect any tampering or malicious modifications.
Applies to
- T0109 Publish malicious artifact
- T0215 Enroll attacker-owned code-signing identity
- T0209 Compromise package registry or CDN origin
- T0207 Skip or forge artifact integrity verification
- T0110 Advertise malicious artifact