Poisoned Pipeline / Mitigations / M1731

M1731

Implement verification of signed commits

Signing commits, or requiring to sign commits, gives other users confidence about the origin of a specific code change.
It ensures that the author of the change is not hidden and is verified by the version control system, thus the change comes from a trusted source.
For each repository in use, enforce the branch protection rule of requiring signed commits, and make sure only signed commits are capable of merging.

Applies to

• T0196 Backdoor in code
• T0195 Spoofed Commits
• T0173 Auto merge rules in SCM
• T0138 Backdoor in code
• T0170 Malicious compiler or interpreter
• T0141 Fake developer reputation (Starjacking)
• T0181 Malicious module injection

References

• https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
• https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/