2 ms·

Any supply chain attack can be done in ways where it's externally impossible to (automatically) differentiate a malicious change from a intentional change. Whi

Any supply chain attack can be done in ways where it's externally impossible to (automatically) differentiate a malicious change from a intentional change. Which means BOM's are 100% guaranteed not to prevent supply chain attacks. At best it makes them a small bit harder. Software BOM's can have some small benefits, but preventing supply chain attacks is not one of them. And open access to source always is much more useful then just a BOM. And like a BOM without signature isn't that much trust able (with closed source) accessible source without signing is not trusteable without reproducible builds. Anyway signing source code isn't hard so no reasons not to do so, signing build artifacts can be harder.

silly-silly 6y ago
> signing build artifacts can be harder. Is this like signing an RPM package?
- dathinab 6y ago
  Somewhat. It's not really hard just a bit harder. Mainly on your desktop system you can easily use a hardware security key (like a yubikey) to get a good level of signing security. But your CI server has a good chance to not be your own hardware so you can't plug in a yubikey so to have good key security you either need to find a CI server where you have a HSM or you need to have some form of signing server/service to keep your private key save. You also should at least consider things like "could the artifact be changed in between your CI creating it and your build signing server/IP-based HSM signing it". There are ways to handle it, with different benefits and drawbacks. And considering and understanding this things is maybe the biggest additional amount of work. Or you use a schema-F solution which seems reasonable without understanding it and be okey with it.