A secure CI/CD update workflow that combines keyless Cosign signing (OIDC/Fulcio), immutable SHA-256 digest–based image addressing, mandatory pre-deployment signature verification, and freshness controls against rollback attacks is presented, while permitting controlled rollback only to previously verified versions.
This paper presents an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification, and implements a proof-of-concept integrated with GitHub Actions and GitLab Runners that mitigates common supply-chain attacks under a realistic threat model.
N. Fotiou, Lefteris Georgiadis, Ignacio Lacalle et al.· 0 citations
This study investigates security risks in Dock-er-based GitHub Actions workflows and proposes a tailored, DevSecOps-aligned security checklist to mitigate these threats, offering practical protection against supply-chain threats while preserving delivery speed and scalability.
A. Amirova· International Journal of Wir...· 0 citations
The idea of secure environments of continuous integration and continuous delivery has emerged as an object of study due to the fact that current delivery pipelines concentrate privileged automation, dependency resolution, artifact handling, and release control within a small number of highly interconnected systems. This concentration also becomes a design issue in zero-trust DevOps where every single interaction in a pipeline is assumed to be untrusted until identity and integrity are established and policy compliance and provenance are verified. This survey discusses secure CI/CD hardening through the practical lens of Jenkins, Bitbucket, and JFrog, treating these systems as focal platforms for pipeline orchestration, source-code governance, and artifact trust. The literature indicates that conventional perimeter-focused protective approaches have been replaced by policy-based, evidence-based, and identity-oriented controls, which focus on least privilege, continuous verification, signed artifacts, infrastructure-as-code inspection, and supply chain visibility. Key themes include barriers to DevSecOps adoption, zero-trust design, maturity and performance metrics, software bill of materials adoption, infrastructure misconfiguration, code integrity, and patch reliability. It has been repeatedly reported that tooling is insufficient when organizational practices, trust boundaries, and feedback loops are weak. Persistent gaps include limited cross-platform empirical research, insufficient product-specific evaluation, underdeveloped provenance metrics, and inadequate attention to artifact repositories as valuable control points. Jenkins-BitBucket-JFrog pipeline hardening is thus reliant on synchronized controls on code, build, repository, identity, and release levels rather than the deployment of a single scanner.
Ratan Raj Anandeshi· International Journal of Sci...· 0 citations
Ensuring the integrity of automotive software, from source code to deployed binaries, has become critical as vehicles increasingly rely on over-the-air (OTA) updates and complex supply chains. The Uptane framework secures OTA update delivery for automotive systems but does not enforce integrity within the upstream software supply chain, leaving the gap between source commits and deployed artifacts unverified. We present GuixChain, a blockchain-backed reproducible build layer that enforces multi-party consensus before artifacts enter OTA pipelines. GuixChain combines deterministic GNU Guix builds, cryptographic SBOM binding, and Hyperledger Fabric smart contracts. Together, these components ensure that only independently verified, bit-identical binaries are deployed. Evaluation across a consortium representing OEMs, suppliers, and auditors demonstrated reliable reproducibility over 30 build cycles. Fault injection experiments covering four threat categories were fully detected with low latency (1.8–2.4 seconds). The system maintained modest overheads (15–19% CPU, 1.4–3.5.GB memory, 41–60MB disk), with blockchain consensus adding only 2–3 seconds to build verification. Multi-node consensus yielding total build-to-verification time of 30–38 seconds per validator. By enforcing consensus-based reproducibility upstream of Uptane, GuixChain provides a scalable and verifiable supply chain integrity layer, bridging the gap between source-level trust and safe deployment, while remaining compatible with existing automotive OTA infrastructure.
Iwinosa Aideyan, M. Pesé, Richard. R. Brooks· Distributed Ledger Technolog...· 0 citations
AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.
Due to the emergence of strict regulatory standards such as the NIST Secure Software Development Framework (SSDF), the demand for compliance is higher. Traditional methods of implementing compliance measures are based on manual auditing and document management. This may lead to inefficiency, delayed processes, and security threats. For the above problems, this research presents a framework that automates compliance validation through rules-as-code approach in order to implement continuous assurance. This paper introduces the Rules-as-Code Cloud Assurance Framework (RC-CAF) which implements automated extraction and execution of rules in order to improve compliance processes in cloud-based environments. Experimental results have shown that the presented model has significantly improved compliance verification compared to FS-PKSE and CIA-Scheme models. It has achieved compliance accuracy of 96%, reduced computational costs to 180 ms and increased efficiency of compliance monitoring in real-time to 95%. The violation detection rate of 97% has been achieved with reduced processing time.
Shuaib Ahmed· 2026 4th International Confe...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
