iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

A08 Software / Data Integrity

By · Reviewed & last updated · Part of OWASP Top 10 Tutorial

A08 is Software & Data Integrity Failures — unsigned dependencies, compromised CI/CD pipelines, deserialisation of untrusted data, auto-updaters with no verification. SolarWinds and the xz backdoor both live here.

SBOM + signing + CI/CD provenance

EXAMPLE
# 1) Sign your artefacts — Sigstore / cosign make it free
#    Container images
cosign sign --key cosign.key me/app:1.4.0
cosign verify --key cosign.pub me/app:1.4.0

#    Or keyless via OIDC (preferred in CI)
cosign sign me/app:1.4.0

#    Generic blobs
cosign sign-blob --output-signature dist.sig --output-certificate dist.crt dist.tar.gz

# 2) Generate + ship an SBOM with every release
syft me/app:1.4.0 -o cyclonedx-json > sbom.json
cosign attach sbom --sbom sbom.json me/app:1.4.0

# 3) SLSA provenance — proves the build came from your CI
#    GitHub Actions OIDC + cosign keyless = SLSA L3 with one workflow
# .github/workflows/release.yml
permissions:
    id-token: write
    contents: read
    packages: write

steps:
    - uses: actions/checkout@v4
    - uses: docker/build-push-action@v6
      with: { push: true, tags: me/app:1.4.0 }
    - uses: sigstore/cosign-installer@v3
    - run: cosign sign me/app:1.4.0          # keyless, signed with workflow OIDC

# 4) Verify at deploy time — refuse to run unsigned images
#    Kubernetes via Kyverno / Sigstore policy controller
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: verify-image-sig }
spec:
    validationFailureAction: Enforce
    rules:
        - name: verify-cosign
          match: { any: [{ resources: { kinds: [Pod] } }] }
          verifyImages:
              - imageReferences: ["me/app:*"]
                attestors:
                    - entries:
                          - keyless:
                                subject: "https://github.com/me/app/.github/workflows/release.yml@refs/heads/main"
                                issuer:  "https://token.actions.githubusercontent.com"

# 5) Deserialisation — accept ONLY signed / schema-validated input
//   Node:    use json-schema, zod, or pydantic-equivalent. NEVER eval().
//   Java:    avoid Java serialisation; use jackson with a strict whitelist.
//   Python:  never pickle.load() untrusted bytes.

# 6) Lock auto-updaters
//   - Mandatory signature verification (Sparkle, Squirrel, electron-updater all support).
//   - Pin checksums.
//   - Roll out gradually (canary 5% → 25% → 100%).

Why it matters

A08 fixes pay back across every vendor incident: signed artefacts + verified provenance = you can’t silently ship someone else’s build under your name. Wire it once, benefit forever.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
// A08 Software / Data Integrity — unsigned deps, CI/CD compromise,
// auto-update without verification.
// Fix: signed artifacts (Sigstore), SLSA provenance, locked CI runners.
Try it Yourself »

Discussion

Loading…