Web › Module 8 › Lesson 2
Integrity of Code and Artifacts
Hashes, signatures, and pinned digests — verify what you build and ship.
Visual · integrity_artifacts
Checksum and signature beside a release tarball. sha256sum locally + curl -I http://192.168.0.1/. Router admin STOP. No Trojan “test payloads.”
Opening
Integrity is a measurable property — hash, signature, or attestation — not a vibe.
OWASP Top 10:2025 A08 Software or Data Integrity Failures includes shipping and consuming artifacts without verifying digests or signatures, mutable tags that move under you, and “trust the CDN” without pinning. Attacker goal: swap the blob. Cyberlium: practice sha256sum (or equivalent) on files YOU created under cyberlium-lab, plus identify HEAD curl -sS -I http://192.168.0.1/. If that IP is a router login, STOP. Next lesson covers deserialization concepts without gadget cookbooks. Own-lab → fix/report: pin digests in your deploy docs. No malware drops. No hydra. No nmap.
1. Digests: detecting change, not proving who authored
A cryptographic hash detects accidental or malicious alteration if you already trust the expected digest from a secure channel. Hash alone does not name the author — combine with signatures or a trusted pin source. Record expected digests for release artifacts YOU publish.
Always hash the artifact you will run, not a webpage that might be different. Compare, then install.
Command guide
A08 Integrity — Digests
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
(sha256sum "$HOME/cyberlium-lab/a08-mid-artifact.txt" || shasum -a 256 "$HOME/cyberlium-lab/a08-mid-artifact.txt") sha256sum "$HOME/cyberlium-lab/a08-mid-toy.txt" || python3 -c "import hashlib; print(hashlib.sha256(open(r'$HOME/cyberlium-lab/a08-mid-toy.txt','rb').read()).hexdigest())"
2. Signatures: authorship when keys are managed
Code signing and signed manifests bind a key to a blob. Protect private keys like deploy secrets. Verify with the vendor’s published public key — obtained out of band when possible. On YOUR releases, document how consumers verify. Do not disable verification in production “temporarily.”
Expired or self-signed demos belong only in labeled local labs, not as production policy.
3. Pins and lockfiles: reproducibility as integrity
Lockfiles and image digests freeze what you tested. Floating latest tags are integrity debt. Module 3 habits apply: pin, review diffs when updating, refuse surprise major bumps without reading changelogs. Write your pin policy for one project you own.
CDN or mirror compromise is why pins and signatures matter even when HTTPS works. A HEAD to YOUR demo URL is identify-only — not a firmware hunt on the gateway.
4. Provenance notes without shipping malware
Say where the artifact came from, who built it, and how you verified. Do not attach live malware samples “to practice scanning.” Do not email classmates a “test trojan.” Cite A08. Original Cyberlium — not official OWASP certification.
chmod 600 for notes that mention key locations (paths only, no key material).
5. Wrong vs right: skip verify vs hash+sign on your artifacts
Same word “release,” opposite discipline.
Wrong
Install unsigned blobs. Use :latest forever. Paste private keys into notes. Ship malware samples to friends. Hydra the router. nmap the LAN.
Right
Identify DEMO with curl -I; router → STOP. Hash/sign artifacts YOU own; pin digests; lock integrity-artifacts-notes.txt. Next: Deserialization Risks Concepts.
6. Hands-on: sha256sum a file you created + DEMO HEAD
Create a toy artifact, hash it, modify it, see mismatch. Local files only for the digest lab.
Mission: integrity-artifacts-notes.txt (mode 600)
1)2) Hash a toy file YOU created; record expected digest; tamper and confirm mismatch. Write signature and pin policy. 3) chmod 600 $HOME/cyberlium-lab/integrity-artifacts-notes.txt. No malware samples. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If integrity still means “download a virus to scan,” ask for a hint — not a sample. Try: "Hint only: hash vs signature; why pins beat :latest; why 192.168.0.1 router login is OUT OF SCOPE; where my toy digest lives?" You still use cyberlium-lab files you created.
Integrity is verify-before-trust on bits you run — sha256sum locally plus identify HEAD to the demo URL. A08. Original Cyberlium — not official OWASP certification. Next — Deserialization Risks Concepts — refuse unsafe loads on YOUR code.
Knowledge Check
APPLY: You pin a sha256 for your release. Someone alters the zip. What should verify do?
Multiple choice
Knowledge Check
APPLY: True or False: A hash alone always proves the vendor authored the file.
True or False
Knowledge Check
APPLY: curl -I of http://192.168.0.1/ is Netgear router admin. Hash the router firmware next?
Multiple choice