Web › Module 8 › Lesson 1
Unsigned Updates and CI Trust
A08: who can change what you run — updates, CI, and unsigned trust.
Visual · unsigned_ci_trust
Pipeline and update arrow without a signature check. with curl -I — router admin STOP. Review YOUR CI — not a supply-chain attack kit.
Opening
Integrity failures are believing a bit stream because it arrived — not because it proved who signed it.
OWASP Top 10:2025 A08 Software or Data Integrity Failures covers auto-updates without signature verification, CI/CD that trusts unsigned artifacts, and build pipelines where anyone who can push can become production. Attacker goal: run their code as yours. Cyberlium: map trust on pipelines and update channels YOU control — Module 3 already covered dependency inventory; A08 is whether the bits you install are authenticated.
1. Updates without proof: HTTPS alone is not authorship
Fetching over TLS proves you talked to some server with a matching certificate — not that the blob is the vendor’s intended build. Signed updates (code signing, signed manifests, verified digests from a pinned channel) answer authorship and integrity. Auto-update that silently installs unsigned zip files is classic A08. On software YOU ship or run, require verify-before-apply. A HEAD request to YOUR demo URL is identify-only — not a hunt for unsigned firmware on a gateway you do not own.
Pin expected hashes when you distribute internal tools. Publish signature verification steps for your users. Do not disable signature checks “to make the lab faster” on production paths you own.
2. CI trust: the pipeline is a privileged identity
CI secrets can deploy. If pull requests from forks run with those secrets, or if anyone can alter the workflow without review, integrity failed by design. Require protected branches, required reviews, pinned actions by hash where feasible, and least-privilege tokens. Document YOUR repo’s settings — do not attack someone else’s Actions.
“Trust the green check” without knowing who could edit the workflow is A08 thinking. Name the humans and bots allowed to change release jobs.
3. Artifact promotion: build once, promote signed outputs
Rebuild-in-prod from mutable tags invites drift. Prefer immutable digests, signed attestations if you use them, and promote the same artifact across environments. Module 3’s pinning habits return here as promotion policy.
Write where your release artifact is stored and who can overwrite it. Empty “we use GitHub” without access notes fails.
4. What this course refuses: poisoning public ecosystems as homework
You will not publish typosquat packages, hijack maintainer accounts, or run “prove CI compromise” against orgs you do not own. Literacy is defensive review of YOUR update and CI surfaces. Cite A08. Original Cyberlium — not official OWASP certification.
If a finding exists on YOUR pipeline, fix/report with config evidence — not a public exploit narrative against unrelated projects.
5. Wrong vs right: attack registries vs verify your update path
Same word “supply chain,” opposite ethics.
Wrong
Typosquat or poison packages. Disable signature checks in prod. Give fork PRs deploy secrets. Attack foreign CI. Hydra the router. nmap the LAN.
Right
Identify DEMO with curl -I; router login → STOP. Map YOUR update verification and CI trust; lock unsigned-ci-notes.txt. Next: Integrity of Code and Artifacts.
6. Hands-on: curl -I DEMO + unsigned-ci-notes.txt
Fill the trust map for a project YOU own or invent as hypothetical-owned.
Mission: unsigned-ci-notes.txt (mode 600)
1)2) Map update verification and CI who-can-change for a project YOU own or invent. 3) chmod 600 $HOME/cyberlium-lab/unsigned-ci-notes.txt. No ecosystem poison. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If A08 still means “hack npm,” ask for a hint — not a poison recipe. Try: "Hint only: why TLS≠signature; what CI secrets risk on fork PRs; why 192.168.0.1 router login is OUT OF SCOPE; where my trust map lives?" You still fill unsigned-ci-notes.txt.
A08 begins with proving authorship of what you run — plus an identify HEAD to the course demo URL. Original Cyberlium — not official OWASP certification. Next — Integrity of Code and Artifacts.
Knowledge Check
APPLY: Auto-update downloads a zip over HTTPS with no signature check. A08 issue?
Multiple choice
Knowledge Check
APPLY: True or False: Fork PRs should inherit production deploy secrets for “realistic CI tests.”
True or False
Knowledge Check
APPLY: curl -I of http://192.168.0.1/ is a home-router admin. Next?
Multiple choice