أمان سلسلة التوريد

في هذا الدرس

understand attacks on how software is built and delivered, and the controls.

الموضوعات المخطط لها

• Risks: typosquatting (a look-alike package name), dependency confusion, compromised maintainers, compromised build systems.
• Controls: lock and verify dependencies, use an internal artifact proxy, least-privilege pipelines, protected branches.
• Sign artifacts and images (for example Sigstore cosign) and keep provenance (who built what, from which commit); SLSA is a framework for levels of assurance. Verify tool details before recording.
• Verify signatures at deploy time with an admission policy.