The signed artifact from the wrong build

A fork-produced artifact has a valid signature and reaches a production approval queue. Define which build context is trusted, then enforce that policy on verified metadata.

AppSec · about 60 minutes. Fictional evidence; Python 3.10+ for local coding.

Prerequisites

Evidence

candidate.json

{
  "signature_verified": true,
  "issuer": "https://token.actions.githubusercontent.com",
  "repository": "fork/billing",
  "workflow": ".github/workflows/pr.yml",
  "source_ref": "refs/heads/feature",
  "event": "pull_request",
  "environment": "preview",
  "artifact_digest": "bbbb... (64 hex characters)"
}
This is already-verified synthetic metadata, not an unsigned payload to trust directly.

production-policy.txt

Only verifier-produced metadata may enter the gate.
Signature result must be boolean true.
Expected issuer: https://token.actions.githubusercontent.com
Repository: acme/billing
Workflow: .github/workflows/release.yml
Source ref: refs/heads/main; event: push; environment: production
Artifact digest must equal the separately approved digest (64 lowercase hex characters).
The deployer must consume those exact immutable bytes, not a mutable tag.
Claim names here are a simplified contract, not a portable attestation schema.

gate.py

def release_allowed(verified_metadata):
    return bool(verified_metadata.get("signature_verified"))

# Later: deploy("registry.example.test/billing:latest")
# A signature check alone neither constrains the builder nor binds this tag.

Tasks and expected evidence

  1. Identify two separate gaps: trusting an unexpected build identity and deploying bytes that are not bound to the reviewed digest.
  2. Edit release_allowed. Deny missing or incorrect verified claims and mismatched digests while allowing the approved build.
  3. Run the release suite without --reference. Map each policy field to a rejected mutation and save the result.
  4. Describe how a real verifier supplies authenticated claims and how the deployment job selects the exact approved digest. Include one compromise scenario this gate cannot prevent.

Run the coding exercise

Download the Python exercise. It uses only the standard library and no network.

python expert_security_lab.py --lab release
python expert_security_lab.py --lab release --reference

Starter mode initially fails. Edit the matching function and rerun without --reference. Reference mode tests supplied code, not your own fix.

Limits

This exercise evaluates a simplified policy on already-verified metadata. It does not verify an OIDC token, certificate, signature, SLSA predicate, registry, or cloud deployment.

All expert cases