A secure CI/CD update workflow that combines keyless Cosign signing (OIDC/Fulcio), immutable SHA-256 digest–based image addressing, mandatory pre-deployment signature verification, and freshness controls against rollback attacks is presented, while permitting controlled rollback only to previously verified versions.
This paper presents an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification, and implements a proof-of-concept integrated with GitHub Actions and GitLab Runners that mitigates common supply-chain attacks under a realist...
N. Fotiou, Lefteris Georgiadis, Ignacio Lacalle et al.· 0 citations
This study investigates security risks in Dock-er-based GitHub Actions workflows and proposes a tailored, DevSecOps-aligned security checklist to mitigate these threats, offering practical protection against supply-chain threats while preserving delivery speed and scalability.
A. Amirova· International Journal of Wir...· 0 citations
This survey discusses secure CI/CD hardening through the practical lens of Jenkins, Bitbucket, and JFrog, treating these systems as focal platforms for pipeline orchestration, source-code governance, and artifact trust.
Ratan Raj Anandeshi· International Journal of Sci...· 0 citations
Ensuring the integrity of automotive software, from source code to deployed binaries, has become critical as vehicles increasingly rely on over-the-air (OTA) updates and complex supply chains. The Uptane framework secures OTA update delivery for automotive systems but does not enforce integrity within the upstream soft...
Iwinosa Aideyan, M. Pesé, Richard. R. Brooks· Distributed Ledger Technolog...· 0 citations
The trade-off across both planes is that the less an operator can commit to in advance, the less deterministic the resulting guarantee, down to asking a human.
Due to the emergence of strict regulatory standards such as the NIST Secure Software Development Framework (SSDF), the demand for compliance is higher. Traditional methods of implementing compliance measures are based on manual auditing and document management. This may lead to inefficiency, delayed processes, and secu...
Shuaib Ahmed· 2026 4th International Confe...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
