Sign an artefact, then break each link in the chain
Task
Build a signed artefact with verification at install and at run, then defeat the arrangement three ways to show where its assurance actually lives.
Steps
- Generate a signing key, sign an artefact, and verify it. Capture the successful verification in
lab/sign-ok.txt. - Modify the artefact and verify again, capturing the failure in
lab/sign-tamper.txt. - Demonstrate the install-versus-run gap: verify at install, then modify the installed artefact on disk and run it, capturing that it executed unverified in
lab/sign-gap.txt. - Close the gap -- verify at load, or make the location read-only -- and demonstrate the modified artefact now failing to run.
- Write
lab/sign-note.mdexplaining why a signing key usable by the pipeline means any pipeline compromise produces validly signed artefacts, and what separates the two.
Verify
grep -Eic 'ok|good|verified|valid' lab/sign-ok.txt
grep -Eic 'bad|invalid|fail|mismatch' lab/sign-tamper.txt
grep -c . lab/sign-gap.txt
grep -Eci 'signing service|separate|policy|approval' lab/sign-note.md
A successful verification, a failed one after tampering, the install-run gap demonstrated and then closed, and the note naming a separate signing service. A signature certifies who produced an artefact, not that it is safe.
This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.