Sign an artefact, then break each link in the chain

short · 55 min · Objective 3.5

Task

Build a signed artefact with verification at install and at run, then defeat the arrangement three ways to show where its assurance actually lives.

Steps

  1. Generate a signing key, sign an artefact, and verify it. Capture the successful verification in lab/sign-ok.txt.
  2. Modify the artefact and verify again, capturing the failure in lab/sign-tamper.txt.
  3. Demonstrate the install-versus-run gap: verify at install, then modify the installed artefact on disk and run it, capturing that it executed unverified in lab/sign-gap.txt.
  4. Close the gap -- verify at load, or make the location read-only -- and demonstrate the modified artefact now failing to run.
  5. Write lab/sign-note.md explaining why a signing key usable by the pipeline means any pipeline compromise produces validly signed artefacts, and what separates the two.

Verify

grep -Eic 'ok|good|verified|valid' lab/sign-ok.txt
grep -Eic 'bad|invalid|fail|mismatch' lab/sign-tamper.txt
grep -c . lab/sign-gap.txt
grep -Eci 'signing service|separate|policy|approval' lab/sign-note.md

A successful verification, a failed one after tampering, the install-run gap demonstrated and then closed, and the note naming a separate signing service. A signature certifies who produced an artefact, not that it is safe.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.