security-review-owasp-software-supply-chain-security

Reviewing CI/CD pipeline supply chain security involves assessing build integrity, provenance, artifact signing, SBOM generation, and dependency trust to identify bypass paths and tamper detection weaknesses before release.

Software supply chain security prevents untrusted changes or dependencies from reaching release. Provenance protects it by providing evidence-based attestation of build integrity, allowing verification of artifact origin and tamper detection across the release chain.

Yes, you can check source control and branch protection for bypass paths by evaluating identity controls and promotion paths, ensuring untrusted changes cannot circumvent security gates before reaching the release pipeline.

An SBOM is required for dependency governance review because it provides the evidence-based inventory needed to assess dependency trust, verify artifact signing, and detect unauthorized components across the release chain.

The best way to verify artifact signing and build integrity is through evidence-based assessment of provenance, signing practices, and tamper detection controls across the release chain, ensuring only trusted build outputs reach promotion.