Rules / GL045

GL045 Release job without artifact signing

Severity: warn
OWASP: CICD-SEC-9 – Improper Artifact Integrity Validation
CWE: CWE-494 – Download of Code Without Integrity Check

Risk

Release and publish jobs that push artifacts (container images, packages, binaries) without cryptographically signing them leave consumers with no way to verify that what they download matches what was built. An attacker who compromises the registry or distribution channel can substitute tampered artifacts without detection.

What is flagged

Jobs whose name or stage: contains a release/publish keyword (release, publish, deploy, push, upload, dist) and whose script contains a known push command but no signing command.

Push commands detected:

Command	Tool
`docker push`	Docker
`crane push`	Google crane
`helm push`	Helm OCI
`twine upload`	Python / PyPI
`cargo publish`	Rust / crates.io
`npm publish`	Node.js / npm
`goreleaser release`	GoReleaser

Signing commands that suppress the finding:

Command	Tool
`cosign sign`	Sigstore cosign
`gpg --detach-sign` / `gpg -b`	GPG
`notation sign`	Notary v2
`slsa-verifier`	SLSA

Signing commands in before_script:, after_script:, or a run: step also count.

Trigger example

publish:
  stage: release
  script:
    - docker build -t registry.example.com/app:$CI_COMMIT_TAG .
    - docker push registry.example.com/app:$CI_COMMIT_TAG
    # no signing step

Safe alternative

publish:
  stage: release
  script:
    - docker build -t registry.example.com/app:$CI_COMMIT_TAG .
    - docker push registry.example.com/app:$CI_COMMIT_TAG
    - cosign sign --key $COSIGN_KEY registry.example.com/app:$CI_COMMIT_TAG

Notes

Detection is heuristic: jobs that push to internal or staging registries may be flagged even if signing is not required there
GoReleaser can sign artifacts via its own config (.goreleaser.yml) without an explicit script command — such configurations will be flagged since glsec only analyses the CI YAML
Jobs that do not match a release keyword in their name or stage are not checked, even if they contain push commands

Documentation for glsec 1.23.0. Source of this page · Rule implementation