https://linuxeries.org/tags/devops/ Recent content in Devops on ShieldedBytes Hugo en Tue, 10 Nov 2026 11:30:34 +0200 https://linuxeries.org/post/2026-11-10-when-your-ci-pipeline-ignores-artifact-signat/ Tue, 10 Nov 2026 11:30:34 +0200 https://linuxeries.org/post/2026-11-10-when-your-ci-pipeline-ignores-artifact-signat/ <h2 id="why-a-missing-gpg-check-is-a-silent-vulnerability">Why a Missing GPG Check is a Silent Vulnerability</h2> <p>When a CI pipeline builds a Docker image, compiles a binary, or packages a Helm chart, it usually writes the result to an artifact store. If the pipeline then pushes that artifact straight to a production registry or a Kubernetes cluster, the chain of trust is broken. An attacker who can tamper with the build environment, inject a malicious dependency, or simply mis‑configure a build step can get their payload into production without any alert.</p>