Supply Chain Compliance

Go modules are pinned with cryptographic hashes in go.sum. GitHub Actions are pinned by full commit SHA, not floating tags. Helm chart dependencies use explicit versions.

Renovate continuously monitors for dependency updates. Security patches are auto-merged for Go minor/patch updates and GitHub Actions patch updates, keeping the supply chain current.

A scheduled workflow runs every day at 02:00 UTC, re-scanning all images for newly disclosed vulnerabilities.

Copa patches fixable OS-level vulnerabilities in-place without rebuilding images, then signs and attests the result.

When new vulnerabilities are found, a pull request is created automatically with updated patched images for review.

All changes flow through pull requests with CI gates. Scheduled scans create PRs rather than modifying main directly. Every published artifact has provenance linking it to a specific commit and workflow run.

Daily vulnerability scans detect new CVEs across all published images. Trivy reports are retained for 30 days as workflow artifacts, providing continuous monitoring evidence.

Workflows use scoped GITHUB_TOKEN permissions with least-privilege (e.g. packages: write only where needed). No long-lived credentials or static API keys.

Cryptographic signatures and attestations verify that artifacts have not been altered between build and deployment. Consumers can independently validate integrity.

Upstream images are continuously scanned and patched. All dependencies are pinned with cryptographic hashes and automatically updated by Renovate. SBOM attestations provide full component visibility.

Automated CI with linting, testing, and vulnerability scanning gates. No artifact can be published without passing the full pipeline on GitHub-hosted runners.

Vulnerability scanning enforces OS-level security requirements on every container image. Copa patches fixable CVEs before artifacts reach the registry.

Third-party chart dependencies and upstream images are treated as untrusted inputs — scanned, patched, re-signed, and attested before publication under the Verity identity.

All components come from known, trusted sources. Dependencies are pinned by hash, not by mutable tag. Renovate monitors for outdated or vulnerable packages and creates PRs automatically.

Consumers can verify that every artifact was built by the Verity pipeline and has not been modified, using cosign signature verification and GitHub attestation checks.

Build processes are scripted and reproducible on ephemeral CI runners. No manual steps, no local builds, no self-hosted infrastructure. Provenance attestations link every artifact to its build definition.

NIST CSF 2.0 added supply chain risk management as a governance function. Verity addresses this through provenance attestation, dependency pinning, continuous scanning, and cryptographic signing of all published artifacts.

CISA's Secure by Design pledge calls for transparency in vulnerability disclosure and software composition. Verity publishes vulnerability scan results, attaches SBOMs to every image, and makes all verification publicly accessible via Rekor.