One post tagged with "modules"

How do you know the module a run deploys is the one you trust, and not a tampered copy?

Modules get shared and reused, and along the way one can be swapped or changed, a supply chain attack that is easy to miss. A Module Attestation policy guards against this: it checks that the module a run deploys is signed by a key you trust, so a swapped or changed copy does not go unnoticed. Here is what it checks, with the steps to set one up.