A CI pipeline for a cloud service pulls third-party packages from a public repository, and the security team is concerned that a package could be tampered with between its publication and the download. Which control most directly verifies integrity and authenticity before a package is used?
Select an answer to reveal the explanation.
Short Explanation
A checksum tells you the box wasn't opened; a signature tells you who packed it. You check both before the package goes anywhere near your build, and you write it down in an SBOM. HTTPS only protects the delivery truck; it can't tell you the box was already swapped at the warehouse.
Full Explanation
Supply-chain integrity means the component is exactly what was published, and authenticity means it came from the claimed publisher. A cryptographic checksum compared against a trusted, independently obtained value detects any modification, and a digital signature verified against the publisher's known key proves origin and integrity together, because only the holder of the private key could have produced it. Recording each verified component, version and hash in a software bill of materials provides traceability, so the organization can later prove what was used and respond quickly to disclosures. Antivirus scanning after installation is late, since install scripts may already have run, and it recognizes known malware rather than verifying the package. HTTPS protects the connection between repository and pipeline from interception, but it cannot detect a package that was altered at the source, such as through a compromised maintainer account or repository; it authenticates the server, not the content's publisher. Always pulling the newest version increases exposure, because a malicious release is consumed as soon as it appears. Exam caveat: the 2026 outline adds integrity, authenticity and licensing to supply-chain management, so expect signature and SBOM concepts rather than tool names. Operational check: configure the pipeline to fail when a signature or checksum does not verify, and confirm an SBOM is produced and stored for every build.