MODULE 1
Trust Travels from Source to Runtime
Map developers, repositories, workflows, runners, registries, deployers, and workloads as one chain of authority.
FREE COURSE / SELF-PACED LEARNING
Software Supply Chain Detection Reasoning
Learn to trace trust across CI/CD, build runners, artifacts and Kubernetes in this free course on supply-chain detection reasoning.
Read freely. Create an account to save your completed lessons.
- Experience level
- Advanced
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 9 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Trace authority across repository, runner, artifact, registry and deployment boundaries.
- Explain what signatures and provenance prove, and what requires independent authorization evidence.
Is this the right course for you?
Who it’s for
Detection practitioners with basic CI/CD and security knowledge.
Scope and boundaries
Detection evidence across source, build and runtime. For component controls and secure release foundations, start with Software Supply Chain Security Foundations.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Follow trust and identity from developer to source, workflow, runner, artifact, registry, deployment, Kubernetes control plane, and runtime. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
A valid signature on an unexpected release
A release is signed by the normal build identity. Its provenance points to an unexpected workflow revision, and the release ticket names a different source commit.
Your task
List the records to preserve and explain why a valid signature does not resolve the release discrepancy.
Compare your reasoning
The signature can support integrity and signer claims under its verification assumptions. It does not establish that the workflow revision or source selection was authorized. Preserve the artifact digest, verified signature, provenance, workflow revision and release ticket. Resolve their relationship through the authorized release process; avoid either approving the artifact solely because it is signed or declaring compromise from an unexplained mismatch alone.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Authorized Features Can Carry Unauthorized Change
Detect consequential state changes even when attackers use valid accounts and normal platform capabilities.
MODULE 3
Provenance Strengthens a Claim Without Making It Absolute
Use artifact identity, builder claims, verification policy, and deployment evidence without treating a signature as proof of benign intent.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.