# Ensure Require and Verify Digital Signatures on Build Metadata

- Source: https://support.icompaas.com/support/solutions/articles/62000235006-ensure-require-and-verify-digital-signatures-on-build-metadata
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
All metadata generated during the build process—such as build logs, configuration files, and artifact manifests—must be digitally signed by authorized build systems or personnel. This signed metadata should be verified before deployment or release to ensure its authenticity and integrity.

**Rationale:**  
Requiring and verifying signed build metadata prevents tampering and unauthorized modifications during the software build lifecycle. It establishes trust in the build artifacts and supports traceability, compliance, and forensic investigations in case of incidents.

**Impact:****Pros:**

-   Enhances integrity and authenticity of build information.  
      
    
-   Prevents malicious or accidental alteration of build data.  
      
    
-   Supports compliance and audit requirements.  
      
    
-   Facilitates reliable software supply chain security.  
      
    

**Cons:**

-   Introduces additional steps in build and release workflows.  
      
    
-   Requires management of signing keys and verification tools.  
      
    

**Default value:**  
Many build environments do not sign or verify build metadata by default, risking undetected tampering.

**Audit:**  
Review build pipelines and artifact repositories for evidence of metadata signing and verification. Inspect key management and access control related to signing processes.

**Remediation:**  
Integrate digital signing of build metadata into automated build pipelines. Implement verification steps before artifact deployment. Train build and release teams on key management and signing procedures.

**References:**

1.  The Update Framework (TUF): [https://theupdateframework.io/](https://theupdateframework.io/)
    
2.  Software Package Data Exchange (SPDX): [https://spdx.dev/](https://spdx.dev/)
    
3.  CIS Controls v8, Control 4 - Secure Configuration of Enterprise Assets and Software: [https://www.cisecurity.org/controls/secure-configuration-of-enterprise-assets-and-software/](https://www.cisecurity.org/controls/secure-configuration-of-enterprise-assets-and-software/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.