Default branch does not require signed commits

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_206
Category	IAM
Severity	LOW

Impact

Unsigned commits in GitHub present significant risks, including compromising code integrity and introducing uncertainty regarding authorship. If an attacker gains unauthorized access to a developer's account, they could impersonate the developer and make malicious code commits undetected. The absence of signed commits makes it exceedingly difficult to distinguish between fraudulent and legitimate commits.

Recommended Solution - Buildtime

It is recommended configuring a rule requiring the use of signed commits on the default branch:

1. In GitHub, browse to the repository Settings > select Branches under Code and automation.

2. Select Add a branch protection rule (or edit an existing one) on the relevant branch > Check the Require signed commits under Protect matching branches > Create.

To create a branch protection rule refer to https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule#creating-a-branch-protection-rule.

For additional information about signed commits refer to https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-signed-commits.