Verifying integrity and secure operations of cloud-based software services
A method for creating a build product including receiving from an application build request from a user, the build request including an application source code and a list of third-party packages, defining a plurality of third-party packages. The method further includes sending a build request to a build server, receiving a first acknowledgment from the build server, receiving the plurality of third-party packages, defining received third-party packages, building an application image from the application source code and the received third-party packages, defining a container image, and sending the container image to a verification server.
1. A method for creating a build product comprising:
receiving from an application build request from a user, the build request comprising:
an application source code; and
a list of third-party packages, defining a plurality of third-party packages;
sending a build request to a build server;
receiving a first acknowledgment from the build server;
receiving the plurality of third-party packages, defining received third-party packages;
building an application image from the application source code and the received third-party packages, defining a container image; and
sending the container image to a verification server.
2. The method of claim 1 wherein the first acknowledgment comprises an indication that at least one build coin has been consumed.
3. The method of claim 1 further comprising:
downloading the plurality of third-party packages from a third-party package repository, defining downloaded third-party packages;
hashing each package of the downloaded third-party packages, defining a plurality of hashing values;
sending the plurality of hashing values to the build server; and
receiving a second acknowledgment from the build server.
4. The method of claim 3 wherein the second acknowledgment comprises an indication that hashing values generated by the build server match the plurality of hashing values.
5. The method of claim 1 wherein the received third-party packages have been encrypted with a public key, defining encrypted received third-party packages, the method further comprising decrypting the encrypted received third-party packages with a private key, the decryption generating the received third-party packages.
6. The method of claim 1 further comprising signing the container image with a private key.
7. The method of claim 6 further comprising sending a request to launch the container image to the build server.
8. A method for creating a build product comprising:
receiving from an application build request from a user, the build request comprising:
an application source code; and
a list of third-party packages, defining a plurality of third-party packages;
sending a build request to a build server;
receiving a first acknowledgment from the build server comprising an indication that at least one build coin has been consumed;
downloading the plurality of third-party packages from a third-party package repository, defining downloaded third-party packages;
hashing each package of the downloaded third-party packages, defining a plurality of hashing values;
sending the plurality of hashing values to the build server; and
receiving a second acknowledgment from the build server;
receiving the plurality of third-party packages, defining received third-party packages;
building an application image from the application source code and the received third-party packages, defining a container image; and
sending the container image to a verification server.
9. The method of claim 8 wherein the second acknowledgment comprises an indication that hashing values generated by the build server match the plurality of hashing values.
10. The method of claim 8 wherein the received third-party packages have been encrypted with a public key, defining encrypted received third-party packages, the method further comprising decrypting the encrypted received third-party packages with a private key, the decryption generating the received third-party packages.
11. The method of claim 8 further comprising signing the container image with a private key.
12. The method of claim 11 further comprising sending a request to launch the container image to the build server.
13. A method for creating a build product comprising:
receiving from an application build request from a user, the build request comprising:
an application source code; and
a list of third-party packages, defining a plurality of third-party packages;
sending a build request to a build server;
receiving a first acknowledgment from the build server;
receiving the plurality of third-party packages that have been encrypted with a public key, defining encrypted received third-party packages;
decrypting the encrypted received third-party packages with a private key, the decryption generating received third-party packages;
building an application image from the application source code and the received third-party packages, defining a container image;
signing the container image with a private key; and
sending the container image to a verification server.
14. The method of claim 13 wherein the first acknowledgment comprises an indication that at least one build coin has been consumed.
15. The method of claim 13 further comprising:
downloading the plurality of third-party packages from a third-party package repository, defining downloaded third-party packages;
hashing each package of the downloaded third-party packages, defining a plurality of hashing values;
sending the plurality of hashing values to the build server; and
receiving a second acknowledgment from the build server.
16. The method of claim 15 wherein the second acknowledgment comprises an indication that hashing values generated by the build server match the plurality of hashing values.
17. The method of claim 13 further comprising sending a request to launch the container image to the build server.