Data confidence and software development operations
A data confidence fabric for generating data confidence scores for a build pipeline is disclosed. Confidence scores are generated for data or jobs in a build pipeline. The scores may be combined into a final confidence score that reflects a confidence in the artifact generated by the pipeline and in the pipeline. A user or infrastructure may or may not perform the artifact based on the associated confidence score.
1 . A method comprising:
for each stage of a pipeline that includes two or more of a development stage, a build stage, a test stage, and a deploy stage:
executing the stage of the pipeline for a code portion;
for each job performed on the code portion in the stage, generating job-specific confidence information, wherein the confidence information includes a plurality of annotations produced using two or more heterogeneous trust insertion technologies selected from static code analysis, dependency auditing, cryptographic signing, and runtime environment verification
cryptographically linking each instance of the confidence information to a unique identifier for the job and the code portion; and
storing the confidence information and corresponding metadata in an immutable blockchain-based ledger maintained by a data confidence fabric, wherein the data confidence fabric is integrated with each of the pipeline stages and configured to collect, timestamp, and store the confidence information in real time; and
generating a final confidence score for an artifact generated by the pipeline from the code portion, wherein:
the final confidence score includes job-specific confidence scores for each of the jobs performed on the code portion across the stages, and
the final confidence score is computed using a weighted function over the job-specific confidence scores and a validity check of the corresponding cryptographically linked provenance records.
2 . The method of claim 1 , wherein, for the development stage, the job includes one or more of receiving the code portion from a developer and storing the code portion in a repository, wherein generating job-specific confidence information includes generating confidence information for performing a security analysis on the code portion and generating confidence information related to storing the code portion in the repository.
3 . The method of claim 1 , wherein, for the build stage, the job includes one or more of retrieving the code portion from the repository, comparing the retrieved code portion to the code portion in the repository prior to compilation, and compiling the code portion, further comprising generating job-specific confidence information for retrieving the code portion, for comparing the code portion, and for compiling the code portion.
4 . The method of claim 1 , wherein, for the test stage, the job includes one or more of performing unit tests or testing the compiled code portion, further comprising generating job-specific confidence information for performing the unit tests and for testing the compiled code portion.
5 . The method of claim 1 , wherein, for the deploy stage, the job includes one or more of generating an artifact, signing the artifact, and publishing the artifact, further comprising generating job-specific confidence information for generating the artifact, generating confidence information for signing the artifact, and generating confidence information for publishing the artifact.
6 . The method of claim 1 , wherein the final confidence score includes job-specific confidence scores for multiple jobs performed on the code portion at multiple stages.
7 . The method of claim 1 , wherein the final confidence score is associated with annotations that describe trust insertions performed on the code portion.
8 . The method of claim 7 , further comprising determining whether to execute the artifact in an infrastructure based on the final confidence score and/or the annotations.
9 . The method of claim 8 , further comprising performing an audit of the pipeline.
10 . The method of claim 8 , wherein the artifact is at least one of an application, an image, an executable, a binary, or is packaged based on a programming language and/or an execution environment.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
for each stage of a pipeline that includes two or more of a development stage, a build stage, a test stage, and a deploy stage:
executing the stage of the pipeline for a code portion;
for each job performed on the code portion in the stage, generating job-specific confidence information, wherein the confidence information includes a plurality of annotations produced using two or more heterogeneous trust insertion technologies selected from static code analysis, dependency auditing, cryptographic signing, and runtime environment verification;
cryptographically linking each instance of the confidence information to a unique identifier for the job and the code portion; and
storing the confidence information and corresponding metadata in an immutable blockchain-based ledger maintained by a data confidence fabric wherein the data confidence fabric is integrated with each of the pipeline stages and configured to collect, timestamp, and store the confidence information in real time;
generating a final confidence score for an artifact generated by the pipeline from the code portion, wherein:
the final confidence score includes job-specific confidence scores for each of the jobs performed on the code portion across the stages, and
the final confidence score is computed using a weighted function over the job-specific confidence scores and a validity check of the corresponding cryptographically linked provenance records.
12 . The non-transitory storage medium of claim 11 , wherein, for the development stage, the job includes one or more of receiving the code portion from a developer and storing the code portion in a repository, wherein generating job-specific confidence information includes generating confidence information for performing a security analysis on the code portion and generating confidence information related to storing the code portion in the repository.
13 . The non-transitory storage medium of claim 11 , wherein, for the build stage, the job includes one or more of retrieving the code portion from the repository, comparing the retrieved code portion to the code portion in the repository prior to compilation, and compiling the code portion, further comprising generating job-specific confidence information for retrieving the code portion, for comparing the code portion, and for compiling the code portion.
14 . The non-transitory storage medium of claim 11 , wherein, for the test stage, the job includes one or more of performing unit tests or testing the compiled code portion, further comprising generating job-specific confidence information for performing the unit tests and for testing the compiled code portion.
15 . The non-transitory storage medium of claim 11 , wherein, for the deploy stage, the job includes one or more of generating an artifact, signing the artifact, and publishing the artifact, further comprising generating job-specific confidence information for generating the artifact, generating confidence information for signing the artifact, and generating confidence information for publishing the artifact.
16 . The non-transitory storage medium of claim 11 , wherein the final confidence score includes job-specific confidence scores for multiple jobs performed on the code portion at multiple stages.
17 . The non-transitory storage medium of claim 11 , wherein the final confidence score is associated with annotations that describe trust insertions performed on the code portion.
18 . The non-transitory storage medium of claim 17 , further comprising determining whether to execute the artifact in an infrastructure based on the final confidence score and/or the annotations.
19 . The non-transitory storage medium of claim 18 , further comprising performing an audit of the pipeline.
20 . The non-transitory storage medium of claim 18 , wherein the artifact is at least one of an application, an image, an executable, a binary, or is packaged based on a programming language and/or an execution environment.