Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • Attestations supported
  • SALT components
Export as PDF
  1. Xygeni Products
  2. Build Security

SALT Architecture

PreviousSalt Command-Line ReferenceNextSALT How To…​

Last updated 8 months ago

Attestations supported

The SALT data model contains most of the in-toto specification types for software attestations, including:

  • The in-toto , common format for signed attestations.

  • The in-toto , typically as payload of an in-toto Envelope.

  • , plus the older and versions.

  • All predicates in the in-toto , including:

    • (SCAI),

    • ,

    • (VSA),

    • predicates for holding SBOM formats like and ,

    • predicate for vulnerability scanning results, and

    • predicate to express results of any type of tests.

  • The legacy in-toto and the new .

  • Xygeni specific predicates:

    • Collection, a collection of predicates. A better alternative to the in-toto for holding multiple predicates on the subjects.

    • CommandRun, a predicate with information for the execution of a command in a pipeline.Generated by the attestation run command.

    • Environment, a predicate with the system environment where the build/deploy is running.Generated by the environment attestor.

    • Git, a predicate with git data: information about last commit (sha1 hash, author and committer, message, commit signature if any), the commit parents, the git treeHash, and git refs pointing at it.Generated by the git attestor.

    • Materials, a predicate with materials (input resources) that were registered as relevant for the pipeline, by the attestation init and attestation add commands.

    • Products, a predicate with products (typically, by-products) that were generated at a certain step in a pipeline.

SALT components

Xygeni Build Security includes the following elements:

Build provenance: metadata representing details on the pipeline, when and where the build were performed, inputs (materials) and outputs (artifacts produced) at each step,

Attestation agent, an actor that runs the checks, creates attestations (signing notes based on a policy associated with the build pipeline) and publishes them in the Attestations Registry.

Attestations Registry, a store for attestations providing an api for storing, fetching and searching for attestations.This could include a transparency, append-only ledger, that acts as a tamper-evident log.

Verifier, that ensures the integrity of an artifact according to the build security policy.The verifier is a consumer of attestations required by the policy, which grabs the attestations for the Attestations Registry and ensures the validity of the attestations.The verifier can be used at enforcement points like in admission controllers.

Build Security Policy, a definition of the checks to be performed at the build & deploy pipeline, on collected attestations to produce a final verification status, conformant or not with the policy. Attestations include evidence that cannot be tampered with, and which policies may refer to.

A “deny” result can be enforced (the artifact is not allowed to run at all) or alerted (the artifact is allowed to run, but a warning notification is emitted).

Please note that the Xygeni platform helps with hardening the build & deploy infrastructure by providing other tools, like build security checks, which detect if the build system satisfies certain security requirements, or otherwise have weaknesses that might be exploited by adversaries.

There are different elements in the support infrastructure for build security:

  • An Attestation Storage/Search Service (the “ledger” that holds the generated attestations and provides security services like timestamping, integrity, transparency, non-repudiation, source authentication, search by subject or by other criteria, etc.),

  • a Signature Infrastructure (“PKI”) including key management like an external KMS and certificate authority (CA), sign/verify, transparency ledger),

  • An optional Timestamping Authority (TSA), that certifies the occurrence of certain events (like the creation/registration of a software attestation) at a given time.

  • Attestor, a logic for gathering context information about the environment or the context for the build & deploy system. There are predefined attestors for getting information from git or the build system environment.

The following image depicts the main parts of SALT.

Verification is the point where the policy based on attestations is applied. Must follow the , which stands that to be safe, the system should be designed to fail closed rather than open. If an attacker can delete or hide any attestation, the verifier must return “deny” with “required attestation not found”. So the policy must list the required attestations, and the omission of a single attestation cannot move the system to “allow”.

Envelope
Statement
SLSA Provenance v1
v0.1
v0.2
Attestation Predicates
Software Supply Chain Attribute Integrity
Runtime Traces
SLSA Verification Summary
SPDX
CycloneDX
Vulnerabilities
Test Result
Link
Link Predicate
Bundle
principle of monotonicity