This brand new feature is intended to create trust in your software delivery pipelines so you can ensure that any artifact that progresses through your pipeline, or that for example gets deployed or promoted, is an artifact that was created by the pipeline and wasn’t tampered with. So creating tamper-proof pipelines is a major security goal of this feature.
For example, you could have a development pipeline that creates a build or an artifact, and then a developer working on his local machine tries to fix an issue and overwrites the artifact. Eventually the next pipeline takes this artifact and promotes it. We want to detect these scenarios and empower organizations to stop the pipeline if this happens. In my example, the developer’s intentions were benign, but Signed Pipelines will also help you block pipeline actions when someone tampers with malicious intent. It’s repudiation through the use of metadata.
The second main benefit of Signed Pipelines is the traceability. We create a pipeInfo.json which has the entire trace for all the runs, and everything that happened to an artifact from the time the code was committed to the time the code was deployed. So you have complete traceability for all your artifacts. You know where they’ve been, who’s worked on them, where they were deployed, all the tests and so on and so forth.