A build process is the repeatable sequence of steps that prepares software for release. It should support predictable updates without depending on one person or machine, making development easier to scale and releases less disruptive. section 9.0 section 9.10
Make the process usable and resilient by documenting and reviewing:
- Each preparation step, what it does, success criteria, and how to detect failure. section 11.2.5
- The order of steps and the point at which work can be cancelled before changing the environment; document differences between patch, hot-fix, and full releases. section 11.2.5
- The configuration of any orchestration tool, such as Jenkins, so the process is not locked in one person’s knowledge. section 11.2.5
- Build protections: use a separate environment, lock third-party library versions until upgrades are validated, and investigate unexplained file-size changes. section 12.7.2
Why build security matters
The SolarWinds attack illustrates how malicious code introduced into shared software can reach many organizations through ordinary updates. Treating the build environment and its dependencies as security concerns helps reduce this exposure. section 12.7.2
