A tool to verify scripts and executables by hash to prevent supply chain attacks.
Preflight is a command-line tool that verifies the integrity of scripts and executables by comparing their cryptographic hashes against known good values. It helps prevent supply chain attacks by ensuring that downloaded code hasn't been tampered with before execution.
DevOps engineers, security teams, and developers who manage CI/CD pipelines or frequently execute scripts from external sources.
Developers choose Preflight for its simple integration into existing workflows, support for multiple hash types and lookup sources, and its focus on preventing real-world supply chain compromises with minimal overhead.
preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports SHA256, SHA1, and MD5 digests, and allows comma-separated hash lists or live URLs for handling rolling updates, as demonstrated in the examples for dealing with changing runnables.
Optional lookup with VirusTotal or file-based lists like Malshare adds an extra layer of security by flagging known malicious hashes, directly addressing supply chain threats beyond simple tampering.
Provides ready-to-use examples for GitHub Actions and Docker builds, enabling easy adoption into pipelines without major workflow changes, as shown in the secure Codecov and Istio installation guides.
Designed for custom lookup providers via pull requests, allowing teams to adapt it to specific security vendors or internal systems, though this requires Go development knowledge.
The README admits a 'chicken and egg' problem for securely obtaining Preflight itself, requiring manual compilation or sourcing from trusted locations like S3 buckets, which adds setup overhead.
Malware lookups rely on third-party services like VirusTotal, which may introduce API rate limits, costs, or privacy concerns, and file-based lists require ongoing manual updates.
While it supports multiple hashes, there is no automated system for generating, storing, or rotating hash lists; users must manually manage updates or depend on external URLs, increasing operational burden.