Mobile DevSecOps: the build pipeline, signing keys and release security
You secure a mobile app's road from code to store: security gates in the pipeline, dependency and SDK checks, protecting signing keys, pre-release verification, staged rollout and emergency withdrawal.
Level 401 · 18 lessons · 15 practice labs
Lessons
Pipeline and gates
- Anatomy of a mobile build pipeline
- Static gates: lint, semgrep, secret scanning
- The binary scan gate: scanning the built package
- Thresholds, exceptions and moving on without blocking the pipeline
- Pipeline secrets and runner hardening
- Short task: add secret scanning and a static scan gate to a build pipeline
Supply chain
- Dependency scanning: Gradle, CocoaPods, Swift packages, npm
- The intake process for a new SDK
- Producing an SBOM for a mobile app
- Dependency pinning and verification
- Build provenance and reproducibility
- Short task: find the newly added risky library from the SBOM diff of two versions
Signing and release
- Signing key management: upload key, store signing, backup
- iOS signing assets: protecting certificates and profiles in the pipeline
- Pre-release verification: signature, debug flag, test endpoints
- Staged rollout, forced update and the kill switch
- Short task: write a script that checks the signature and release settings of a package declared ready
Capstone
- Capstone: secure the build pipeline of a retail app end to end
Practice labs
- Find the security steps in a pipeline definition: List the gates present and missing.
- Add secret scanning and a static scan gate to the pipeline: Add the two gates in the lab CI and show they stop a faulty change.
- Add a binary gate that scans the built package: Write the step that sends the built APK to the static scanner and stops the pipeline when the threshold is crossed.
- Find the secret printed openly in a pipeline log: Show the unmasked value in the run log.
- Move pipeline secrets to protected variables: Move a signing password written in the repository to a secret variable reachable only on the release branch.
- Harden the runner and turn on branch protection: Add the setting that cleans leftover files on a shared runner, block direct pushes to the release branch and verify.
- Run the dependency scan and read the result: Find the library with a high-severity flaw.
- Produce an SBOM for the app: Generate the SBOM from the build and summarise component count and licences.
- Find the risky library from the SBOM diff of two versions: Produce the diff, assess the new library against the SDK intake criteria and write the decision.
- Find where the signing key lives: Search the repository and pipeline settings for the keystore file and its password.
- Write a signing step that takes the key from the vault: Remove the keystore from the repository and sign in a pipeline step that fetches it from the vault stub.
- Audit how iOS signing assets are protected in the pipeline: Examine how the certificate and profile are loaded in the pipeline definition, find the exposed file and write the corrected definition.
- Check a release package's signature and debug flag: Run both checks from the command line.
- Write a script that checks release settings: Prepare a script that checks signature, debug flag, test addresses and cleartext permission.
- Secure a retail app's pipeline end to end: Add the gates, vault signing and release check to the Turnalı Perakende pipeline and write the staged rollout and withdrawal plan.
About this course
You secure a mobile app's road from code to store: security gates in the pipeline, dependency and SDK checks, protecting signing keys, pre-release verification, staged rollout and emergency withdrawal.
What you will learn
- Pipeline and gates
- Supply chain
- Signing and release
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.