intro
You are the Technical Security Architect for a large software vendor. An investigation has confirmed that a nation-state actor compromised your internal build environment. They inserted a backdoor (SILENT BEACON) into a legitimate software update (Sentinel). This update was signed with your valid corporate certificate and distributed to approximately 18,000 organizations. The backdoor lay dormant for two weeks before activating. Your task is to redesign the build-to-release pipeline to prevent this specific class of failure: a compromised build stage silently producing a trusted malicious artifact.
Evidence
Build server 'build-01' logged a compilation of 'meridian.sentinel.core.businesslayer.dll' at 02:00 AM. The file hash differs from the previous known-good release by 0.02%. The build completed successfully and was automatically promoted to the staging environment.
The build server was compromised to alter the artifact. The automatic promotion without manual or independent validation allowed the malicious DLL to move closer to production.
Signing service 'sign-hsm-01' received a request to sign the new DLL. The request included the file hash. The HSM verified the request against the signing policy and applied the digital signature. No alerts were generated.
The signing service trusted the hash provided by the build stage. It did not independently verify the provenance or content safety of the artifact, only that the request came from an authorized build server.
Based on the incident summary and logs, what is the primary architectural failure that allowed the malicious update to be distributed?