Picklescan

The pickle-scan task uses picklescan to scan AI and ML model content for malicious pickle files. Python pickle serialization is common for model weights and related artifacts, and unsafe pickle data can execute arbitrary code when loaded.

Intended users

This scan is aimed at teams that release AI or ML models in Konflux, especially models that ship pickle-serialized Python content. Other teams can adopt it if their components include similar artifacts.

How the scan runs

Use the pickle-scan or pickle-scan-oci-ta Tekton task in a build pipeline that tests your model content.

Example

To add the Trusted Artifacts variant to a pipeline definition, include a task similar to the following in the tasks section. Adjust the runAfter dependencies and parameter values to match your pipeline.

- name: pickle-scan
  params:
    - name: image-digest
      value: $(tasks.build-container.results.IMAGE_DIGEST)
    - name: image-url
      value: $(tasks.build-container.results.IMAGE_URL)
    - name: SOURCE_ARTIFACT
      value: $(tasks.clone-repository-oci-ta.results.SOURCE_ARTIFACT)
  runAfter:
    - build-container
  taskRef:
    params:
      - name: name
        value: pickle-scan-oci-ta
      - name: bundle
        value: quay.io/konflux-ci/tekton-catalog/task-pickle-scan-oci-ta:0.1
      - name: kind
        value: task
    resolver: bundles
  when:
    - input: $(params.skip-checks)
      operator: in
      values:
        - "false"

The task produces a TEST_OUTPUT result that summarizes the outcome. By default it also attaches a pickle scan report to the image under test.

Picklescan findings do not gate a release by default. If you want release gating, include Picklescan in your Conforma policy.

Additional resources