For a semester exam, which option is correct about secure build process?

A. building on infected machines B. letting anyone modify releases C. skipping artifact signing D. ensuring build pipelines, artifacts and dependencies are protected and reproducible