Prefer prebuilt packages over packages built from source at install

Description

Where the ecosystem offers both, prebuilt distributions are installed instead of source distributions that execute a build script at install time. Source builds are allowed only for listed packages.

Rationale

Building from source at install time is install-time code execution, even in ecosystems that have no explicit lifecycle scripts.

Impact

Some packages only ship sources for some platforms and must be listed or built once and published to the private registry.

Audit

1. Check that configuration prefers or requires prebuilt distributions.
2. Review the list of packages allowed to build from source.

Automated: every check must pass. Scanners report each check by its id.

postmortem

Python: no-build / only-binary, and locked packages that ship no wheel

command: postmortem harden --json
control: CB-DEP-EXEC-002
coverage: auto

Remediation

1. Require prebuilt distributions in committed configuration.
2. Build the remaining packages once in a controlled pipeline and publish them to the private registry.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-EXEC-001 Block install-time scripts except for an allowlist

People and lifecycle