# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-EXEC-002
title: Prefer prebuilt packages over packages built from source at install
finding:
  title: Installing a dependency runs its build code on the machine
status: draft
profiles: [hardened]
risk:
  severity: medium
assessment: partial
tags: [install-scripts, build]
description: |
  Where the ecosystem offers both, prebuilt distributions are installed instead of source distributions that execute a build script at install time. Source builds are allowed only for listed packages.
rationale: |
  Building from source at install time is install-time code execution, even in ecosystems that have no explicit lifecycle scripts.
impact: |
  Some packages only ship sources for some platforms and must be listed or built once and published to the private registry.
audit:
  manual: |
    1. Check that configuration prefers or requires prebuilt distributions.
    2. Review the list of packages allowed to build from source.
  checks:
    - id: postmortem
      engine: postmortem
      description: "Python: no-build / only-binary, and locked packages that ship no wheel"
      spec:
        command: postmortem harden --json
        control: CB-DEP-EXEC-002
        coverage: auto
remediation:
  manual: |
    1. Require prebuilt distributions in committed configuration.
    2. Build the remaining packages once in a controlled pipeline and publish them to the private registry.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-829
related_controls:
  - id: CB-DEP-EXEC-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16