Description
When a package publishes signatures or build provenance attestations, they are verified at install or in the pipeline, and a package that used to publish them and stops doing so is flagged.
Rationale
Provenance ties a package to the source repository and pipeline that built it. A release pushed by hand from a stolen token typically lacks it.
Impact
Support varies by ecosystem and package. Where it is absent, this control does not apply.
Audit
- Check that available signatures and provenance are verified for ecosystems that support them.
- Check that loss of provenance on a new version is flagged.
Automated: every check must pass. Scanners report each check by its id.
postmortem
`npm audit signatures` in CI; --online: versions that dropped provenance
command: postmortem harden --json
control: CB-DEP-INV-003
coverage: partial
Remediation
- Enable signature and provenance verification in the package manager or pipeline where supported.
References
- SLSA specification v1.0 OpenSSF, standard, accessed 2026-10-16
- Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SR-4 | related | |
| NIST SP 800-53 Rev. 55.1.1 | SI-7 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 | |
| Common Weakness Enumeration | CWE-494 |
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |