# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-INV-003
title: Verify provenance and signatures when the ecosystem provides them
finding:
  title: Published provenance and signatures of packages are ignored
status: draft
profiles: [hardened]
risk:
  severity: medium
assessment: partial
tags: [provenance, signature]
description: |
  When a package publishes signatures or build provenance attestations, they are verified at install or in the pipeline, and a package that used to publish them and stops doing so is flagged.
rationale: |
  Provenance ties a package to the source repository and pipeline that built it. A release pushed by hand from a stolen token typically lacks it.
impact: |
  Support varies by ecosystem and package. Where it is absent, this control does not apply.
audit:
  manual: |
    1. Check that available signatures and provenance are verified for ecosystems that support them.
    2. Check that loss of provenance on a new version is flagged.
  checks:
    - id: postmortem
      engine: postmortem
      description: "`npm audit signatures` in CI; --online: versions that dropped provenance"
      spec:
        command: postmortem harden --json
        control: CB-DEP-INV-003
        coverage: partial
remediation:
  manual: |
    1. Enable signature and provenance verification in the package manager or pipeline where supported.
references:
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-4
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-494
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16