# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-LOCK-001
title: Commit a lockfile for every deployable application
finding:
  title: Applications are built without a lockfile
  description: Each build resolves dependencies again and may silently pick up a new, possibly malicious, version.
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [lockfile, reproducibility]
description: |
  Every application, service or other deployable artifact commits the lockfile produced by its package manager, listing the exact version of every direct and transitive dependency.
rationale: |
  Without a lockfile, the dependency tree is decided at build time by whatever the registry serves that minute. Two builds of the same commit can differ, and a new malicious release is picked up automatically.
impact: |
  Lockfile changes must be reviewed like code. Merge conflicts in lockfiles are more frequent.
notes: |
  Libraries published for others to consume may leave the lockfile out of the published package, but should still commit it for their own tests and builds.
audit:
  manual: |
    1. List deployable projects.
    2. Check each one has a committed, up-to-date lockfile for every ecosystem it uses.
  checks:
    - id: postmortem
      engine: postmortem
      description: "every manifest has its lockfile, committed"
      spec:
        command: postmortem harden --json
        control: CB-DEP-LOCK-001
        coverage: auto
remediation:
  manual: |
    1. Generate the lockfile with the package manager and commit it.
    2. Remove lockfiles from ignore rules.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-2
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-1357
related_controls:
  - id: CB-DEP-LOCK-002
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16