Install from the lockfile without modifying it in builds

Description

Pipelines and release builds install dependencies in the package manager's frozen or locked mode: they install exactly what the lockfile lists and fail if the manifest and lockfile disagree, instead of updating the lockfile.

Rationale

A lockfile only protects the build if the build is forced to follow it. In default mode, several package managers quietly re-resolve and rewrite the lockfile.

Impact

Builds fail when someone forgets to update the lockfile. That is the intended behaviour.

Audit

1. Review the install step of each pipeline.
2. Check it uses the frozen or locked install mode and that a manifest/lockfile mismatch fails the build.

Automated: every check must pass. Scanners report each check by its id.

postmortem

install commands in pipelines and Dockerfiles use frozen / locked mode

command: postmortem harden --json
control: CB-DEP-LOCK-002
coverage: auto

Remediation

1. Switch the install step of every pipeline to the package manager's frozen or locked mode.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
• SLSA specification v1.0 OpenSSF, standard, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-LOCK-001 Commit a lockfile for every deployable application

People and lifecycle