# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-LOCK-002
title: Install from the lockfile without modifying it in builds
finding:
  title: Builds may resolve versions different from the lockfile
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [lockfile, ci]
description: |
  Pipelines and release builds install dependencies in the package manager's frozen or locked mode: they install exactly what the lockfile lists and fail if the manifest and lockfile disagree, instead of updating the lockfile.
rationale: |
  A lockfile only protects the build if the build is forced to follow it. In default mode, several package managers quietly re-resolve and rewrite the lockfile.
impact: |
  Builds fail when someone forgets to update the lockfile. That is the intended behaviour.
audit:
  manual: |
    1. Review the install step of each pipeline.
    2. Check it uses the frozen or locked install mode and that a manifest/lockfile mismatch fails the build.
  checks:
    - id: postmortem
      engine: postmortem
      description: "install commands in pipelines and Dockerfiles use frozen / locked mode"
      spec:
        command: postmortem harden --json
        control: CB-DEP-LOCK-002
        coverage: auto
remediation:
  manual: |
    1. Switch the install step of every pipeline to the package manager's frozen or locked mode.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: CM-2
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-LOCK-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16