Description
The lockfile records a cryptographic hash for every package, and the package manager verifies the downloaded content against it on every install. Where the ecosystem does not do this by default, hash checking is turned on explicitly.
Rationale
Hashes guarantee that what is installed today is byte-for-byte what was reviewed when the lockfile was changed, even if a registry, mirror or cache serves something else.
Impact
None known, once lockfiles contain hashes. Older lockfiles may need to be regenerated.
Audit
- Check that lockfiles contain a hash for every entry.
- Check that hash verification is not disabled in configuration or pipeline flags.
Automated: every check must pass. Scanners report each check by its id.
postmortem
a hash per package in the lockfile; config that turns verification off
command: postmortem harden --json
control: CB-DEP-LOCK-003
coverage: auto
Remediation
- Regenerate lockfiles with hashes.
- Turn on mandatory hash checking where it is optional.
References
- Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
- SLSA specification v1.0 OpenSSF, standard, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SI-7 | related | |
| NIST SP 800-53 Rev. 55.1.1 | SR-4 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1195.001 | |
| Common Weakness Enumeration | CWE-494 |
Related controls
- related
CB-DEP-LOCK-001Commit a lockfile for every deployable application
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |