# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-LOCK-003
title: Verify package integrity against recorded hashes
finding:
  title: Downloaded packages are not checked against a known hash
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [lockfile, integrity]
description: |
  The lockfile records a cryptographic hash for every package, and the package manager verifies the downloaded content against it on every install. Where the ecosystem does not do this by default, hash checking is turned on explicitly.
rationale: |
  Hashes guarantee that what is installed today is byte-for-byte what was reviewed when the lockfile was changed, even if a registry, mirror or cache serves something else.
impact: |
  None known, once lockfiles contain hashes. Older lockfiles may need to be regenerated.
audit:
  manual: |
    1. Check that lockfiles contain a hash for every entry.
    2. Check that hash verification is not disabled in configuration or pipeline flags.
  checks:
    - id: postmortem
      engine: postmortem
      description: "a hash per package in the lockfile; config that turns verification off"
      spec:
        command: postmortem harden --json
        control: CB-DEP-LOCK-003
        coverage: auto
remediation:
  manual: |
    1. Regenerate lockfiles with hashes.
    2. Turn on mandatory hash checking where it is optional.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-7
    relation: related
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-494
related_controls:
  - id: CB-DEP-LOCK-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16