Resolve all packages through an organization-controlled registry

Description

Every package install, on workstations and in build pipelines, goes through a registry or caching proxy run or controlled by the organization. Direct access to public registries is not used.

Rationale

A single entry point is where release-age rules, malicious package blocking and audit logs can be enforced for everyone at once. It also keeps builds working when a package is unpublished upstream, and gives a record of which package versions were fetched, by whom and when.

Impact

A registry proxy must be operated and kept available: if it is down, nobody can install. Package manager configuration must be distributed to every workstation and pipeline.

Audit

1. List the registry URLs configured for each ecosystem in project, user and pipeline configuration.
2. Confirm every URL points to the organization-controlled registry.
3. From a build environment, confirm that direct requests to public registries are refused or not used.

Automated: every check must pass. Scanners report each check by its id.

postmortem

a non-public registry configured per package manager; the proxy itself is not visible

command: postmortem harden --json
control: CB-DEP-SRC-001
coverage: partial

Remediation

1. Deploy a registry proxy for each ecosystem in use, or one that serves several.
2. Set it as the only registry in versioned project configuration (see CB-DEP-SRC-006).
3. Block or alert on direct access to public registries from build networks.

References

• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-SRC-006 Keep package manager configuration in the repository
• related CB-DEP-AGE-001 Wait a minimum age before installing a new package version
• related CB-DEP-VULN-002 Block packages known to be malicious
• related CB-DEP-CI-003 Limit network access of builds to approved registries

People and lifecycle