# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-SRC-001
title: Resolve all packages through an organization-controlled registry
finding:
  title: Packages are downloaded directly from public registries
  description: Builds and workstations pull packages straight from the internet. The organization cannot block, delay or audit what enters its software.
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [registry, proxy]
description: |
  Every package install, on workstations and in build pipelines, goes through a registry or caching proxy run or controlled by the organization. Direct access to public registries is not used.
rationale: |
  A single entry point is where release-age rules, malicious package blocking and audit logs can be enforced for everyone at once. It also keeps builds working when a package is unpublished upstream, and gives a record of which package versions were fetched, by whom and when.
impact: |
  A registry proxy must be operated and kept available: if it is down, nobody can install. Package manager configuration must be distributed to every workstation and pipeline.
audit:
  manual: |
    1. List the registry URLs configured for each ecosystem in project, user and pipeline configuration.
    2. Confirm every URL points to the organization-controlled registry.
    3. From a build environment, confirm that direct requests to public registries are refused or not used.
  checks:
    - id: postmortem
      engine: postmortem
      description: "a non-public registry configured per package manager; the proxy itself is not visible"
      spec:
        command: postmortem harden --json
        control: CB-DEP-SRC-001
        coverage: partial
remediation:
  manual: |
    1. Deploy a registry proxy for each ecosystem in use, or one that serves several.
    2. Set it as the only registry in versioned project configuration (see CB-DEP-SRC-006).
    3. Block or alert on direct access to public registries from build networks.
references:
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
  - framework: iso27001-2022
    framework_version: '2022'
    id: A.5.21
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-SRC-006
    type: related
  - id: CB-DEP-AGE-001
    type: related
  - id: CB-DEP-VULN-002
    type: related
  - id: CB-DEP-CI-003
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16