Declare dependencies only from a registry

Description

Production dependencies are declared as named, versioned packages from an approved registry. Direct archive URLs, source repository references and local paths are not used, except under a documented and reviewed exception.

If an exception is needed, reference an immutable identifier (a full commit hash, a checksum) and record the reason.

Rationale

Non-registry sources skip release-age rules, malicious package blocking and vulnerability matching. A branch or unversioned URL can point to different content between two builds.

Impact

Forks or unreleased fixes must be published to the private registry instead of referenced directly.

Audit

1. Search manifests and lockfiles for dependencies whose source is a URL, a source repository or a path.
2. Check that each one has a documented exception and an immutable reference.

Automated: every check must pass. Scanners report each check by its id.

postmortem

git / URL / out-of-repo path dependencies in manifests and lockfiles

command: postmortem harden --json
control: CB-DEP-SRC-004
coverage: auto

Remediation

1. Publish the needed package to the private registry under a proper version.
2. Replace the direct reference with the registry package.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-LOCK-004 Allow only approved sources in lockfiles

People and lifecycle