# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-SRC-004
title: Declare dependencies only from a registry
finding:
  title: Dependencies are pulled from direct URLs, source repositories or local paths
  description: Code fetched from a URL or a repository branch bypasses registry controls and can change at any time without a new version.
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [registry, lockfile]
description: |
  Production dependencies are declared as named, versioned packages from an approved registry. Direct archive URLs, source repository references and local paths are not used, except under a documented and reviewed exception.
rationale: |
  Non-registry sources skip release-age rules, malicious package blocking and vulnerability matching. A branch or unversioned URL can point to different content between two builds.
impact: |
  Forks or unreleased fixes must be published to the private registry instead of referenced directly.
notes: |
  If an exception is needed, reference an immutable identifier (a full commit hash, a checksum) and record the reason.
audit:
  manual: |
    1. Search manifests and lockfiles for dependencies whose source is a URL, a source repository or a path.
    2. Check that each one has a documented exception and an immutable reference.
  checks:
    - id: postmortem
      engine: postmortem
      description: "git / URL / out-of-repo path dependencies in manifests and lockfiles"
      spec:
        command: postmortem harden --json
        control: CB-DEP-SRC-004
        coverage: auto
remediation:
  manual: |
    1. Publish the needed package to the private registry under a proper version.
    2. Replace the direct reference with the registry package.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
  - title: Secure Supply Chain Consumption Framework (S2C2F)
    url: https://github.com/ossf/s2c2f
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SR-3
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
  - framework: cwe
    id: CWE-494
related_controls:
  - id: CB-DEP-LOCK-004
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16