Description
All registry and proxy URLs use HTTPS with certificate verification enabled. No configuration disables TLS verification or marks a host as trusted to skip it.
Rationale
Without verified TLS, anyone on the network path can swap a package during download. Disabling verification "temporarily" to work around a proxy is a common and long-lived mistake.
Impact
Internal certificate authorities must be distributed to workstations and build images.
Audit
- Search project, user, system and pipeline configuration for registry URLs that are not HTTPS.
- Search for settings or flags that disable certificate verification or trust a host without it.
Automated: every check must pass. Scanners report each check by its id.
postmortem
TLS bypasses and plain-http registries in config, CI, Dockerfiles, lockfiles
command: postmortem harden --json
control: CB-DEP-SRC-005
coverage: auto
Remediation
- Switch every registry URL to HTTPS.
- Remove settings that disable verification, and install the internal CA certificate instead.
References
- Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | SC-8 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID | Note |
|---|---|---|
| MITRE ATT&CK | T1557 | |
| Common Weakness Enumeration | CWE-295 |
People and lifecycle
| Authors | Alice |
| Introduced in | v1.0.0 |
| Created, updated | 2026-10-16, 2026-10-16 |