# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-SRC-005
title: Use authenticated, encrypted transport to registries
finding:
  title: Packages are downloaded without TLS or without certificate verification
status: draft
profiles: [baseline]
risk:
  severity: high
assessment: partial
tags: [tls, registry]
description: |
  All registry and proxy URLs use HTTPS with certificate verification enabled. No configuration disables TLS verification or marks a host as trusted to skip it.
rationale: |
  Without verified TLS, anyone on the network path can swap a package during download. Disabling verification "temporarily" to work around a proxy is a common and long-lived mistake.
impact: |
  Internal certificate authorities must be distributed to workstations and build images.
audit:
  manual: |
    1. Search project, user, system and pipeline configuration for registry URLs that are not HTTPS.
    2. Search for settings or flags that disable certificate verification or trust a host without it.
  checks:
    - id: postmortem
      engine: postmortem
      description: "TLS bypasses and plain-http registries in config, CI, Dockerfiles, lockfiles"
      spec:
        command: postmortem harden --json
        control: CB-DEP-SRC-005
        coverage: auto
remediation:
  manual: |
    1. Switch every registry URL to HTTPS.
    2. Remove settings that disable verification, and install the internal CA certificate instead.
references:
  - title: Package Manager Best Practices
    url: https://github.com/ossf/package-manager-best-practices
    publisher: OpenSSF
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SC-8
    relation: related
threats:
  - framework: mitre-attack
    id: T1557
  - framework: cwe
    id: CWE-295
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16