Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
2.2 KiB
2.2 KiB
Supply Chain — Derived Rules
Derives from
domains/security/first-principles.mdP10 (Surface Minimization), P3 (Defense in Depth), P7 (Auditability).
Dependencies are Attack Surface (P10)
- Every dependency is code you did not write but must trust. Minimize it.
- A dependency you do not need is a vulnerability you do not have.
- Audit dependencies regularly. Remove unused ones (
npm prune,pip-autoremove).
Lockfiles (P1 Correctness, P5 Reversibility)
- Pin exact versions in a lockfile (
package-lock.json,yarn.lock,Pipfile.lock,Cargo.lock). - Commit the lockfile. A reproducible build requires a committed lock.
npm ci(notnpm install) in CI.pip install -r requirements.txtwith pinned versions.
Integrity (P6 Crypto Correctness)
- Subresource integrity for web assets:
<script src="..." integrity="sha384-...">. - Package signatures where available (signed npm packages, GPG-signed apt packages).
- Verify checksums on downloaded artifacts. A tarball without a checksum is untrusted.
Vulnerability Scanning (P3 Defense in Depth)
npm audit,pip-audit,cargo audit,trivy,snyk— run in CI.- Fail the build on high/critical vulnerabilities (configurable threshold).
- Auto-merge security PRs from Dependabot/Renovate when the patch is non-breaking.
Provenance (P7 Auditability)
- SBOM (Software Bill of Materials):
cyclonedxorspdxoutput. Know what is in your build. - SLSA (Supply-chain Levels for Software Artifacts): provenance attestation for builds.
- Signed artifacts: cosign, sigstore. A build you cannot verify is untrusted.
Private Registries (P2 Least Privilege)
- Internal packages come from a private registry, not public npm/PyPI.
- A typo-squatted public package is a supply chain attack (
lodashvslodahs). - Scope your registry:
@myorg:registry=https://registry.myorg.com.
What Violates Supply Chain
| Violation | Principle |
|---|---|
npm install (no lockfile) in CI |
P1, P5 |
Unpinned dependency ^1.2.3 in production |
P1 |
| No vulnerability scanning in CI | P3 |
eval of a package's README |
P10 (surface) |
| A dependency with 0 weekly downloads | P10 (no eyes) |
| No SBOM for a shipped artifact | P7 |