Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
50 lines
2.2 KiB
Markdown
50 lines
2.2 KiB
Markdown
# Supply Chain — Derived Rules
|
|
|
|
> Derives from `domains/security/first-principles.md` P10 (Surface Minimization), P3 (Defense in Depth), P7 (Auditability).
|
|
|
|
## Dependencies are Attack Surface (P10)
|
|
|
|
- Every dependency is code you did not write but must trust. Minimize it.
|
|
- A dependency you do not need is a vulnerability you do not have.
|
|
- Audit dependencies regularly. Remove unused ones (`npm prune`, `pip-autoremove`).
|
|
|
|
## Lockfiles (P1 Correctness, P5 Reversibility)
|
|
|
|
- Pin exact versions in a lockfile (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `Cargo.lock`).
|
|
- Commit the lockfile. A reproducible build requires a committed lock.
|
|
- `npm ci` (not `npm install`) in CI. `pip install -r requirements.txt` with pinned versions.
|
|
|
|
## Integrity (P6 Crypto Correctness)
|
|
|
|
- Subresource integrity for web assets: `<script src="..." integrity="sha384-...">`.
|
|
- Package signatures where available (signed npm packages, GPG-signed apt packages).
|
|
- Verify checksums on downloaded artifacts. A tarball without a checksum is untrusted.
|
|
|
|
## Vulnerability Scanning (P3 Defense in Depth)
|
|
|
|
- `npm audit`, `pip-audit`, `cargo audit`, `trivy`, `snyk` — run in CI.
|
|
- Fail the build on high/critical vulnerabilities (configurable threshold).
|
|
- Auto-merge security PRs from Dependabot/Renovate when the patch is non-breaking.
|
|
|
|
## Provenance (P7 Auditability)
|
|
|
|
- SBOM (Software Bill of Materials): `cyclonedx` or `spdx` output. Know what is in your build.
|
|
- SLSA (Supply-chain Levels for Software Artifacts): provenance attestation for builds.
|
|
- Signed artifacts: cosign, sigstore. A build you cannot verify is untrusted.
|
|
|
|
## Private Registries (P2 Least Privilege)
|
|
|
|
- Internal packages come from a private registry, not public npm/PyPI.
|
|
- A typo-squatted public package is a supply chain attack (`lodash` vs `lodahs`).
|
|
- Scope your registry: `@myorg:registry=https://registry.myorg.com`.
|
|
|
|
## What Violates Supply Chain
|
|
|
|
| Violation | Principle |
|
|
|-----------|-----------|
|
|
| `npm install` (no lockfile) in CI | P1, P5 |
|
|
| Unpinned dependency `^1.2.3` in production | P1 |
|
|
| No vulnerability scanning in CI | P3 |
|
|
| `eval` of a package's README | P10 (surface) |
|
|
| A dependency with 0 weekly downloads | P10 (no eyes) |
|
|
| No SBOM for a shipped artifact | P7 | |