TMA-SUPPLY-CHAIN-LOCKFILE

Ensure a dependency lockfile is committed for each detected package ecosystem

高レベル 1自動supply-chain

説明

Lockfiles pin the exact (and, for most ecosystems, hash-verified) versions of direct and transitive dependencies so builds are reproducible and a newly published malicious version is not pulled in silently. The audit inspects package manifests at the repository root (npm/yarn/pnpm/bun, Go, Cargo, Bundler, Composer, Pipenv, Python pyproject, Gradle, SwiftPM, Dart, Mix) and requires the matching lockfile to be tracked by git. Passes with a note when no supported manifest exists. Run tmaegis from inside the repository; the audit fails when git is missing or the working directory is not a git repository.

チェック方法

監査方法: シェルコマンド

shell

top=$(git rev-parse --show-toplevel 2>/dev/null) || exit 1
cd "$top" || exit 1
files=$(git ls-files 2>/dev/null) || exit 1
missing=
found=0
chk() {
  if printf '%s\n' "$files" | grep -qxE "$1"; then
    found=1
    printf '%s\n' "$files" | grep -qxE "$2" || missing="$missing $3"
  fi
}
chk 'package\.json' '(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?)' npm
chk 'go\.mod' 'go\.sum' go
chk 'Cargo\.toml' 'Cargo\.lock' cargo
chk 'Gemfile' 'Gemfile\.lock' bundler
chk 'composer\.json' 'composer\.lock' composer
chk 'Pipfile' 'Pipfile\.lock' pipenv
chk 'pyproject\.toml' '(poetry\.lock|uv\.lock|pdm\.lock|pylock(\.[^/]+)?\.toml|Pipfile\.lock)' python
chk 'build\.gradle(\.kts)?' '(gradle\.lockfile|gradle/dependency-locks/.*\.lockfile)' gradle
chk 'Package\.swift' 'Package\.resolved' swiftpm
chk 'pubspec\.yaml' 'pubspec\.lock' dart
chk 'mix\.exs' 'mix\.lock' mix
if [ -n "$missing" ]; then
  echo "no committed lockfile for:$missing"
elif [ "$found" -eq 0 ]; then
  echo compliant
  echo "no supported package manifest at the repository root"
else
  echo compliant
fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Generate and commit the lockfile: npm install --package-lock-only / yarn install / pnpm install; go mod tidy (go.sum); cargo generate-lockfile; bundle lock; composer update --lock; pipenv lock; poetry lock or uv lock; gradle dependencies --write-locks. Use frozen installs in CI (npm ci, yarn --immutable, pip --require-hashes).

プロパティ

オペレーティングシステム: すべて
タグ: supply-chaindependencieslockfile
参照: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - Dependencies - pin and lock third-party dependencies (verify section number for your release)

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target supply-chain