Chapter 22 — Application and software supply chain security: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Lockfiles with hashes"]
N2["Lab — Lab — checking hashes"]
N3["22.2 Lab result"]
N4["22.3 Investigating"]
N5["22.4 SBOMs"]
N6["22.5 Using SBOMs"]
N7["22.6 Dependency owners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Lockfiles with hashes"]
N2["Lab — Lab — checking hashes"]
N3["22.2 Lab result"]
N4["22.3 Investigating"]
N5["22.4 SBOMs"]
N6["22.5 Using SBOMs"]
N7["22.6 Dependency owners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Lockfiles with hashes]
|
v
[Lab — Lab — checking hashes]
|
v
[22.2 Lab result]
|
v
[22.3 Investigating]
|
v
[22.4 SBOMs]
|
v
[22.5 Using SBOMs]
|
v
[22.6 Dependency owners]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) explain lockfiles and integrity hashes; (2) verify downloaded packages against a lockfile; (3) investigate mismatches safely; (4) generate and use an SBOM.
22.1 Lockfiles with hashes
CampusEats' lockfile records each package's exact version and a cryptographic hash of its contents. On install, the package manager compares downloaded bytes with the hash and stops if they differ.
The hash is recorded when a package is first added or updated, so it reflects what the society reviewed at that time. Lena checks that the build uses the install command that enforces the lockfile, since some commands quietly update it instead of checking against it. A test in CI confirms this on every build.
Lab — Lab — checking hashes
"""Compare downloaded package hashes with lockfile entries (synthetic)."""
import hashlib
lock = {"menu-ui-2.3.1": hashlib.sha256(b"menu-ui 2.3.1").hexdigest(),
"pay-client-1.8.0": hashlib.sha256(b"pay-client 1.8.0").hexdigest(),
"date-tools-0.4.2": hashlib.sha256(b"date-tools 0.4.2").hexdigest()}
downloaded = {"menu-ui-2.3.1": b"menu-ui 2.3.1", "pay-client-1.8.0": b"pay-client 1.8.0 (rebuilt)",
"date-tools-0.4.2": b"date-tools 0.4.2"}
for name, blob in downloaded.items():
print(f"{name:17} {'ok' if hashlib.sha256(blob).hexdigest() == lock[name] else 'HASH MISMATCH - stop install'}")
Run with python3 lab_lockfile.py. Verified output:
menu-ui-2.3.1 ok
pay-client-1.8.0 HASH MISMATCH - stop install
date-tools-0.4.2 ok
22.2 Lab result
menu-ui and date-tools match their lockfile hashes. pay-client 1.8.0 does not: the downloaded content differs from what was recorded, and installation stops. This is the check that halted the build in Lena's first week.
Lena runs the lab with the original files to show exactly how the check behaves: matching packages install silently and a single mismatch stops everything, without any partial installation. The output names the package and both hashes, which gives the investigation a clear starting point and shows new members what a working integrity check looks like in practice.
22.3 Investigating
A mismatch can mean a corrupted download, a registry problem, a republished package or tampering. The society does not override the check. Lena compares the package metadata and finds the maintainer had rebuilt and re-uploaded 1.8.0 with a small change, which good registries usually prevent. The society reports it to the maintainer and pins the previous known-good version until 1.8.1 is published.
Lena records the investigation in the society's incident notes. The notes record what was checked, what was found and who decided to pin the earlier version, so the decision can be reviewed later.
22.4 SBOMs
A software bill of materials lists every component and version in a build. NTIA (2021) defined minimum elements, including supplier, component name, version, unique identifiers, dependency relationships, the SBOM's author and a timestamp. CampusEats generates an SBOM for every build.
The SBOM is stored with each release, so the society can always say what was in a given version. Lena checks a generated SBOM against the minimum elements and finds that the supplier field is often empty for small packages, so the society fills it from the registry where possible and notes the gaps.
22.5 Using SBOMs
When an advisory appears, searching SBOMs shows which releases contain the affected component.
When an advisory affected a date library, the search took seconds and showed that only the two most recent releases contained the vulnerable version, both still in use. That told the society what needed updating and confirmed that older archived releases were unaffected. Without SBOMs, the same answer would have meant rebuilding each release or reading old lockfiles by hand. Lena times the search in the termly summary.
22.6 Dependency owners
Each direct dependency has a named owner in the society.
The owner watches for advisories, reviews updates and decides when a package should be replaced. The list started with the three packages Lena found with no owner in her first term; now every direct dependency has one, and the CI check stops the build if a new dependency is added without a name. Owners hand over their packages when they leave the society. Lena checks the list each term to make sure no owner has left without a successor.
Pinning carefully
Pinning an old version is a temporary measure with an expiry date, so CampusEats does not stay on it forever.
Worked example
When the maintainer releases pay-client 1.8.1 with notes explaining the earlier re-upload, the society updates, regenerates the lockfile and SBOM, and closes the incident with a note linking the evidence.
Synthetic case. Packages and hashes are synthetic.
Errors and limits
Hashes prove the bytes match the lockfile, not that the original package was safe.
Exercises
- EX064 — Lab mismatch. Which package failed and what happened? Rubric: 3 = pay-client 1.8.0; stop install; 2 = partial; 1 = vague; 0 = none.
- EX065 — Mismatch cause. What caused the real mismatch? Rubric: 3 = maintainer re-uploaded 1.8.0; 2 = partial; 1 = vague; 0 = none.
- EX066 — SBOM elements. Name four NTIA minimum elements. Rubric: 3 = supplier, name, version, identifiers, relationships, author, timestamp (four); 2 = two; 1 = one; 0 = none.
Synthesis
Hash-checked lockfiles and SBOMs show exactly what you build and let you trace problems.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →