# Supply Chain — Derived Rules

> Derives from `domains/security/first-principles.md` P10 (Surface Minimization), P3 (Defense in Depth), P7 (Auditability).

## Dependencies are Attack Surface (P10)

- Every dependency is code you did not write but must trust. Minimize it.
- A dependency you do not need is a vulnerability you do not have.
- Audit dependencies regularly. Remove unused ones (`npm prune`, `pip-autoremove`).

## Lockfiles (P1 Correctness, P5 Reversibility)

- Pin exact versions in a lockfile (`package-lock.json`, `yarn.lock`, `Pipfile.lock`, `Cargo.lock`).
- Commit the lockfile. A reproducible build requires a committed lock.
- `npm ci` (not `npm install`) in CI. `pip install -r requirements.txt` with pinned versions.

## Integrity (P6 Crypto Correctness)

- Subresource integrity for web assets: `<script src="..." integrity="sha384-...">`.
- Package signatures where available (signed npm packages, GPG-signed apt packages).
- Verify checksums on downloaded artifacts. A tarball without a checksum is untrusted.

## Vulnerability Scanning (P3 Defense in Depth)

- `npm audit`, `pip-audit`, `cargo audit`, `trivy`, `snyk` — run in CI.
- Fail the build on high/critical vulnerabilities (configurable threshold).
- Auto-merge security PRs from Dependabot/Renovate when the patch is non-breaking.

## Provenance (P7 Auditability)

- SBOM (Software Bill of Materials): `cyclonedx` or `spdx` output. Know what is in your build.
- SLSA (Supply-chain Levels for Software Artifacts): provenance attestation for builds.
- Signed artifacts: cosign, sigstore. A build you cannot verify is untrusted.

## Private Registries (P2 Least Privilege)

- Internal packages come from a private registry, not public npm/PyPI.
- A typo-squatted public package is a supply chain attack (`lodash` vs `lodahs`).
- Scope your registry: `@myorg:registry=https://registry.myorg.com`.

## What Violates Supply Chain

| Violation | Principle |
|-----------|-----------|
| `npm install` (no lockfile) in CI | P1, P5 |
| Unpinned dependency `^1.2.3` in production | P1 |
| No vulnerability scanning in CI | P3 |
| `eval` of a package's README | P10 (surface) |
| A dependency with 0 weekly downloads | P10 (no eyes) |
| No SBOM for a shipped artifact | P7 |