I don't want to commit dependency pins because knowledgeable system operators cannot easily override them and because dependency pin updates pollute a project's history in ways that make code reviews difficult, yet I must mitigate supply chain attacks, which requires pinning dependencies. The current approach uses opentofu-freeze or python-freeze to generate dependency pins at CI workflow run time or pinact to generate/update dependency pins before making a commit, which suffers from the following flaws:
-
Neither tofu providers lock nor pip-compile support cooldowns.
-
Neither tofu providers lock nor pip-compile can audit or update existing pins.
-
Python dependencies must be pinned to specific cryptographic hashes because PyPI does not guarantee immutable binary wheels.
-
OpenTofu does not provide a way to manage module pins.
-
The pre-commit framework does not provide a way to pin hook scripts, although developers can do that manually. (The same goes for TFLint.)
-
Dependency pinning happens during a CI workflow run, outside of developers' purview.
I've thought about configuring dependency pins via GitHub Actions secrets or variables or re-use the previous release's, but that only really addresses the final point. I'm not sure how to address all the gaps without creating a lot of work for folks.
I don't want to commit dependency pins because knowledgeable system operators cannot easily override them and because dependency pin updates pollute a project's history in ways that make code reviews difficult, yet I must mitigate supply chain attacks, which requires pinning dependencies. The current approach uses opentofu-freeze or python-freeze to generate dependency pins at CI workflow run time or pinact to generate/update dependency pins before making a commit, which suffers from the following flaws:
Neither
tofu providers locknorpip-compilesupport cooldowns.Neither
tofu providers locknorpip-compilecan audit or update existing pins.Python dependencies must be pinned to specific cryptographic hashes because PyPI does not guarantee immutable binary wheels.
OpenTofu does not provide a way to manage module pins.
The pre-commit framework does not provide a way to pin hook scripts, although developers can do that manually. (The same goes for TFLint.)
Dependency pinning happens during a CI workflow run, outside of developers' purview.
I've thought about configuring dependency pins via GitHub Actions secrets or variables or re-use the previous release's, but that only really addresses the final point. I'm not sure how to address all the gaps without creating a lot of work for folks.