bubbles-supply-chain-source-locking

Lock dependency resolution to a single explicit allowlist of trusted registries and forbid extra indexes or fall-through proxies. For pip, avoid --extra-index-url to un-allowlisted hosts; for Go, pin GOPROXY without an open ,direct fall-through; for Rust, set cargo-deny unknown-registry and unknown-git to deny.

In deny.toml, set unknown-registry = "deny" and unknown-git = "deny", then populate allow-registry with exactly one trusted index such as sparse+https://index.crates.io/. Leave allow-git empty by default so every git dependency is an explicit reviewed exception, and wire cargo deny check sources into the blocking lint gate.

No, provenance and source locking are complementary controls on different axes. Signing verifies the built artifact is authentic before deploy, while source locking governs where code enters the build; a signed image built from a typosquatted dependency still ships compromised code.

pip resolves the highest version across all configured indexes, so a public typosquat of an internal package name at a higher version wins over the private index. Use a single --index-url with hash-pinned, version-pinned requirements instead, and allowlist any internal index explicitly.

No, the source check must be blocking with no --skip, --force, or --allow-once escape hatch, since the first skip tends to become the permanent path. A legitimately new trusted source is added by editing the allowlist as a reviewed config change.

Checksum-disable knobs such as GONOSUMCHECK, GONOSUMDB, GOINSECURE, and a permissive GOPRIVATE covering public modules are forbidden because they defeat source verification. Builds should use GOFLAGS=-mod=readonly, a pinned GOPROXY, and go.sum verification in the gate.