maltfield
commented
2 years ago Originally my plan was to just 3TOFU the dependencies once and only store a SHA256SUMS file in the repo. That way it's lightweight and I don't risk comprimising the app's builds with Supply Chain vulnerabilities.
However, ^ this solution ended-up breaking my build pipelines when an asset 404'd (only the newer, unsigned asset was available).
To make builds future-proof, I decided to just include the dependencies directly in the repo.
Problem: Right now we're storing all of the app's dependencies directly in this repo, which has made it balloon in-size, which is only going to get worse with time.
This issue will track the task to find a solution to this problem.
The solution:
Should not depend on downloading resources through the Internet, unless those resources have been cryptographically signed with a pinned, trustworthy key such that the authenticity of the release can be verified, even if the infrastructure from which we're downloading or the connection to that infrastructure is compromised
Should not cause builds to fail in the future in-case our dependency is not longer available for download (404).
For more info on why PyPi fails at security the supply chain (unlike
aptfor example), see: