On supplychain attacks and dependency cooldowns
After the recent
npm attacks there have been
many
recommendations
to leverage dependency cooldown as an additional mitigating factor. Dependency
cooldown works by instructing the package manager to ignore releases that are
younger than a certain threshold.
The reasoning is that a vulnerable package will eventually be detected (and
removed) in less time than the threshold, therefore preventing the attack.
This, combined with dependency pinning (including transitive dependencies!),
is a very powerful tool, but introduces an issue for anyone using internal
dependencies. For those the cooldown will have the undesired side-effect of
blocking internal dependency updates which might contain urgent fixes. I
haven't checked all package managers, but I did check some of the most popular
languages.
Also, cooldown is not supported everywhere and sometimes is supported with
noteworthy exceptions.
Nodejs
Use or switch to pnpm and use a combination of minimumReleaseAge and
minimumReleaseAgeExclude, such as this one:
minimumReleaseAge=30240 minimumReleaseAgeExclude[]=@my-internal-scope/*
Java, Python & probably everything else
Neither maven or pip provide a cooldown setting, so the only alternative is to
use (transitive) dependency pinning. Version ranges must be disallowed too.
Generally speaking I find
hard dependency pinning is a fundamental architecture choice anyways
(for reproducible builds, for example).
Renovate cooldown can be achieved by applying different
matchCurrentAge
setting to each
package group.
Dependabot provides a
cooldown option
but it's critical to note that
the option only applies to non-security updates, so it might not be as
effective as one images and even might lead to a false sense of security. And
when that is in place, people might run dangerous commands they would avoid
instead.
Yocto
Yocto does not provide a way to set dependency cooldown, but defaults to pinned versions and does not automatically bump versions. Update of versions is a manual process and because of this the need for dependency cooldown is effectively removed.