Dependencies on Brian Faust

A Lockfile Gives Repeatability, Not Provenance

Mon, 01 Dec 2025 00:00:00 +0000

composer install exits successfully. It selects the version in the committed lockfile, downloads an archive whose checksum matches, generates the autoloader, and produces the same output on a second clean install.

The output is EXFILTRATED.

Nothing about that result means Composer ignored the lock. The lockfile was updated to select the malicious package and its correct checksum. Composer then repeated that decision exactly.

This is the useful boundary of a dependency lock. It records a resolution. It can make later installations select the same versions, references, metadata, and declared distribution bytes. It cannot prove who deserved to publish those bytes, why the update was approved, what package code will do, whether new advisories exist, or which artifact a consumer eventually executes.

Supply-Chain Security Begins with Who Can Change the Artifact

Sat, 01 Nov 2025 00:00:00 +0000

quote-tool.bin has a valid signature. Its provenance names the expected source revision, dependency lock, workflow digest, and builder. The signature verifies against the consumer’s trusted fixture key.

The program is still malicious.

In the SEC-01 fixture , the authorized builder changes the artifact after the tests pass and signs the resulting digest. Signature verification succeeds because the statement is authentic. Consumer policy rejects the artifact because its digest does not match the independently reproduced output.

Dependency Inversion Lets Policy Own the Boundary

Tue, 01 Jun 2021 00:00:00 +0000

This class uses constructor injection and still points in the wrong direction:

final readonly class QuoteShipment
{
 public function __construct(private GuzzleHttp\Client $http) {}

 public function handle(Shipment $shipment): Money
 {
 $response = $this->http->post('/carrier/rates', [
 'json' => CarrierPayload::fromShipment($shipment),
 ]);

 return Money::EUR(
 json_decode($response->getBody(), true)['price_cents'],
 );
 }
}

The dependency is visible and testable, but the application use case knows an HTTP client, carrier endpoint, payload, response shape, and currency assumption. Replacing new Client() with an injected client improved assembly; it did not protect policy from the detail.