Pinning Dependencies Is Not Optional Anymore

There is no shortage of articles about Vault. Most of them cover the happy path. This one is about what happened after the happy path ended.

We had good intentions. We even had a document describing how threat modeling should work. The trouble was that the document and the code had quietly gone their separate ways.

Where we started

The first symptom was subtle. Nothing failed outright, but threat modeling kept drifting in the wrong direction, and every fix seemed to make the next one harder.

Most of the complexity was accidental. Over the years we'd layered three different approaches to threat modeling on top of each other, and each one made sense at the time.

A simpler approach

The fix turned out to be smaller than expected. Instead of adding another layer, we removed one and leaned on what Vault already gives you out of the box.

Here's a trimmed-down version of what we ended up with:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

It's tempting to generalize this into a library. Resist that urge until you've needed it in at least three places.

A few things that helped along the way:

• Pair on the first few changes so the knowledge doesn't live in one head.
• Keep the old path around until the new one has survived a real incident.
• Make the default the safe choice, not just the documented one.

Where this breaks down

None of this is free. The new approach is a bit more verbose, and newcomers occasionally ask why we don't just use Semgrep for everything. That's a fair question with a boring answer: we tried, and it made threat modeling harder to reason about.

We still haven't solved session management. That's a post for another day, and honestly, I'm not sure we'll get it right the first time either.

Takeaways

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.