← ACARA Digital Technologies Years 9–10

Reducing supply chain risk

Lower the chance of a bad dependency: use fewer trusted ones, pin exact versions, verify their integrity with hashes, and scan them for known vulnerabilities.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 81

Understanding Reducing supply chain risk in ACARA Digital Technologies Years 9–10

What it does: This command works out the file's SHA-256 hash. If it matches the published hash, the file has not been changed. A short list with one trusted package pinned to an exact version means fewer places for an attacker to get in. Pinning does not make code perfect. It stops unexpected updates arriving unchecked, so you decide when to upgrade. The == sign locks one exact version. >=0 accepts almost any version, including a bad one. Dependency scanners compare the versions you use with databases of known vulnerabilities and warn you to update or replace them. Pinning keeps versions steady, but it also keeps a vulnerable version. Scan regularly and move to a patched version when one is available.

Common mistakes: The >= sign lets pip install any newer version, including one that has been tampered with. To pin a version you must use == and an exact number: flask==3.0.2. The check is the wrong way round. With != it says ok when the hash does NOT match the trusted hash. It should use == so only an unchanged file passes.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Reducing supply chain risk to a class →

This module's key terms are also in a printable crossword (Modules 828–859) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which approach reduces supply chain risk the most?

Use fewer dependencies from trusted sourcesAdd every popular package you find, just in case

Matches

requests>=2.0

↓

This does not pin a version. Any newer release is allowed, including a tampered one. Use an exact version such as requests==2.31.0.

Applying

Meanings

Term

reduce supply chain risk

Meaning

Lower the chance of a bad dependency: use fewer trusted ones, pin exact versions, verify their integrity with hashes, and scan them for known vulnerabilities.

Practice

requests==2.31.0

Testing

Gaps

flask3.0.0

Check Answer

Spots

2requests==2.31.0

3flask>=3.0.2

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which approach reduces supply chain risk the most?

A. Add every popular package you find, just in case

B. Use fewer dependencies from trusted sources ✓

Every extra dependency is another piece of code you must trust. Fewer, trusted dependencies means a smaller attack surface.

2. What does pinning a version mean?

A. Locking a dependency to an exact version, such as requests==2.31.0 ✓

B. Always downloading whatever the newest version is

Pinning means your project only uses the exact version you have checked, so a surprise change cannot slip in.

3. Why is pinning versions a good idea?

A. A hijacked or tampered new release will not be installed automatically ✓

B. It makes the dependency impossible to hack

Pinning does not make code perfect. It stops unexpected updates arriving unchecked, so you decide when to upgrade.

4. Which line pins a version in a Python requirements file?

A. flask>=0

B. flask==3.0.2 ✓

The == sign locks one exact version. >=0 accepts almost any version, including a bad one.

5. How do you verify the integrity of a downloaded package?

A. Compare its hash with the hash published by the trusted source ✓

B. Check that the file name looks right

A hash is a fingerprint of the file. If even one byte changes, the hash no longer matches, so tampering is detected.

Match the Pairs

requests==2.31.0 → Pins one exact version of a dependency, so a new or tampered release cannot slip in during an update.

pip-audit → Scans your dependencies and reports any that have known vulnerabilities, so you can update or replace them.

Verify integrity by checking that a downloaded file has the same hash the publisher shared → sha256sum package.zip

Use fewer trusted dependencies by keeping your list short and only adding packages you need → requests==2.31.0

requests>=2.0 → This does not pin a version. Any newer release is allowed, including a tampered one. Use an exact version such as requests==2.31.0.

pip install totally-new-pkg → The package is installed without checking who made it or whether it is trusted. Verify and scan it first, or avoid it.

Key Term

reduce supply chain risk

Lower the chance of a bad dependency: use fewer trusted ones, pin exact versions, verify their integrity with hashes, and scan them for known vulnerabilities.

Fill in the Blanks

1. flask==3.0.0

Hint: Type the operator that pins a package to one exact version in requirements.txt.

2. digest = hashlib.sha256(data).hexdigest()

Hint: Type the name of the hash function used to fingerprint the downloaded file.

3. npm audit

Hint: Type the npm subcommand that scans your dependencies for known vulnerabilities.

4. if digest == expected: print("Hash matches") else:

Hint: Type the keyword that runs when the hash check does not pass.

5. pip freeze > requirements.txt

Hint: Type the pip command that lists installed packages with their exact versions so they can be pinned.

Spot the Error

Question 1

A # requirements.txt

B requests==2.31.0

C flask>=3.0.2

D numpy==1.26.4

Line C — The >= sign lets pip install any newer version, including one that has been tampered with. To pin a version you must use == and an exact number: flask==3.0.2.

Question 2

A import hashlib

B f = open('lib.zip', 'rb')

C h = hashlib.sha256(f.read())

D ok = h.hexdigest() != GOOD

E print(ok)

Line D — The check is the wrong way round. With != it says ok when the hash does NOT match the trusted hash. It should use == so only an unchanged file passes.

Question 3

A FOR each dependency IN list

B hash ← SHA256(file)

C IF hash = want THEN reject

D END FOR

Line C — This rejects files that match the trusted hash. A file should be rejected when the hash is NOT equal (≠) to the expected hash, because that means it may have been changed.

Question 4

A {

B "dependencies": {

C "left-pad": "1.3.0",

D "express": "*"

E }

F }

Line D — The * wildcard accepts any version, so a bad new release could be installed without you knowing. Pin the exact version instead: "express": "4.18.2".

Question 5

A NEED: format a date

B IF standard library can do it

C THEN add a new package

D ELSE review package first

Line C — Using fewer dependencies reduces risk. If the standard library can already do the job, use it instead of adding another package that must be trusted.

Student with a class code? Join your class →