Reducing supply chain risk

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which approach reduces supply chain risk the most?

A Add every popular package you find, just in case

B Use fewer dependencies from trusted sources

2. What does pinning a version mean?

A Locking a dependency to an exact version, such as requests==2.31.0

B Always downloading whatever the newest version is

3. Why is pinning versions a good idea?

A A hijacked or tampered new release will not be installed automatically

B It makes the dependency impossible to hack

4. Which line pins a version in a Python requirements file?

A flask>=0

B flask==3.0.2

5. How do you verify the integrity of a downloaded package?

A Compare its hash with the hash published by the trusted source

B Check that the file name looks right

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1requests==2.31.0		AThe package is installed without checking who made it or whether it is trusted. Verify and scan it first, or avoid it.
2pip-audit		BPins one exact version of a dependency, so a new or tampered release cannot slip in during an update.
3Verify integrity by checking that a downloaded file has the same hash the publisher shared		CThis does not pin a version. Any newer release is allowed, including a tampered one. Use an exact version such as requests==2.31.0.
4Use fewer trusted dependencies by keeping your list short and only adding packages you need		Dsha256sum package.zip
5requests>=2.0		Erequests==2.31.0
6pip install totally-new-pkg		FScans your dependencies and reports any that have known vulnerabilities, so you can update or replace them.

Definitions

reduce supply chain risk

Fill in the Blanks

Complete each line of code by filling in the missing parts.

flask__3.0.0

digest = hashlib.______(data).hexdigest()

npm _____

if digest == expected: print("Hash matches") ____:

pip ______ > requirements.txt

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A # requirements.txt

B requests==2.31.0

C flask>=3.0.2

D numpy==1.26.4

Question 2

A import hashlib

B f = open('lib.zip', 'rb')

C h = hashlib.sha256(f.read())

D ok = h.hexdigest() != GOOD

E print(ok)

Question 3

A FOR each dependency IN list

B hash ← SHA256(file)

C IF hash = want THEN reject

D END FOR

Question 4

A {

B "dependencies": {

C "left-pad": "1.3.0",

D "express": "*"

E }

F }

Question 5

A NEED: format a date

B IF standard library can do it

C THEN add a new package

D ELSE review package first

Answer Key

Reducing supply chain risk

Section A: Quick Questions

B — Use fewer dependencies from trusted sources

A — Locking a dependency to an exact version, such as requests==2.31.0

A — A hijacked or tampered new release will not be installed automatically

B — flask==3.0.2

A — Compare its hash with the hash published by the trusted source

Section B: Match the Pairs

requests==2.31.0 → Pins one exact version of a dependency, so a new or tampered release cannot slip in during an update.

pip-audit → Scans your dependencies and reports any that have known vulnerabilities, so you can update or replace them.

Verify integrity by checking that a downloaded file has the same hash the publisher shared → sha256sum package.zip

Use fewer trusted dependencies by keeping your list short and only adding packages you need → requests==2.31.0

requests>=2.0 → This does not pin a version. Any newer release is allowed, including a tampered one. Use an exact version such as requests==2.31.0.

pip install totally-new-pkg → The package is installed without checking who made it or whether it is trusted. Verify and scan it first, or avoid it.

Section C: Definitions

reduce supply chain risk — Lower the chance of a bad dependency: use fewer trusted ones, pin exact versions, verify their integrity with hashes, and scan them for known vulnerabilities.

Section D: Fill in the Blanks

flask==3.0.0

digest = hashlib.sha256(data).hexdigest()

npm audit

if digest == expected:
    print("Hash matches")
else:

pip freeze > requirements.txt

Section E: Spot the Error

C — The >= sign lets pip install any newer version, including one that has been tampered with. To pin a version you must use == and an exact number: flask==3.0.2.

D — The check is the wrong way round. With != it says ok when the hash does NOT match the trusted hash. It should use == so only an unchanged file passes.

C — This rejects files that match the trusted hash. A file should be rejected when the hash is NOT equal (≠) to the expected hash, because that means it may have been changed.

D — The * wildcard accepts any version, so a bad new release could be installed without you knowing. Pin the exact version instead: "express": "4.18.2".

C — Using fewer dependencies reduces risk. If the standard library can already do the job, use it instead of adding another package that must be trusted.