Description

Hi again, I'd like to suggest another security practice recommended by the OpenSSF Scorecard which is to hash pin dependencies to prevent dependency-confusion, typosquatting and tag renaming attacks. Besides this is currently the only way to make your CI run as an immutable release.

The change would only be applied to GitHub workflows, dockerfiles and shell scripts dependencies.

This means:

• Hash pinning GitHub Workflow actions.
• Using --require-hashes on pip installs.

I can submit one PR for each type of change above to be easier to review if you prefer. Just let me know if that's the case.

Also it might be important to notice that the dependabot, that seems to be already enabled, is able to update both the hash and the comment version related to it.

Let me know if you are open to evaluate those changes and I'll submit the PR(s) ASAP.

Any questions or concerns just let me know.
Thanks!

Additional Context

A tag renaming attack is a type of attack whereby an attacker:

• Hijack an action.
• Upload a malicious version.
• Replace existing tags with malicious versions.

Both Dependency Confusion and Typosquatting attacks are more applicable to package managers (such as pip, npm, choco, etc)

A dependency-confusion attack occurs when an attacker:

• Find the name of a package that the victims wants to install
• Create an identically named package and publish it under the public or default registry.
• Assign the package with a higher version number to trick the package manager tool to download it from the public repo.

A typosquatting attack is a type of attack whereby an attacker:

• Create a malicious package
• Publish it with a similar name of a known package (example: numpi instead of numpy)

Reproduction steps

None

Expected vs. actual results

Actions

Current

actions/checkout@v3

Expected

actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

Pip installs

Current

run: python -m pip install reuse

Expected

run: python -m pip install --require-hashes -r ci-deps.txt

Minimal code example

None

Error messages

None - not a bug

Compiler and operating system

None

Library version

None

Validation

• The bug also occurs if the latest version from the develop branch is used.
• I can successfully compile and run the unit tests.