Dependency requirements

Why SIGMA enforces strict dependency rules

A certificate is only as meaningful as the artifacts it covers. If a dependency is declared as a range, the certificate still needs one exact registry artifact behind it. SIGMA therefore accepts public-registry ranges only when it can resolve them to a concrete version at quote / submission time and disclose both the declared spec and the exact audited version in the certificate. Future package releases are not implicitly covered by that certificate.

Similarly, packages from sources that are not publicly verifiable - private registries, version control references, local paths - cannot be independently reviewed. SIGMA only certifies packages from official public registries because a certificate for an artifact no one else can inspect would be meaningless as a trust signal.

Version declaration requirements

Python (requirements.txt)

Exact pins are accepted directly:

requests==2.31.0
openai==1.14.0
pydantic==2.6.0

The following are also accepted when SIGMA can resolve them from pypi.org to one concrete version at submission time:

• requests>=2.30.0 - comparison range
• requests~=2.31 - compatible release specifier

The following are still rejected:

• requests - no version at all
• requests==2.* - wildcard version when no exact version can be resolved safely

Node.js (package.json)

Exact pins are accepted directly:

{
  "dependencies": {
    "axios": "1.6.7",
    "openai": "4.28.0"
  }
}

The following are also accepted when SIGMA can resolve them from registry.npmjs.org to one concrete version at submission time:

• "^1.6.7" - caret range
• "~1.6.0" - tilde range
• ">=1.6.0" - comparison range

The following are still rejected:

• "*" - wildcard
• "latest" - tag reference

Registry requirements

Python: All packages must be installable from pypi.org. The following are not accepted:

• --index-url pointing to a private registry
• --extra-index-url pointing to any additional source
• --find-links pointing to a local directory or URL
• git+https://... version control references
• -e . editable installs

Node.js: All packages must be available on registry.npmjs.org. The following are not accepted:

• GitHub shorthand references ("github:user/repo")
• Direct git URLs ("git+https://...")
• File protocol references ("file:../local-package")
• Private scoped registries (when not resolvable on the public registry)

Install flag restrictions

requirements.txt must not contain flags that bypass safety mechanisms:

• --no-deps - bypasses transitive dependency resolution
• --trusted-host - bypasses TLS verification
• --pre - allows pre-release versions
• -e - editable installs from local paths

Hash pinning (optional but encouraged)

Python supports explicit hash pinning in requirements.txt:

requests==2.31.0 --hash=sha256:58cd2187423d...

When a developer provides hash values for their dependencies and those values match what SIGMA fetches from PyPI, this is recorded as a positive signal in the certificate. It demonstrates that the developer has independently verified their supply chain. If hash values are provided and do not match the registry, the submission is rejected immediately as a critical integrity failure.

Node.js package-lock.json files contain integrity hashes for all resolved packages. Including a package-lock.json in the repository is similarly recorded as a positive signal.

Related: Package Trust Registry, CODE + PACKAGES, Submitting code.