Dependency supply chain

Lock 19

Choose

CI fetches 400 packages/s for builds. An attacker took over a popular package and published a poisoned version. From 0:20 to 0:40 the public registry is down. No unreviewed version may enter a build. Fetches must stay 99 percent available. Pick the dependency policy.

Goals

Not tested yet

Requests served each second.The share of requests that get a correct answer.99 of 100 requests finish faster than this.What the servers and services cost each month.
Choose a design
Version ranges, newest wins
Pinned hashes, public registry
Pinned hashes, private mirror