Skip to main content
EMEP depends on model frameworks, numerical libraries, and system packages. A compromised dependency can poison merges, leak weights, or break reproducibility. This page defines the controls that keep the dependency graph safe and auditable.

​
Dependency Pinning

All runtime and build dependencies use exact versions with cryptographic hashes. The lockfile format stores:
  • Package name and exact version
  • Hash algorithm (SHA-256) and value
  • Source index or mirror URL
  • License identifier
No floating versions are permitted in production builds. Development environments may use a relaxed lockfile that is promoted to exact pins before merge to main.

​
SBOM

Every build produces a Software Bill of Materials in CycloneDX format with SPDX fallback. The SBOM includes:
  • Direct and transitive dependencies
  • Hashes and licenses
  • Vulnerability identifiers (populated at build time from CVE database)
  • Build timestamp and builder identity
The SBOM is attached to the artifact manifest and signed alongside the artifact.

​
CVE Monitoring

​
Blocked Lists

The build system maintains two deny lists:
  • Blocked packages: known malicious or abandoned packages
  • Blocked licenses: licenses incompatible with EMEP distribution goals
A dependency graph containing a blocked package fails the build immediately.

​
Build-Time Flow

​
Offline Mirror

Air-gapped deployments maintain an offline mirror of all dependencies. The mirror syncs from the public index on a scheduled interval through a one-way transfer. The mirror contents are hashed and signed. Builds in the air-gapped zone use only the offline mirror.