Supply Chain Security Overview

June 28, 2026 ยท View on GitHub

This document describes the supply chain security approach for the Hex ecosystem.

What is Supply Chain Security?

Supply chain security ensures that:

  1. Provenance - You know where software came from
  2. Integrity - Software hasn't been tampered with
  3. Verification - Claims can be cryptographically verified

Hex Supply Chain Model

flowchart LR
    subgraph Maintainer["Maintainer Environment"]
        Build["Build & Package"]
    end

    subgraph Registry["hex.pm"]
        API["API"]
        Sign["Sign & Store"]
    end

    subgraph Distribution["repo.hex.pm (CDN/S3)"]
        Dist["Distribute"]
    end

    subgraph Consumer["Client Environment"]
        Verify["Verify & Install"]
    end

    Build --> API
    API --> Sign
    Sign --> Dist
    Dist --> Verify

Security Properties

Publishing Side

PropertyDescriptionStatus
AuthenticationPublishing requires authenticated userImplemented
AuthorizationOnly owners can publish to their packagesImplemented
Audit loggingAll publishing actions are loggedImplemented
Owner notificationsAll package owners are notified by email when a new version is published or when owners are added or removedImplemented
2FA for publishingOTP required for write operations via OAuthImplemented
Trusted publishing (OIDC)Short-lived CI credentialsPlanned
Build provenance (SLSA)Cryptographic proof of build originPlanned

Distribution Side

PropertyDescriptionStatus
Signed registryMetadata signed with RSA-PKCS1-SHA512Implemented
ChecksumsArtifacts have SHA-256 checksumsImplemented
ImmutabilityVersions cannot be modified after grace periodImplemented
Transparency logAppend-only log of publication eventsPlanned

Consumption Side

PropertyDescriptionStatus
Signature verificationClients verify registry signaturesImplemented
Checksum verificationClients verify artifact checksumsImplemented
Lock filesExact versions recorded for reproducibilityImplemented
Provenance verificationClients verify build attestationsPlanned

Attack Surface

StageThreatsCurrent Mitigations
MaintainerCompromised credentials, malicious insider2FA, OAuth, audit logs
BuildCompromised build environmentNone (planned: trusted publishing, SLSA provenance)
PublishingUnauthorized publish, tamperingAuthentication, authorization
DistributionCDN/mirror tampering, MITMSigned registry, checksums
ConsumptionDependency confusion, typosquatting, vulnerable/retired versionsRepository field verification, typosquatting detection, advisory CLI reporting and dependency policies (Hex/Mix)

Detailed Documentation