Documentation
Book a demo

Policy as code

Rego recipes

Recipe 1: simple tag check

Use case: Match any package with a certain tag. For example: ready-for-production. For this rule, the value of match will be true when any tag.name contains the value provided in required_tag.

rego
package cloudsmith

required_tag := "ready-for-production"

default match := false

match if {
    has_required_tag
}

has_required_tag if {
    some i
	input.v0["package"].tags[i].name == required_tag
}

Recipe 2: high-risk vulnerabilities

Use case: Match packages with high-severity vulnerabilities (CVSS >= 7.0) when a fix is available.

What It Does:

  • Groups OSV records by ID, aliases, and upstreams, so severity data from one advisory is considered alongside fix data from another for the same vulnerability.
  • Requires at least one fixed event, so packages with no available remediation are not matched.
  • Requires a CVSS score at or above cvss_threshold.
  • Skips vulnerabilities listed in ignored_ids.
rego
# METADATA
# title: High-risk vulnerabilities
# description: Match packages with high-severity vulnerabilities (CVSS >= 7.0) when fixes are available
package cloudsmith

default match := false

cvss_threshold := 7.0

ignored_ids := {} # for example, {"CVE-2021-9999"}

ids(v) := {v.id} | {a | some a in v.aliases}

vulnerabilities[id] contains v if {
	some v in input.v0.osv
	some id in (ids(v) | {u | some u in v.upstream})
}

scores(records) := {s.numerical_score |
	some v in records
	some s in v.severity
} | {s.numerical_score |
	some v in records
	some a in v.affected
	some s in a.severity
}

has_fix(records) if {
	some v in records
	v.affected[_].ranges[_].events[_].fixed
}

ignored_record(v) if {
	some id in ids(v)
	id in ignored_ids
}

ignored_record(v) if {
	count(v.upstream) > 0
	every u in v.upstream { u in ignored_ids }
}

ignored(records) if {
	some v in records
	ignored_record(v)
}

matching_scores contains score if {
	some records in vulnerabilities
	has_fix(records)
	not ignored(records)
	some score in scores(records)
	score >= cvss_threshold
}

match if count(matching_scores) > 0

reason contains msg if {
	match
	msg := sprintf("Vulnerability at CVSS %.1f with fix available, threshold %.1f", [max(matching_scores), cvss_threshold])
}

Recipe 3: compare software package license to a list of copyleft licenses

Use case: Check whether a software package's license is a copyleft license.

What It Does:

  • Defines a set of known copyleft SPDX identifiers.
  • Triggers if the package's license SPDX identifier matches any of those copyleft licenses.
rego
package cloudsmith

default match := false

# GNU General Public License (GPL) variants
gpl_licenses := {
    "GPL-1.0-only",
    "GPL-1.0-or-later",
    "GPL-2.0",
    "GPL-2.0-only",
    "GPL-2.0-or-later",
    "GPL-3.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
}

# GNU Lesser General Public License (LGPL) variants
lgpl_licenses := {
    "LGPL-2.0",
    "LGPL-2.0-only",
    "LGPL-2.0-or-later",
    "LGPL-2.1",
    "LGPL-2.1-only",
    "LGPL-2.1-or-later",
    "LGPL-3.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
}

# GNU Affero General Public License (AGPL) variants
agpl_licenses := {
    "AGPL-1.0",
    "AGPL-1.0-only",
    "AGPL-1.0-or-later",
    "AGPL-3.0",
    "AGPL-3.0-only",
    "AGPL-3.0-or-later",
}

# Mozilla Public License (MPL) variants
mpl_licenses := {
    "MPL-1.0",
    "MPL-1.1",
    "MPL-2.0",
}

# Common Development and Distribution License (CDDL) variants
cddl_licenses := {
    "CDDL-1.0",
    "CDDL-1.1",
}

# Eclipse Public License (EPL) variants
epl_licenses := {
    "EPL-1.0",
    "EPL-2.0",
}

# Open Software License (OSL) variants
osl_licenses := {
    "OSL-1.0",
    "OSL-2.0",
    "OSL-3.0",
}

# GNU Free Documentation License (GFDL) variants
gfdl_licenses := {
    "GFDL-1.1-only",
    "GFDL-1.1-or-later",
    "GFDL-1.2-only",
    "GFDL-1.2-or-later",
    "GFDL-1.3-only",
    "GFDL-1.3-or-later",
}

# Creative Commons Share Alike (CC-BY-SA) variants
cc_by_sa_licenses := {
    "CC-BY-SA-1.0",
    "CC-BY-SA-2.0",
    "CC-BY-SA-2.5",
    "CC-BY-SA-3.0",
    "CC-BY-SA-4.0",
}

# Other copyleft licenses
other_copyleft_licenses := {
    "QPL-1.0",
    "Sleepycat",
    "SSPL-1.0",
    "copyleft-next-0.3.0",
}

# Combined copyleft license set
copyleft := gpl_licenses | lgpl_licenses | agpl_licenses | mpl_licenses | cddl_licenses | epl_licenses | osl_licenses | gfdl_licenses | cc_by_sa_licenses | other_copyleft_licenses

# Main policy rule
match if {
    input.v0.package.license.oss_license.spdx_identifier in copyleft
}

Recipe 4: detect malicious packages

Use case: Check if a package was part of a supply chain attack.

rego
# METADATA
# title: Malware
# description: Match packages with detected malware vulnerabilities
package cloudsmith

default match := false

malicious(vulnerability) if startswith(vulnerability.id, "MAL-")
malicious(vulnerability) if "CWE-506" in vulnerability.database_specific.cwe_ids

match if {
	some vulnerability in input.v0.osv
	malicious(vulnerability)
}

reason contains "Package contains malware" if match

Recipe 5: detect non-compliant licenses used in a Docker image

Use case: Check whether any components or transitive dependencies of a Docker image have a copyleft license.

What It Does:

  • Defines a set of known copyleft SPDX identifiers.
  • Triggers if any component of the Docker image has a copyleft license.
rego
package cloudsmith

import rego.v1

default match := false

# Match components with copyleft SPDX licenses
# Comprehensive list of copyleft licenses from https://spdx.org/licenses/

# GNU General Public License (GPL) variants
gpl_licenses := {
    "GPL-1.0-only",
    "GPL-1.0-or-later",
    "GPL-2.0",
    "GPL-2.0-only",
    "GPL-2.0-or-later",
    "GPL-3.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
}

# GNU Lesser General Public License (LGPL) variants
lgpl_licenses := {
    "LGPL-2.0",
    "LGPL-2.0-only",
    "LGPL-2.0-or-later",
    "LGPL-2.1",
    "LGPL-2.1-only",
    "LGPL-2.1-or-later",
    "LGPL-3.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
}

# GNU Affero General Public License (AGPL) variants
agpl_licenses := {
    "AGPL-1.0",
    "AGPL-1.0-only",
    "AGPL-1.0-or-later",
    "AGPL-3.0",
    "AGPL-3.0-only",
    "AGPL-3.0-or-later",
}

# Mozilla Public License (MPL) variants
mpl_licenses := {
    "MPL-1.0",
    "MPL-1.1",
    "MPL-2.0",
}

# Common Development and Distribution License (CDDL) variants
cddl_licenses := {
    "CDDL-1.0",
    "CDDL-1.1",
}

# Eclipse Public License (EPL) variants
epl_licenses := {
    "EPL-1.0",
    "EPL-2.0",
}

# Open Software License (OSL) variants
osl_licenses := {
    "OSL-1.0",
    "OSL-2.0",
    "OSL-3.0",
}

# GNU Free Documentation License (GFDL) variants
gfdl_licenses := {
    "GFDL-1.1-only",
    "GFDL-1.1-or-later",
    "GFDL-1.2-only",
    "GFDL-1.2-or-later",
    "GFDL-1.3-only",
    "GFDL-1.3-or-later",
}

# Creative Commons Share Alike (CC-BY-SA) variants
cc_by_sa_licenses := {
    "CC-BY-SA-1.0",
    "CC-BY-SA-2.0",
    "CC-BY-SA-2.5",
    "CC-BY-SA-3.0",
    "CC-BY-SA-4.0",
}

# Other copyleft licenses
other_copyleft_licenses := {
    "QPL-1.0",
    "Sleepycat",
    "SSPL-1.0",
    "copyleft-next-0.3.0",
}

# Combined copyleft license set
copyleft := gpl_licenses | lgpl_licenses | agpl_licenses | mpl_licenses | cddl_licenses | epl_licenses | osl_licenses | gfdl_licenses | cc_by_sa_licenses | other_copyleft_licenses

match if {
    input.v0.sbom != null
    component := input.v0.sbom.components[_]
    component.licenses != null
    license_entry := component.licenses[_]
    license_entry.license != null
    license_id := license_entry.license.id
    license_id in copyleft
}

Recipe 6: compare package versions

Use case: Match any package with a specific version range.

What It Does:

  • Evaluates the version of a package against a specified package version.
  • Triggers if the version of the current package being evaluated is older than the specified package version.
rego
package cloudsmith

default match := false

match if count(reason) > 0

reason contains msg if {
	pkg := input.v0.package
	pkg.name == "h11"

	# Parse versions using Cloudsmith's semantic version comparator
	semver.compare(pkg.version, "0.16.0") == -1

	msg := sprintf("Package 'h11' version '%s' is older than 0.16.0", [pkg.version])
}