Documentation
Book a demo

Supply chain security

Block until scan

Block until scan is deprecated

Strict mode for policies, now in early access, replaces block until scan and lets you apply this behavior per upstream.

Block until scan will be retired in Q1 2027. Cloudsmith will contact you to plan your migration. For details, see Migrating from block until scan.

Block until scan is a security feature designed to enhance the integrity and security of software packages served by Cloudsmith, guaranteeing that all relevant security and compliance policy checks (licenses, vulnerabilities, package deny policies) are fully completed before a package is made available for download.

By enabling block until scan, all package requests originating from upstreams configured in "Cache and Proxy" or "Cache Only" mode are subjected to a mandatory scanning and policy evaluation process. This ensures that only packages meeting your organization's security policies can be accessed by users.

Without block until scan, packages could be served to clients before all necessary policy checks were completed (unless the package was already synced in the repository, and policy checks had been completed prior to that). This allowed for the initial download of packages that may subsequently fail policy checks.

How to use it

Important

Workspace-wide setting

Please note that block until scan is a global setting that affects all repositories within a given workspace. Its activation will impact all applicable package flows.

Requirements

  • Active Security Policies: At least one active standard policy with a quarantine action enabled, or at least one enabled policy as code policy, is required. Without such a policy, the system would have no criteria to evaluate incoming packages.
  • Upstream Configuration ('Cache and Proxy' or 'Cache Only' mode): the repository must have an upstream configured with 'Cache and Proxy' or 'Cache Only' mode enabled. Block until scan is explicitly applied to packages undergoing the caching and evaluation pipeline within Cloudsmith. Upstreams in 'Proxy Only' mode are not affected.

Steps to validate block until scan

To verify the functionality of block until scan, follow these steps:

1. Configure an upstream

Configure a repository with an upstream in 'Cache and Proxy' mode. For example, enable a Python upstream with PyPI.

Note

📘 Note that incoming packages from sources different to an upstream are also subjected to block until scan. Downloads won't be allowed until all security checks have been completed.

2. Create a vulnerability policy

Browse to your Workspace Settings and create a new vulnerability policy. Define your policy with:

  • A name.
  • A package Search Query to scope the filter to format:python AND name:^requests$. We're targeting only the Python package named exactly requests, following the example in the next step. Adjust the policy so that it applies only to your desired scope if you use a different package for this example.
  • A severity threshold set to High.
  • A Quarantine action enabled.

Then, click + Create Policy.

3. Pull a new package from your repository

Execute a command to pull a new package. For example, requests==1.2.0. This package contains a known vulnerability with a high severity CVE: 2018-18074. If this package already exists in your repository, find a different one that hasn't been synced and cached before:

bash
pip download requests==1.2.0 --index-url https://dl.cloudsmith.io/public/demo-docs/awesome-repo/python/simple/

Note

📘 Performance Impact

When a package is not yet cached within Cloudsmith, every package and its dependencies must undergo a series of synchronous operations before being served:

  • Parsing: The package metadata must be parsed.
  • Scanning: The package is scanned for malware, vulnerabilities, and license compliance.
  • Policy Evaluation: The package is evaluated against all active policies.

4. Observe behavior

When block until scan is enabled, the initial download request for an uncached package will be temporarily blocked until the policy evaluation has completed:

  • No Blocking Policy Matched: If no policy blocks the package, the download will proceed, and the package will be served normally.
  • Policy Matched: If the package is matched against a policy, the package is processed exactly as the matched policy specifies:
    • If the policy's action is quarantine, the package is quarantined and any download attempt returns 403 Forbidden.
    • If the policy's action is tag, allow, or any other non-blocking action, the package is served normally (with the tag or other metadata applied).

A download returns 403 Forbidden only when a policy quarantines or denies the package. If security checks fail, the package is evaluated without their results and is served unless another policy blocks it. If policy evaluation fails, the download stays blocked: the package manager keeps being redirected until it reaches its redirect or timeout limit and reports an error. Cloudsmith retries failed evaluations for policy as code policies; for standard license and vulnerability policies, the package stays blocked until its security checks are re-run, it is resynced, or a policy backfill is issued.

First download without block until scan

Without block until scan, the same package would be delivered to the user immediately, before the full evaluation phase of the synchronization process had taken place. Cloudsmith would then asynchronously cache and synchronize the package after the first download. At this point, the system would apply the policy to the package and could then quarantine it. While future downloads of the package would then be blocked, this asynchronous processing means the initial downloads of the package could not be prevented if required.

Summary

Block until scan helps your organization ensure that all software packages and their dependencies downloaded through Cloudsmith meet your security and compliance rules. While this scanning happens before you can download packages, the advantages are significant:

  • Enforce Security Policies across all your organization: It blocks any package downloads until security checks have been completed. Only approved software components are used in your workloads, guaranteeing compliance with organizational standards and practices.
  • Reduced Risk: checking packages before running them reduces your exposure to non-compliant software.

In short, block until scan is a crucial tool for securing and reducing risk in your software supply chain.