Policy management

Package deny policy

Package deny policies let you control which packages can be downloaded from your workspace's repositories.

With a package deny policy, you can specify criteria in the form of a package_query_string, to identify packages that should be blocked from download. By defining these rules, organizations can enforce stricter security measures and maintain tighter control over their software artifacts.

Supported package formats

This feature applies to all formats.

Docker SBOM
Package deny policies don't apply to components inside of a Docker image.
While package deny policies can be applied to Docker images by their package name (pull string) or image digest, they won't apply to any internal components. For example, a deny policy with the package query format:python won't block Docker images containing Python artifacts within the Software Bill of Materials (SBOM).

Scope

Deny policies are applied at the workspace level.

Manage package deny policies

To manage the package deny policies in your workspace, go to the Policies tab of the overview page in the Cloudsmith web app and click Package deny.

Create a package deny policy

To create a new package deny policy, click +Create package deny policy. You are then presented with the Create package deny policy form:

The following fields and options are available:


Policy name	A display name for the package deny policy. This name will be visible to users who view a package that violates this policy, as a reason for the violation.
Description	A description of the package deny policy. This description will be visible to users who view a package that violates this policy, as a reason for the violation.
Package query	A search query that you can use to target this policy at a specific repository, package format or package name. See Package search syntax for more details on the available fields you can filter by. The query string box (limited to 256 chars in length) to specify a search-query string to match packages against. Matched packages will then be blocked across the workspace. TIP: To ensure your search query will block the packages you want to block from download, test your search query first, using the "Search all packages..." box at the top of the Repositories tab. Confirm that the results of your query are the packages that you intend to block.
Enabled	You can disable a rule temporarily, without deleting the rule.

Tip
We recommend that you create a package deny policy for each package you want to block.

For example:
format:npm AND name:^@react-native-community/cli-server-api$ AND version:<=20.0.0-alpha.2 AND version:>=4.8.0

Propagating a new package deny policy

New/Uncached packages: Policies are applied instantly to any package proxied directly from an upstream source.
Existing/Cached packages: Cloudsmith automatically runs new policies against all repositories in your workspace. This background process may take time depending on your artifact count.

Tip
If you need to act on cached artifacts immediately, manually quarantine them using the Cloudsmith web app or API.

You can check the status of a newly created deny policy via our deny policy list API endpoint, which returns Pending while the new policy is being propagated. The status will change to Complete when the policy is fully implemented across your workspace.

Even after a new deny policy is fully propagated, a user who has recently downloaded a package may still be able to download it again for a short period of time due to CDN caching.

What gets blocked

Download requests are blocked for a specific package (or version of a package, if your search string specifies one). This includes the initial download of the package, even if it is proxied through from an upstream.

Audit logs

Audit logs are generated whenever users create, update, or delete a package deny policy:

Unblock a package that violates a policy

To remove a policy violation, you have several options depending on your user permissions:

Delete the policy
Upgrade the package to a version outside of the policy
Edit the policy to allow the package by using the query string language syntax
Temporarily disable the policy

Updated 2 weeks ago