Policy as code

Rego recipes

Recipe 1: simple tag check

Use case: Match any package with a certain tag. For example: ready-for-production. For this rule, the value of match will be true when any tag.name contains the value provided in required_tag.

rego

package cloudsmith

required_tag := "ready-for-production"

default match := false

match if {
    has_required_tag
}

has_required_tag if {
    some i
	input.v0["package"].tags[i].name == required_tag
}

Recipe 2: high-risk vulnerabilities

Use case: Match packages with high-severity vulnerabilities (CVSS >= 7.0) when a fix is available.

What It Does:

Groups OSV records by ID, aliases, and upstreams, so severity data from one advisory is considered alongside fix data from another for the same vulnerability.
Requires at least one fixed event, so packages with no available remediation are not matched.
Requires a CVSS score at or above cvss_threshold.
Skips vulnerabilities listed in ignored_ids.

rego

# METADATA
# title: High-risk vulnerabilities
# description: Match packages with high-severity vulnerabilities (CVSS >= 7.0) when fixes are available
package cloudsmith

default match := false

cvss_threshold := 7.0

ignored_ids := {} # e.g. {"CVE-2021-9999"}

ids(v) := {v.id} | {a | some a in v.aliases}

vulnerabilities[id] contains v if {
	some v in input.v0.osv
	some id in (ids(v) | {u | some u in v.upstream})
}

scores(records) := {s.numerical_score |
	some v in records
	some s in v.severity
} | {s.numerical_score |
	some v in records
	some a in v.affected
	some s in a.severity
}

has_fix(records) if {
	some v in records
	v.affected[_].ranges[_].events[_].fixed
}

ignored_record(v) if {
	some id in ids(v)
	id in ignored_ids
}

ignored_record(v) if {
	count(v.upstream) > 0
	every u in v.upstream { u in ignored_ids }
}

ignored(records) if {
	some v in records
	ignored_record(v)
}

matching_scores contains score if {
	some records in vulnerabilities
	has_fix(records)
	not ignored(records)
	some score in scores(records)
	score >= cvss_threshold
}

match if count(matching_scores) > 0

reason contains msg if {
	match
	msg := sprintf("Vulnerability at CVSS %.1f with fix available, threshold %.1f", [max(matching_scores), cvss_threshold])
}

Recipe 3: compare software package license to a list of copyleft licenses

Use case: Check whether a software package's license is a copyleft license.

What It Does:

Defines a set of known copyleft SPDX identifiers.
Triggers if the package's license SPDX identifier matches any of those copyleft licenses.

rego

package cloudsmith

default match := false

# GNU General Public License (GPL) variants
gpl_licenses := {
    "GPL-1.0-only",
    "GPL-1.0-or-later",
    "GPL-2.0",
    "GPL-2.0-only",
    "GPL-2.0-or-later",
    "GPL-3.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
}

# GNU Lesser General Public License (LGPL) variants
lgpl_licenses := {
    "LGPL-2.0",
    "LGPL-2.0-only",
    "LGPL-2.0-or-later",
    "LGPL-2.1",
    "LGPL-2.1-only",
    "LGPL-2.1-or-later",
    "LGPL-3.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
}

# GNU Affero General Public License (AGPL) variants
agpl_licenses := {
    "AGPL-1.0",
    "AGPL-1.0-only",
    "AGPL-1.0-or-later",
    "AGPL-3.0",
    "AGPL-3.0-only",
    "AGPL-3.0-or-later",
}

# Mozilla Public License (MPL) variants
mpl_licenses := {
    "MPL-1.0",
    "MPL-1.1",
    "MPL-2.0",
}

# Common Development and Distribution License (CDDL) variants
cddl_licenses := {
    "CDDL-1.0",
    "CDDL-1.1",
}

# Eclipse Public License (EPL) variants
epl_licenses := {
    "EPL-1.0",
    "EPL-2.0",
}

# Open Software License (OSL) variants
osl_licenses := {
    "OSL-1.0",
    "OSL-2.0",
    "OSL-3.0",
}

# GNU Free Documentation License (GFDL) variants
gfdl_licenses := {
    "GFDL-1.1-only",
    "GFDL-1.1-or-later",
    "GFDL-1.2-only",
    "GFDL-1.2-or-later",
    "GFDL-1.3-only",
    "GFDL-1.3-or-later",
}

# Creative Commons Share Alike (CC-BY-SA) variants
cc_by_sa_licenses := {
    "CC-BY-SA-1.0",
    "CC-BY-SA-2.0",
    "CC-BY-SA-2.5",
    "CC-BY-SA-3.0",
    "CC-BY-SA-4.0",
}

# Other copyleft licenses
other_copyleft_licenses := {
    "QPL-1.0",
    "Sleepycat",
    "SSPL-1.0",
    "copyleft-next-0.3.0",
}

# Combined copyleft license set
copyleft := gpl_licenses | lgpl_licenses | agpl_licenses | mpl_licenses | cddl_licenses | epl_licenses | osl_licenses | gfdl_licenses | cc_by_sa_licenses | other_copyleft_licenses

# Main policy rule
match if {
    input.v0.package.license.oss_license.spdx_identifier in copyleft
}

Recipe 4: detect malicious packages

Use case: Check if a package was part of a supply chain attack.

rego

# METADATA
# title: Malware
# description: Match packages with detected malware vulnerabilities
package cloudsmith

default match := false

malicious(vulnerability) if startswith(vulnerability.id, "MAL-")
malicious(vulnerability) if "CWE-506" in vulnerability.database_specific.cwe_ids

match if {
	some vulnerability in input.v0.osv
	malicious(vulnerability)
}

reason contains "Package contains malware" if match

Recipe 5: detect non-compliant licenses used in a Docker image

Use case: Check whether any components or transitive dependencies of a Docker image have a copyleft license.

What It Does:

Defines a set of known copyleft SPDX identifiers.
Triggers if any component of the Docker image has a copyleft license.

rego

package cloudsmith

import rego.v1

default match := false

# Match components with copyleft SPDX licenses
# Comprehensive list of copyleft licenses from https://spdx.org/licenses/

# GNU General Public License (GPL) variants
gpl_licenses := {
    "GPL-1.0-only",
    "GPL-1.0-or-later",
    "GPL-2.0",
    "GPL-2.0-only",
    "GPL-2.0-or-later",
    "GPL-3.0",
    "GPL-3.0-only",
    "GPL-3.0-or-later",
}

# GNU Lesser General Public License (LGPL) variants
lgpl_licenses := {
    "LGPL-2.0",
    "LGPL-2.0-only",
    "LGPL-2.0-or-later",
    "LGPL-2.1",
    "LGPL-2.1-only",
    "LGPL-2.1-or-later",
    "LGPL-3.0",
    "LGPL-3.0-only",
    "LGPL-3.0-or-later",
}

# GNU Affero General Public License (AGPL) variants
agpl_licenses := {
    "AGPL-1.0",
    "AGPL-1.0-only",
    "AGPL-1.0-or-later",
    "AGPL-3.0",
    "AGPL-3.0-only",
    "AGPL-3.0-or-later",
}

# Mozilla Public License (MPL) variants
mpl_licenses := {
    "MPL-1.0",
    "MPL-1.1",
    "MPL-2.0",
}

# Common Development and Distribution License (CDDL) variants
cddl_licenses := {
    "CDDL-1.0",
    "CDDL-1.1",
}

# Eclipse Public License (EPL) variants
epl_licenses := {
    "EPL-1.0",
    "EPL-2.0",
}

# Open Software License (OSL) variants
osl_licenses := {
    "OSL-1.0",
    "OSL-2.0",
    "OSL-3.0",
}

# GNU Free Documentation License (GFDL) variants
gfdl_licenses := {
    "GFDL-1.1-only",
    "GFDL-1.1-or-later",
    "GFDL-1.2-only",
    "GFDL-1.2-or-later",
    "GFDL-1.3-only",
    "GFDL-1.3-or-later",
}

# Creative Commons Share Alike (CC-BY-SA) variants
cc_by_sa_licenses := {
    "CC-BY-SA-1.0",
    "CC-BY-SA-2.0",
    "CC-BY-SA-2.5",
    "CC-BY-SA-3.0",
    "CC-BY-SA-4.0",
}

# Other copyleft licenses
other_copyleft_licenses := {
    "QPL-1.0",
    "Sleepycat",
    "SSPL-1.0",
    "copyleft-next-0.3.0",
}

# Combined copyleft license set
copyleft := gpl_licenses | lgpl_licenses | agpl_licenses | mpl_licenses | cddl_licenses | epl_licenses | osl_licenses | gfdl_licenses | cc_by_sa_licenses | other_copyleft_licenses

match if {
    input.v0.sbom != null
    component := input.v0.sbom.components[_]
    component.licenses != null
    license_entry := component.licenses[_]
    license_entry.license != null
    license_id := license_entry.license.id
    license_id in copyleft
}

Recipe 6: compare package versions

Use case: Match any package with a specific version range.

What It Does:

Evaluates the version of a package against a specified package version.
Triggers if the version of the current package being evaluated is older than the specified package version.

rego

package cloudsmith

default match := false

match if count(reason) > 0

reason contains msg if {
	pkg := input.v0.package
	pkg.name == "h11"

	# Parse versions using Cloudsmith's semantic version comparator
	semver.compare(pkg.version, "0.16.0") == -1

	msg := sprintf("Package 'h11' version '%s' is older than 0.16.0", [pkg.version])
}

Recipe 7: package publish date

Use case: Match new packages for a specific period (e.g. two weeks) after release. Enforcing a time lag before consuming a new package or package version is an effective safeguard to protect against zero-day attacks.

Package publish date is currently available for npm, Python, NuGet, Docker, Ruby, Go, Rust, Conda, and Maven.

How we source publish date metadata:

To ensure the accuracy of your policies, we pull metadata from the most reliable sources for each ecosystem:

npm, Python, NuGet, Go, Rust, Ruby & Conda: Sourced directly from the official registry metadata APIs.

Docker: Retrieved via the Docker Registry Tags API.

Maven: Since Maven repositories don't always provide a native "publish date," this is a best-effort calculation based on the Last-Modified HTTP header of the package's POM file on the upstream server.

What It Does:

Evaluates the publish date of your npm package.
Triggers if your npm package was published within the past 14 days.

rego

package cloudsmith

default match := false

# A package is matched if its upstream publish date is within the past N days.
within_past_days := 14
supported_formats := {"npm"}

match if count(reason) != 0

reason contains msg if {
    pkg := input.v0.package
    within_past_days_date := time.add_date(time.now_ns(), 0, 0, 0 - within_past_days)
    publish_date := time.parse_rfc3339_ns(pkg.upstream_metadata.published_at)

    # Match if the publish date comes after the date of the set number of days ago.
    publish_date >= within_past_days_date
    pkg.format in supported_formats

    msg := sprintf("Package upstream publish date is %v (falls within the past %v days)", [pkg.upstream_metadata.published_at, within_past_days])
}

Updated 4 days ago