Package Firewall
What the Package Firewall proxy does, the ecosystems it fronts, which are free and which need the add-on, and how each one is enforced.
The Package Firewall is an authenticating proxy at https://packages.vulnetix.com. You point a package manager at it instead of the public registry. For every request it checks your organization’s credentials and add-on, fetches the document from an upstream mirror, applies your organization’s policy and curation lists, and then serves, filters or refuses the response.
Policy is per organization and applies to every ecosystem your organization can use. You configure it in the Resolve Platform at www.vulnetix.com/resolve/package-firewall or with vulnetix config set package-firewall.
Ecosystems
Each ecosystem has a route prefix under https://packages.vulnetix.com. Go is served at the root.
| Ecosystem | ID | Proxy URL | Mode | Plan | Cooldown | vulnetix package-firewall |
|---|---|---|---|---|---|---|
| Go modules | go |
/ |
native | Add-on | yes | go |
| pkg.go.dev API | go-dev |
/go-dev |
filter | Free | no | go-dev |
| Arch Linux (AUR) | aur |
/aur |
filter | Free | yes | aur |
| Arch Linux (pacman) | arch |
/arch |
gate | Add-on | no | aur (staged files) |
| npm | npm |
/npm |
filter | Add-on | yes | npm |
| PyPI | pypi |
/pypi |
filter | Add-on | yes | pypi |
| Cargo | cargo |
/cargo |
filter | Add-on | yes | cargo |
| RubyGems | gem |
/gem |
filter | Add-on | yes | gem |
| Hex | hex |
/hex |
gate | Add-on | no | hex |
| pub.dev | pub |
/pub |
filter | Add-on | yes | pub |
| Maven and Gradle | maven |
/maven |
filter | Add-on | no | maven |
| NuGet | nuget |
/nuget |
filter | Add-on | yes | nuget |
| Composer | composer |
/composer |
filter | Add-on | yes | composer |
| Conan | conan |
/conan |
gate | Add-on | no | conan |
| Conda | conda |
/conda |
gate | Add-on | no | manual |
| CRAN | cran |
/cran |
gate | Add-on | no | cran |
| Julia | julia |
/julia |
gate | Add-on | no | manual |
| Homebrew | homebrew, homebrew-bottle |
/homebrew, /homebrew-bottle |
filter (API), gate (bottles) | Add-on | no | homebrew |
| Docker and OCI | oci |
/v2 |
filter (tag lists), gate (manifests) | Add-on | no | manual |
| Debian and Ubuntu | debian |
/debian |
gate | Add-on | no | manual |
| RPM | rpm |
/rpm |
gate | Add-on | no | manual |
| Alpine | alpine |
/alpine |
gate | Add-on | no | manual |
| Helm | helm |
/helm |
filter | Add-on | yes | helm |
| Chef | chef |
/chef |
filter | Add-on | yes | manual |
| Terraform | terraform |
/terraform |
filter | Add-on | no | manual |
- ID is the value you use for mirrors, curation entries and decision-log filters.
- Plan: Free means every account can use it on any plan: the pkg.go.dev API (
go-dev) and the AUR (aur). Add-on means the organization has the Package Firewall add-on ($125 a month, bought in the Resolve Platform under Billing) or is on the Enterprise plan, which includes every add-on. That covers every other ecosystem, including the Go module proxy at/, Arch Linux (pacman), Homebrew and its bottles. The Resolve Platform plan (Community, Pro, Business or Enterprise) no longer decides which ecosystems you can use. A request for an add-on ecosystem without the add-on returns402; see Block responses. - Cooldown says whether the cooldown window is enforced for that ecosystem today.
- manual means
vulnetix package-firewall <ecosystem>exits 1 withautomatic <name> configuration is not implemented yet. The client page gives the configuration to write yourself.
Filter, gate and native
The mode is fixed per ecosystem so the firewall never breaks a registry’s signature checks. You do not choose it.
| Mode | Metadata | Blocked version |
|---|---|---|
| filter | Buffered and rewritten. Blocked and cooldown versions are removed, so the resolver never picks them. | The artifact request for a pinned blocked version returns a block status. |
| gate | Streamed through unchanged, because it is signed, content-addressed or too large to buffer. | The artifact download returns a block status. |
| native | Go’s module proxy protocol. Each @v/<version> request is checked. |
.info, .mod and .zip for that version return a block status. |
Details of the request path are on How it works.
Get started
- Sign in with the CLI:
vulnetix auth login. - Point a package manager at the firewall, for example
vulnetix package-firewall npm. See Quickstart. - Set a policy:
vulnetix config set package-firewall --block-malware true --block-kev true. See Policy settings. - Watch decisions in the decision log.
Platform IaC
The firewall policy and its mirrors are the PackageFirewallPolicy kind, and the allow and deny lists are PackageList documents of purls. A list entry can take a when over the package’s signals (malware, CVSS, EPSS, KEV, age and more); see CEL rule expressions. vulnetix config set package-firewall and config get package-firewall are the imperative forms (see CLI commands). Both kinds have Terraform resources: Terraform and OpenTofu.
When Drift protection is on, a change made in the console or through a legacy API to the package firewall policy or its package lists that is managed as code (by Terraform or a repository) is refused with HTTP 409 managed_by_platform_iac. Change it where it is declared, or ask an admin to turn Drift protection off.