Conda

Point conda channels at the Package Firewall, which streams repodata unchanged and gates package downloads.


Channel URL	`https://packages.vulnetix.com/conda/<channel>`
Ecosystem ID	`conda`
Plan	Add-on
Mode	gate: `repodata.json` is streamed unchanged; `.conda` and `.tar.bz2` downloads are checked
Cooldown	no (gate mode)
Default mirror	`https://conda.anaconda.org`
Automatic setup	none: `vulnetix package-firewall conda` exits 1

A resolve can therefore pick a blocked version; the install then fails on that package’s download with the block status. Pin an allowed version and re-run.

Configuration

~/.condarc:

channels:
  - https://packages.vulnetix.com/conda/conda-forge
default_channels:
  - https://packages.vulnetix.com/conda/main
channel_alias: https://packages.vulnetix.com/conda

The channel path is appended to the mirror, so /conda/conda-forge fetches https://conda.anaconda.org/conda-forge. conda authenticates with ~/.netrc, so run any vulnetix package-firewall <ecosystem> once, or write the netrc entry yourself.

Use and verify

conda config --show channels
conda clean -i
conda install numpy