Hex (Elixir and Erlang)

Mirror URL	https://packages.vulnetix.com/hex
Ecosystem ID	hex
Plan	Add-on
Mode	gate: the signed registry is streamed unchanged; tarballs/*.tar and docs/*.tar are checked
Cooldown	no (gate mode)
Default mirror	https://repo.hex.pm

Automatic setup

vulnetix package-firewall hex
source ~/.config/vulnetix/package-firewall/hex.env

~/.config/vulnetix/package-firewall/hex.env:

export HEX_MIRROR="https://YOUR_ORG_UUID:YOUR_API_KEY@packages.vulnetix.com/hex"

Hex has no separate auth file for a mirror and honours credentials in the mirror URL. Add the source line to your shell profile, or set HEX_MIRROR as a CI secret.

Use and verify

echo "$HEX_MIRROR" | sed 's#//[^@]*@#//***@#'
mix deps.get

Notes

• Because the registry is signed and served unchanged, resolution can pick a blocked version; the fetch of that tarball then fails with the block status. Pin an allowed version in mix.exs and run mix deps.unlock <dep>.