PackageFirewallPolicy

The tenant’s package firewall policy: what the registry proxy refuses to serve, the posture it enforces in, per-ecosystem posture overrides, and the upstream mirrors it fetches from. One per tenant. The allow and deny lists are PackageList objects. A field left out keeps its current value.

apiVersion	vulnetix.com/v1
kind	PackageFirewallPolicy
Group	Package firewall
Status	Served. The config engine plans and applies it.
Objects per tenant	one (metadata.name: default)
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists PackageFirewallPolicy in its kinds. See Management tokens.
Terraform resource	vulnetix_package_firewall_policy, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.157.0 and later.
Pinned schema	v1.15.0/PackageFirewallPolicy.schema.json
Newest schema	latest/PackageFirewallPolicy.schema.json
First released in	v1.1.0
Print the built-in copy	vulnetix config schema PackageFirewallPolicy

Minimal

Only the fields the kind requires. From examples/PackageFirewallPolicy/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/PackageFirewallPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: PackageFirewallPolicy
metadata:
  name: default
spec: {}

HCL (resource vulnetix_package_firewall_policy)

# Only the arguments the kind requires. From config-schemas examples/PackageFirewallPolicy/minimal.yaml.

resource "vulnetix_package_firewall_policy" "default" {
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/PackageFirewallPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: PackageFirewallPolicy
metadata:
  name: default
spec: {}
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/PackageFirewallPolicy/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/PackageFirewallPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: PackageFirewallPolicy
metadata:
  name: default
  labels:
    team: platform-security
  annotations:
    ticket: https://jira.example.com/browse/SEC-2210
spec:
  mode: enforce
  thresholds:
    cvss: 9.0
    epss: 0.5
    cess: 8.0
  block:
    malware: true
    eol: true
    kev: true
    weaponized: true
    active: true
    poc: false
    badActors: true
  cooldownDays: 3
  versionLag: 10
  review:
    staleDecisionDays: 180
    staleUsageDays: 60
  ecosystems:
    npm: { mode: allowlist_only }
    go: { mode: warn }
    pypi: { mode: enforce }
  mirrors:
    - ecosystem: go
      url: https://proxy.golang.org
      priority: 0
      active: true
    - ecosystem: go
      url: https://goproxy.io
      priority: 1
      active: false
    - ecosystem: npm
      url: https://registry.npmjs.org
      priority: 0
    - ecosystem: pypi
      url: https://pypi.org/simple
      priority: 0

HCL (resource vulnetix_package_firewall_policy)

# Every argument the kind supports. From config-schemas examples/PackageFirewallPolicy/advanced.yaml.

resource "vulnetix_package_firewall_policy" "default" {
  block = {
    active     = true
    bad_actors = true
    eol        = true
    kev        = true
    malware    = true
    poc        = false
    weaponized = true
  }
  cooldown_days = 3
  ecosystems = {
    go = {
      mode = "warn"
    }
    npm = {
      mode = "allowlist_only"
    }
    pypi = {
      mode = "enforce"
    }
  }
  mirrors = [
    {
      active    = true
      ecosystem = "go"
      priority  = 0
      url       = "https://proxy.golang.org"
    },
    {
      active    = false
      ecosystem = "go"
      priority  = 1
      url       = "https://goproxy.io"
    },
    {
      ecosystem = "npm"
      priority  = 0
      url       = "https://registry.npmjs.org"
    },
    {
      ecosystem = "pypi"
      priority  = 0
      url       = "https://pypi.org/simple"
    },
  ]
  mode = "enforce"
  review = {
    stale_decision_days = 180
    stale_usage_days    = 60
  }
  thresholds = {
    cess = 8
    cvss = 9
    epss = 0.5
  }
  version_lag = 10
  labels = {
    team = "platform-security"
  }
  annotations = {
    ticket = "https://jira.example.com/browse/SEC-2210"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/PackageFirewallPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: PackageFirewallPolicy
metadata:
  name: default
  labels:
    team: platform-security
  annotations:
    ticket: https://jira.example.com/browse/SEC-2210
spec:
  mode: enforce
  thresholds:
    cvss: 9.0
    epss: 0.5
    cess: 8.0
  block:
    malware: true
    eol: true
    kev: true
    weaponized: true
    active: true
    poc: false
    badActors: true
  cooldownDays: 3
  versionLag: 10
  review:
    staleDecisionDays: 180
    staleUsageDays: 60
  ecosystems:
    npm: { mode: allowlist_only }
    go: { mode: warn }
    pypi: { mode: enforce }
  mirrors:
    - ecosystem: go
      url: https://proxy.golang.org
      priority: 0
      active: true
    - ecosystem: go
      url: https://goproxy.io
      priority: 1
      active: false
    - ecosystem: npm
      url: https://registry.npmjs.org
      priority: 0
    - ecosystem: pypi
      url: https://pypi.org/simple
      priority: 0
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly PackageFirewallPolicy	Always PackageFirewallPolicy.
metadata	object	yes		no other keys	Metadata for a kind the tenant has exactly one of. The name is fixed to default.
metadata.name	string	yes		exactly default; pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.mode	string	no	enforce	enforce, warn, allowlist_only	The tenant’s default posture. enforce blocks what the policy says to block. warn only observes: every block becomes an advisory logged as WARN, except a deny-list hit, which always blocks. allowlist_only refuses any package without an allow entry.
spec.thresholds	object	no		no other keys	Block a version with a vulnerability scoring at or above a threshold. 0 turns that threshold off.
spec.thresholds.cvss	number	no	0	0 to 10	CVSS base score, 0 to 10.
spec.thresholds.epss	number	no	0	0 to 1	EPSS probability, 0 to 1.
spec.thresholds.cess	number	no	0	0 to 10	Coalition ESS score, 0 to 10.
spec.block	object	no		no other keys	Signals that block a version on their own. All default to false.
spec.block.malware	boolean	no	false		Known malware.
spec.block.eol	boolean	no	false		The version’s product is past end of life.
spec.block.kev	boolean	no	false		A vulnerability in a known-exploited catalogue.
spec.block.weaponized	boolean	no	false		A vulnerability with a weaponised exploit.
spec.block.active	boolean	no	false		A vulnerability exploited in the wild.
spec.block.poc	boolean	no	false		A vulnerability with a public proof of concept.
spec.block.badActors	boolean	no	false		A maintainer or signing key attributed to a known threat actor.
spec.cooldownDays	integer	no	0	>= 0	Block a version published fewer than this many days ago. 0 turns it off.
spec.versionLag	integer	no	0	>= 0	Block a version more than this many releases behind its package’s newest servable release (rank 0 is the newest, so 2 serves the three newest). Versions already blocked, and on npm versions still inside the cooldown, are not counted, so lag and cooldown together never remove every version. 0 turns it off. Enforced only for ecosystems whose proxy can list every version, and not in warn mode. Note that this is the opposite of the QualityGate versionLag check.
spec.review	object	no		no other keys	When the console flags a curation decision for review. Read by the console only, never by the proxy.
spec.review.staleDecisionDays	integer	no	90	>= 1	Days since a list entry was decided or last re-affirmed.
spec.review.staleUsageDays	integer	no	90	>= 1	Days since the proxy last saw traffic for a list entry.
spec.ecosystems	object	no		map of string to object	Per-ecosystem posture, keyed by ecosystem, overriding mode. An ecosystem left out inherits mode.
spec.ecosystems.<key>	object	no		no other keys
spec.ecosystems.<key>.mode	string	yes		enforce, warn, allowlist_only
spec.mirrors	array of object	no			The upstream registries the proxy fetches from. When set, this is the whole list: mirrors not named are removed.
spec.mirrors[].ecosystem	string	yes		go, go-dev, npm, pypi, cargo, gem, hex, pub, maven, nuget, composer, conan, conda, cran, julia, oci, debian, rpm, alpine, helm, chef, terraform, aur, arch, homebrew, homebrew-bottle	A package ecosystem the firewall proxies, by its firewall id.
spec.mirrors[].url	string	yes		format uri	The registry’s base URL.
spec.mirrors[].priority	integer	no	0		Order within the ecosystem, lowest tried first.
spec.mirrors[].active	boolean	no	true

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.
• Singleton. There is one per tenant, and its name is always default.

How apply treats it

• Scalars merge: a field the document leaves out keeps its value, as the console’s save does.
• ecosystems and mirrors, when present, are the whole set. An ecosystem the document does not name inherits mode again, and a mirror it does not name is removed.
• Mirrors are matched by ecosystem and URL, so a priority change updates that mirror and keeps its crawl position.
• The allow and deny lists are PackageList objects, applied after this one.

Terraform and OpenTofu

The resource is vulnetix_package_firewall_policy in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_package_firewall_policy.

Import an object that already exists by its name (default):

# Import an existing PackageFirewallPolicy by its name (metadata.name).
terraform import vulnetix_package_firewall_policy.default default

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/PackageFirewallPolicy/default.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/PackageFirewallPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: PackageFirewallPolicy
metadata:
  name: default
spec:
  mode: enforce
  thresholds:
    cvss: 9.0
    epss: 0.5
  block:
    malware: true
    kev: true
    weaponized: true
    badActors: true
  cooldownDays: 3
  review:
    staleDecisionDays: 180
  ecosystems:
    npm: { mode: allowlist_only }
    go: { mode: warn }
  mirrors:
    - ecosystem: go
      url: https://proxy.golang.org
      priority: 0
    - ecosystem: go
      url: https://goproxy.io
      priority: 1
    - ecosystem: npm
      url: https://registry.npmjs.org

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.