Product guide
Evaluate proxy packages before consumption
Turn proxy repository requests into PASS, WARN, or BLOCK decisions using OSV intelligence and applicable policy.
Decision flow
The package coordinate is matched against OSV data, organization/project/repository scope is resolved, and the decision is written to audit history.
From request to decision
Firewall evaluation applies to package resolution that would reach an upstream through a Proxy repository. After request identity, repository context, and package coordinates are resolved, intelligence matches and prioritized policy scope are evaluated.
- PASS: applicable rules produce no result that blocks the download.
- WARN: risk remains visible and traceable; target-client behavior is validated separately in acceptance testing.
- BLOCK: the policy decision denies package consumption and records decision evidence.
- NOT_EVALUATED: absence of the required intelligence or policy context is handled as a distinct result.
Supported firewall formats
The Repository Firewall matcher evaluates nine proxy formats: Maven, npm, PyPI, NuGet, Go, Cargo, RubyGems, APT, and YUM/DNF. This list is distinct from the broader Artifact Management format scope; for example, Docker/OCI artifact repositories are supported but are not in the current firewall matcher scope.
Navigation between evidence pages
Vulnerability coverage in the firewall table opens the related advisory records. An advisory identity deep-links to exact search on Vulnerabilities, while a risk-acceptance task identity filters the firewall table to the same repository, package, and version scope.
Scope and precedence
Applicable policy is resolved from organization, project, and repository relationships plus rule priority. Anonymous access, upstream credentials, and repository sharing are separate access controls from the policy decision; none replaces another.
Operational evidence
In acceptance testing, exercise PASS, WARN, BLOCK, and, where context is absent, NOT_EVALUATED for the same package. Reconcile the client result with the firewall decision, audit or operation record, upstream access, and cache behavior under the same correlation context.
Current boundary
Decision inputs are OSV vulnerability data and severity/policy rules. Malware, license, and namespace-confusion analysis are outside the current scope.