{"id":43846947,"url":"https://github.com/cloudsmith-io/rego-recipes","last_synced_at":"2026-02-06T06:06:11.275Z","repository":{"id":304979547,"uuid":"1021477662","full_name":"cloudsmith-io/rego-recipes","owner":"cloudsmith-io","description":"Cloudsmith EPM Rego samples","archived":false,"fork":false,"pushed_at":"2025-12-02T16:41:28.000Z","size":195,"stargazers_count":4,"open_issues_count":2,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-05T15:13:20.998Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cloudsmith-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-17T13:04:52.000Z","updated_at":"2025-12-02T16:41:32.000Z","dependencies_parsed_at":"2025-07-17T19:22:13.131Z","dependency_job_id":"59e7054b-71f0-4c14-8643-3786eaa2d259","html_url":"https://github.com/cloudsmith-io/rego-recipes","commit_stats":null,"previous_names":["cloudsmith-io/rego-recipes"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cloudsmith-io/rego-recipes","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudsmith-io%2Frego-recipes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudsmith-io%2Frego-recipes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudsmith-io%2Frego-recipes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudsmith-io%2Frego-recipes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cloudsmith-io","download_url":"https://codeload.github.com/cloudsmith-io/rego-recipes/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudsmith-io%2Frego-recipes/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29153201,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-06T02:39:25.012Z","status":"ssl_error","status_checked_at":"2026-02-06T02:37:22.784Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-02-06T06:06:10.360Z","updated_at":"2026-02-06T06:06:11.253Z","avatar_url":"https://github.com/cloudsmith-io.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cloudsmith EPM Recipes\nA curated collection of Enterprise Policy Management (EPM) recipes for Cloudsmith - combining practical OPA Rego policy samples, action configurations, and testing guides to help you define, simulate, and enforce package lifecycle rules across your repositories.\n\u003cbr/\u003e\u003cbr/\u003e\nThis repository includes:\n- Rego policies tailored for Cloudsmith’s EPM engine, using the supported input schema and policy format.\n- Policy action configurations (```SetPackageState```, ```AddPackageTags```, etc.) with examples showing how to order and associate them by precedence.\n- Simulation and deployment instructions using Cloudsmith’s API, including how to safely test policies before enforcement.\n- Helper scripts and workflows to automate policy testing and promotion.\n\nThese recipes are designed to be modular, auditable, and production-ready - with a strong emphasis on policy-as-code best practices.\n\n***\n\n### Table of Rego Samples\n\n| Name | Description |\n| --- | --- |\n| [Enforcing Signed Packages](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-1---enforcing-signed-packages) | This policy enforces mandatory ```GPG/DSA signature``` checks on packages during their sync/import into Cloudsmith |\n| [Restriction Based on Tags](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-2---restricting-package-based-on-tags) | This policy checks whether a package includes specific ```deprecated``` tag and marks it as match if present |\n| [Copy-Left licensing](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-3---copyleft-or-restrictive-oss-licenses) | This policy is designed to detect a broad range of copyleft licenses, including free-text and SPDX variants |\n| [Quarantine Debug Builds](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-4---restricting-package-based-on-tags) | Identify and quarantine packages that look like debug/test artifacts based on filename or metadata patterns |\n| [Limit Tag Sprawl](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-5---limit-tag-sprawl) | Flag any packages that have more than a threshold number of tags to avoid ungoverned tagging behaviours |\n| [Enforce Consistent Filename](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-6---enforce-consistent-filename-convention) | Validate whether the filename convention matches a semantic or naming pattern via Regular Expressions |\n| [Approved Upstreams based on Tags](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-7---approved-upstreams-based-on-tags) | Only packages from explicitly approved upstream sources are permitted, helping to prevent the propagation of unvetted or insecure dependencies. |\n| [CVSS Policy with Fix Available](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-8---cvss-with-fix-available) | Match packages in a specific repo that have high/critical fixed vulnerabilities, excluding specific known CVEs. |\n| [Time-Based CVSS Policy](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-9---time-based-cvss-policy) | Evaluate CVEs older than 30 days. Checks CVSS threshold ≥ 7. Filters for a specific repo. Ignores certain CVE |\n| CVSS with EPSS context | Combines High scoring CVSS vulnerability with EPSS scoring context that go above a specific threshold. |\n| [Architecture allow list](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-11---architecture-specific-allow-list) | Policy that only allows ```amd64``` architecture packages and blocks others like arm64. |\n| [Block package if version over 0.16.0](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-12---block-package-xyz-if-version--0160) | ```semver.compare(pkg.version, \"0.16.0\") == -1``` should check if the version is less than ```0.16.0``` using semver-aware comparison. |\n| [Block specific CVE numbers](https://github.com/cloudsmith-io/rego-recipes?tab=readme-ov-file#recipe-15---block-specifically-based-on-cves) | Blocks a specific package based on known CVE numbers |\n| [Enforce Upload Time Window](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-16---suspicious-package-upload-window) | Allow uploads during business hours (9 AM – 5 PM UTC), to catch anomalous behaviour like late-night uploads |\n| [Tag-based bypass Exception](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-17---tag-based-exception-policy) | This is a simple tag-based exception. |\n| [Exact allowlist with CVSS limit exemption](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-18---exact-allowlist-exception-policy-with-cvss-ceiling) | Use when you want tight control per version, but still prevent exemptions if a CVSS exceeds a ceiling. |\n| [Malware advisory](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-19---malware-advisory) | Match for malware advisory. |\n| [npm last published date](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-20---npm-last-published-date) | Use when you want to tag or stop devs from using the latest npm package. |\n| [Exact blocklist by format/name/version](https://github.com/cloudsmith-io/rego-recipes/tree/main?tab=readme-ov-file#recipe-21---exact-blocklist) | Blocks packages that appear on a known-bad exact list across formats (e.g. npm/python) before your upstream removes them. |\n| [Huggingface Recipes](https://github.com/cloudsmith-io/rego-recipes/blob/main/huggingface-recipes/README.md/) | Policies relating to Hugging Face models/datasets. |\n\n***\n\n### Recipe 1 - Enforcing Signed Packages\nThis policy enforces mandatory GPG/DSA signature checks on packages during their sync/import into Cloudsmith \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-1/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Enforcing Signed Packages\",\n  \"description\": \"This policy enforces mandatory GPG/DSA signature checks on packages during their sync/import into Cloudsmith.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 1\n}\nEOF\n```\n\nOnce the policy is created, here is how you can perform a controlled test. \u003cbr/\u003e\nCreate a simple dummy python package locally that we know for certain is unsigned. \u003cbr/\u003e\nYour policy will trigger, since ```input.v0.package.signed``` will not be present or will default to ```false```.\n\n```\nmkdir dummy_unsigned\ncd dummy_unsigned\necho \"from setuptools import setup; setup(name='dummy_unsigned', version='0.0.1')\" \u003e setup.py\npython3 -m pip install --upgrade build\napt install python3.10-venv\npython3 -m build  # produces dist/dummy_unsigned-0.0.1.tar.gz\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO dist/dummy_unsigned-0.0.1.tar.gz -k \"$CLOUDSMITH_API_KEY\"\n```\n\n***\n\n### Recipe 2 - Restricting Package Based on Tags\nThis policy checks whether a package includes a specific ```deprecated``` tag and marks it as a match if it does. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-2/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Restricting Package Based on Tags\",\n  \"description\": \"This policy checks whether a package includes a specific DEPRECATED tag.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 2\n}\nEOF\n```\n\nOnce ready, download a random package, in this case a python package called ```h11``` and push the package to Cloudsmith with the ```deprecated``` tag to cause the policy violation:\n```\npip download h11==0.14.0\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO h11-0.14.0-py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\"  --tags deprecated\n```\n\n***\n\n### Recipe 3 - Copyleft or restrictive OSS licenses\nThis policy is designed to flag packages that use ```copyleft``` or ```restrictive``` open-source licenses, particularly those unsuitable for production use \u003cb\u003ewithout legal review or approval\u003c/b\u003e. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-3/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Copyleft licensing policy\",\n  \"description\": \"This policy checks packages that are unsuitable for production.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 3\n}\nEOF\n```\n\nOnce ready, download the Python ```Gitlab v.3.1.1``` package that we know has a ```LGPLv3 license``` that should trigger the policy:\n```\npip download python-gitlab==3.1.1\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO python_gitlab-3.1.1-py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\"  --tags lgplv3license\ncloudsmith list packages acme-corporation/acme-repo-one -k \"$CLOUDSMITH_API_KEY\" -q \"format:python AND tag:lgplv3license\"\n```\n\nNote: If you have a tagging response action attached to your policy, you could tag the package with ```non-compliant-license``` for further review:\n\n\u003cimg width=\"856\" height=\"663\" alt=\"Screenshot 2025-07-30 at 14 21 19\" src=\"https://github.com/user-attachments/assets/8f795b5e-6516-4173-ac94-817574697b04\" /\u003e\n\n\u003cimg width=\"1494\" height=\"681\" alt=\"Screenshot 2025-07-30 at 14 28 43\" src=\"https://github.com/user-attachments/assets/d123ea4e-2318-46b2-8aab-aa0c408e08c2\" /\u003e\n\n\n***\n\n### Recipe 4 - Quarantine Debug Builds\nThis policy checks whether a package includes specific ```debug```, ```test```, or ```temp``` descriptors in the filename.\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-4/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Quarantine Debug Builds\",\n  \"description\": \"Identify and quarantine packages that look like debug/test artifacts based on filename or metadata patterns.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 4\n}\nEOF\n```\n\nOnce ready, download ```debugpy``` Python package and push it to Cloudsmith to cause the policy violation:\n```\npip download --no-deps --dest . debugpy \n\u0026\u0026 cloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO debugpy-1.8.14-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n***\n\n### Recipe 5 - Limit Tag Sprawl\nThis policy checks whether a package already includes ```5``` or more assigned tags - conidered as sprawl by some orgs.\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-5/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Limit Tag Sprawl\",\n  \"description\": \"Flag packages that have more than a threshold number of tags to avoid ungoverned tagging behaviours.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 5\n}\nEOF\n```\n\nOnce ready, download ```transformers``` Python and assign it ```5 tags``` during the Cloudsmith push process to cause the policy violation:\n```\npip download transformers --no-deps\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO transformers-4.53.1-py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\" --tags TAG1,TAG2,TAG3,TAG4,TAG5\n```\n\n***\n\n### Recipe 6 - Enforce Consistent Filename Convention\nValidate filename matches a semantic or naming pattern where ```MAJOR```.```MINOR```, and ```PATCH``` are all numeric. \nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-6/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Enforce Consistent Filename Convention\",\n  \"description\": \"Validate filename matches a semantic or naming pattern.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 6\n}\nEOF\n```\n\nA straightforward way to test this policy is to take a package that already has a valid SemVer-compliant filename and rename it by replacing the version number with a placeholder like ```test```:\n\n```\npip download h11==0.14.0\nmv h11-0.14.0-py3-none-any.whl h11-test.whl\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO h11-test.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n***\n\n### Recipe 7 - Approved Upstreams based on Tags\nSimply put, this approves packages based on the specified upstream source. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-7/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Approved Upstreams based on Tags\",\n  \"description\": \"Only packages from explicitly approved upstream sources are permitted, helping to prevent the propagation of unvetted or insecure dependencies.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 7\n}\nEOF\n```\n\nIf a package has ```upstream``` \u003cb\u003eand not\u003c/b\u003e ```approved``` --\u003e allowed\n\u003cbr/\u003e\u003cbr/\u003e\nIf a package has ```approved``` --\u003e blocked (\u003cb\u003eeven if upstream is present\u003c/b\u003e)\n\n\n***\n\n### Recipe 8 - CVSS with Fix Available\nThis policy is designed to match packages in a specific repository (```acme-repo-one```) that have ```high``` or ```critical``` with a ```Fixed version available```, excluding specific ```known CVEs```. \nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-8/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"CVSS with Fix Available\",\n  \"description\": \"Matched packages from a specific repository that have high or critical vulnerabilities that can be patched.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 8\n}\nEOF\n```\n\nTo demonstrate this policy, you can use the ```requests``` Python package, which has a known vulnerability with a high CVSS score.\n\u003cbr/\u003e\u003cbr/\u003e\n\u003cb\u003eVulnerability Details:\u003c/b\u003e\n\u003cbr/\u003e\n- \u003cb\u003ePackage:\u003c/b\u003e  h11\n- \u003cb\u003eAffected Version:\u003c/b\u003e 0.14.0\n- \u003cb\u003eFixed In:\u003c/b\u003e 0.16.0\n- \u003cb\u003eCVE Identifier:\u003c/b\u003e  [CVE-2025-43859](https://access.redhat.com/security/cve/cve-2025-43859)\n- \u003cb\u003eCVSS Context:\u003c/b\u003e This CVE record has been marked for NVD enrichment efforts.\n- \u003cb\u003eDescription:\u003c/b\u003e An HTTP request smuggling vulnerability in python-h11.\n\n```\npip download h11==0.14.0\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO h11-0.14.0-py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\nYou'll probably want to enable a [Quarantine](https://help.cloudsmith.io/docs/package-quarantine) action for policies dealing with critical vulnerabilities that can be fixed:\n\n\u003cimg width=\"965\" height=\"202\" alt=\"Screenshot 2025-07-28 at 10 28 21\" src=\"https://github.com/user-attachments/assets/85f34bd8-247f-4cef-b7e0-93507b60cf48\" /\u003e\n\n\n***\n\n### Recipe 9 - Time-based CVSS Policy\nThis policy is designed to detect and flag packages in a specific repo that contain serious, outdated, but fixed vulnerabilities.\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-9/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Time-based CVSS policy\",\n  \"description\": \"Only matches if the vulnerability was published more than 30 days ago.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 9\n}\nEOF\n```\n\nThis CVE was published on \u003cb\u003e24 April 2025\u003c/b\u003e - much older than the 30 day threshold specified in the policy.\n\n```\npip download h11==0.14.0\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO h11-0.14.0-py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n***\n\n\n### Recipe 11 - Architecture-specific allow list\nThis policy only allows ```amd64``` architecture packages and blocks others like ```arm64```.\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-11/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Architecture-specific allow list\",\n  \"description\": \"Policy that only allows amd64 architecture packages and blocks others like arm64\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 11\n}\nEOF\n```\n\nTo trigger the above policy (which blocks all architectures \u003cb\u003eexcept\u003c/b\u003e ```amd64```), you'd want to upload or sync a Python package that is built for a ```non-amd64``` architecture - like ```arm64```.\n\u003cbr/\u003e\u003cbr/\u003e\nHowever, pip by default fetches packages built for your local system architecture, so you typically won't download architecture-specific wheels unless they're explicitly tagged.\n\u003cbr/\u003e\u003cbr/\u003e\nHere's a command to download a known Python package with an ARM-specific wheel using pip download:\n```\npip download numpy --platform manylinux2014_aarch64 --only-binary=:all: --python-version 38 --implementation cp --abi cp38\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO numpy-1.24.4-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n- ```--platform manylinux2014_aarch64```: targets ```arm64``` (```aarch64```)\n- ```--only-binary=:all:```: avoid source dist, force binary wheel\n- ```--python-version 38``` and ```--abi cp38```: simulate Python 3.8 CPython ABI\n\n\u003cimg width=\"995\" height=\"696\" alt=\"Screenshot 2025-07-28 at 11 26 50\" src=\"https://github.com/user-attachments/assets/cd654f84-3fc9-4cfd-a222-3c4d0f13e22e\" /\u003e\n\n\n***\n\n\n### Recipe 12 - Block Package XYZ if version \u003c 0.16.0\nThis policy matches any ```h11``` packages with a version older than ```0.16.0```: \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-12/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Forced Upgrade of Package Versions\",\n  \"description\": \"Forces teams to periodically upgrade versions of certain package dependencies, so they don't fall too far behind.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 12\n}\nEOF\n```\n\n***\n\n### Recipe 15 - Block specifically based on CVEs\nAgain, the Python package ```requests``` version ```2.6.0``` has the known vulnerability ```CVE-2018-18074```: \u003cbr/\u003e\nWe have commented out the other CVEs in this policy, but feel free remove those comments and add additional CVEs as a list. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-15/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Block specific CVE numbers\",\n  \"description\": \"This policy is only blocking CVE-2018-18074 specifically\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 15\n}\nEOF\n```\n\n```\npip download requests==2.6.0\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO requests-2.6.0-py2.py3-none-any.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n\u003cimg width=\"987\" height=\"742\" alt=\"Screenshot 2025-07-29 at 13 43 39\" src=\"https://github.com/user-attachments/assets/28f44055-8986-4304-a7e7-ad6bb17b47aa\" /\u003e\n\n\n***\n\n\n### Recipe 16 - Suspicious Package Upload Window\nAssuming your organisation don't expect packages to be uploaded or modified at specific times, the below policy can detect package uploads at ```9am-11am UTC``` - regardless of the package name. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-16/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Package Upload Window\",\n  \"description\": \"Flag any package uploaded outside of working hours\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 16\n}\nEOF\n```\n\n```\npip download \u003cpackage-name\u003e\ncloudsmith push python $CLOUDSMITH_ORG/$CLOUDSMITH_REPO \u003cpackage-name\u003e.whl -k \"$CLOUDSMITH_API_KEY\"\n```\n\n***\n\n\n### Recipe 17 - Tag-Based Exception Policy\nUse this policy when you need a quick, time-boxed exception. For example, policy can quarantine by severity; where a separate terminal exemption policy matches if a package has an exempt tag and stops further evaluation.\u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-17/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Tag based exception\",\n  \"description\": \"Exception policy based on basic tagging\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 17\n}\nEOF\n```\n\n**Trade-off:** While the tag remains, new CVEs on that package won’t trigger quarantine. You'll need to review those tags regularly.\n\n***\n\n### Recipe 18 - Exact allowlist exception policy with CVSS ceiling\nUse when you want tight control per version, but still prevent exemptions if a CVSS exceeds a ceiling. \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-18/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Specific allowlist exception\",\n  \"description\": \"Controls based on exact version but still prevent exemptions if a CVSS exceeds a ceiling.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": false,\n  \"precedence\": 18\n}\nEOF\n```\n\n**Trade-off:** While the tag remains, new CVEs on that package won’t trigger quarantine. You'll need to review those tags regularly.\n\n***\n\n### Recipe 19 - Malware advisory\nUse when you want to match based on malware advisory \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-19/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Malware\",\n  \"description\": \"Control malware ingestion.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": true,\n  \"precedence\": 1\n}\nEOF\n```\n***\n\n### Recipe 20 - npm last published date\nUse when you want to match based on the npm last published date on npm upstream \u003cbr/\u003e\nDownload the ```policy.rego``` and create the associated ```payload.json``` with the below command:\n```\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-20/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\n\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"npm last published date on npm upstream\",\n  \"description\": \"Match if the publish date comes after the date of the set number of days ago.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": true,\n  \"precedence\": 1\n}\nEOF\n```\n***\n\n### Recipe 21 - Exact blocklist\n\nThis policy lets you maintain an **exact deny list** of suspicious or malicious packages across formats using the key pattern:\n\n`\u003cformat\u003e:\u003cname\u003e:\u003cversion\u003e` (for example: `npm:@alloc/quick-lru:5.2.0`, `python:requests:2.6.0`).\n\nIt’s especially useful for incident response scenarios like Shai-Hulud-style attacks, where you receive a CSV or text list of impacted packages and need to block them immediately — even before upstream registries have removed them.\n\nDownload the `policy.rego` and create the associated `payload.json` with:\n\n```bash\nwget https://raw.githubusercontent.com/cloudsmith-io/rego-recipes/refs/heads/main/recipe-21/policy.rego\nescaped_policy=$(jq -Rs . \u003c policy.rego)\ncat \u003c\u003cEOF \u003e payload.json\n{\n  \"name\": \"Exact blocklist by format/name/version\",\n  \"description\": \"Blocks packages that appear on an external suspicious or malicious list, using exact format:name:version matches.\",\n  \"rego\": $escaped_policy,\n  \"enabled\": true,\n  \"is_terminal\": true,\n  \"precedence\": 1\n}\nEOF\n\n### Hugging Face recipes\n\nFor policies relating to Hugging Face models and datasets, see [Hugging Face Recipes](https://github.com/cloudsmith-io/rego-recipes/blob/main/huggingface-recipes/README.md/).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudsmith-io%2Frego-recipes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcloudsmith-io%2Frego-recipes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudsmith-io%2Frego-recipes/lists"}