Security & Policy

24 tutorials in this category.

01 Known-malicious blocks Why Chainsaw blocks known-malicious package installs at the proxy before policy evaluation, what data backs the gate, and the supported false-positive path. Reference 5 minutes Operators 01 How to Detect Known Malware in Your Supply Chain Understand Chainsaw's malware index powered by OpenSSF data, review malware detections, and configure automatic blocking of malicious packages. Intermediate 20 minutes Security Engineers 01 How to Secure AI/ML Model Downloads with Hugging Face Proxying Route Hugging Face model downloads through Chainsaw, apply supply chain policies to ML artifacts, and monitor AI model consumption. Intermediate 20 minutes Security Engineers / ML Engineers 01 How to Verify Package Provenance with SLSA Attestations Understand provenance statuses, create policies that require verified provenance, and interpret provenance data in the BOM. Advanced 25 minutes Security Engineers 02 How to Detect Mirror Tampering with APT, Yum, and DNF Hash-Chain Provenance Enable end-to-end clearsigned InRelease + repomd.xml.asc verification for OS package mirrors by configuring the trust-root keyring. Advanced 20 minutes Platform Engineers / Security Engineers 02 How to Block Vulnerable Packages Using CVSS and EPSS Score Policies Create policies with vulnerability conditions, set CVSS/EPSS thresholds, and choose between block and quarantine enforcement modes. Intermediate 20 minutes Security Engineers 02 How to Detect and Prevent Typosquatting Attacks Understand Chainsaw's BK-tree typosquat detection, review flagged packages, and create policies that block suspected typosquats. Intermediate 20 minutes Security Engineers 03 How to Enforce License Compliance Across Your Supply Chain Set up SPDX license allowlists and blocklists in policies, monitor license coverage from the dashboard, and handle unknown licenses. Intermediate 20 minutes Security Engineers / Compliance Teams 03 How to Protect Against Dependency Confusion Attacks Configure reserved namespace policies and internal package flags to prevent attackers from hijacking your private package names on public registries. Advanced 20 minutes Security Engineers / DevOps Engineers 04 How to Apply Reserved-Namespace Starter Packs Turn on one-click dependency-confusion protection with the curated reserved-namespace packs shipped in configs/reserved_namespaces_defaults.yaml. Beginner 10 minutes Security Engineers / Platform Engineers 05 How to Detect Install-Script Exfiltration Block PhantomRaven-style dynamic install dependencies and obfuscated eval(atob(...)) payloads with the hasInstallScript and installScriptFetchesRemote conditions. Intermediate 15 minutes Security Engineers 05 How to Use Country and IP-Based Access Policies Configure GeoIP-based policies to restrict package access by country, and create IP allowlists/blocklists for network-level access control. Advanced 20 minutes Security Engineers / Compliance Teams 06 How to Detect Compromised Packages with publisherChanged and versionAnomaly Catch Axios-style maintainer-takeover drops, semver regressions, multi-major skips, and backdated publishes before they reach your builds. Intermediate 20 minutes Security Engineers 06 How to Enable Monitoring for a Single Policy Use per-policy Monitor mode to record audit-only matches on one policy without disabling enforcement on the rest of your policy stack. Intermediate 10 minutes Security Engineers / Platform Engineers 07 How to Detect Hidden Unicode Payloads (GlassWorm / Trojan Source) Block packages carrying zero-width, bidi-override, or Unicode-tag payloads with the hasHiddenUnicode condition. Intermediate 10 minutes Security Engineers 07 How to Enable Checksum Fail-Closed Enforcement Block silently swapped upstream packages by switching CHAINSAW_CHECKSUM_MODE from log to quarantine or block. Advanced 15 minutes Platform Engineers / Security Engineers 08 How to Detect Shai-Hulud-Style Worm Bursts Catch attackers auto-publishing hundreds of packages from a compromised token with the publishVelocityAnomaly condition. Intermediate 15 minutes Security Engineers 09 How to Route Violations to CODEOWNERS-Resolved Owners with ActionNotifyOwner Fire a notification, not a block — when a policy with `ActionNotifyOwner` matches, Chainsaw resolves the manifest's CODEOWNERS team and dispatches via your configured destination map. The minimum-friction way to put accountability on the right team. Intermediate 25 minutes Security Engineers / Engineering Managers 09 How to Scan Container Image Layers and the Docker Malware Feed Catch vulnerabilities hidden beneath a clean manifest with per-layer Trivy scanning, and close the OpenSSF index gap for containers with the Docker-specific feed. Advanced 20 minutes Platform Engineers / Security Engineers 10 Policy DSL Reference (Rego / OPA Authoring Surface) Author custom org-specific rules in Rego against the chainsaw.policy entrypoint: the input fields a rule can read, the decision shape it returns, the supported actions, and which inputs are populated at which enforcement surface. Advanced 30 minutes Security Engineers / Platform Engineers 11 How to Author, Sign, and Load Signed Policy Bundles Ship custom Rego rules as a cosign-signed bundle that the server verifies at load — author, sign, verify-at-load, promote — with the same signed bundle enforced at PR, install, K8s admission, and runtime, and the bundle digest stamped on each policy decision and carried into the audit trail. Advanced 30 minutes Platform Engineers / Security Engineers 11 How to Use Trust Scores to Assess Package Risk Understand the 0-100 composite trust score breakdown, filter by trust score, and build policies around package trust levels. Intermediate 20 minutes Security Engineers / Compliance Teams 12 YAML Conditions vs the Rego Policy DSL Chainsaw has two policy surfaces — the built-in YAML / dashboard conditions and the signed Rego DSL. When to reach for each, and how they relate. Intermediate 10 minutes Security Engineers / Platform Engineers 13 How to Refuse Installs When a Required Signal Could Not Be Evaluated Turn on the optional fail-closed coverage gate: declare the data sources that must be evaluable, measure in warn mode, then refuse instead of allowing unchecked. Off by default. Advanced 30 minutes Platform Engineers / Security Engineers in regulated environments