When something goes wrong
Who has it: consumers of every package and version
Consumers answers the question every incident starts with: who has this?
Search for a package, a version or range, a file by its SHA-256, or an advisory by its CVE, GHSA or PYSEC id. The answer lists the applications and environments that took it with production flagged, the developers and CI pipelines, the addresses, how many downloads, and the first and last download of each.
It works because every token carries an application and an environment, and every download that was actually served is folded into one small row per version per consumer. That record is kept for a year by default, much longer than the raw traffic log, and it is written when it happens: if a token is later revoked or moved, the rows keep saying what was true at the time.
SBOM of an application turns the same record into a document: every version an application downloaded in an environment, with the SHA-256 of each file still cached, in CycloneDX. That is the file to send the auditor who asks what is in production.
In short
- Search by name, range, SHA-256 or advisory id
- Applications and environments, with production flagged
- Developers, pipelines, addresses, counts, first and last seen
- Kept for a year by default, set to forever if you like
- SBOM of an application from what it actually downloaded
In the documentation
- Consumers and SBOMs Administrator Guide
- Applications, environments and token scope Administrator Guide
Goes well with
- Kill switch Take a package, a version range, one file hash or a whole advisory away from everyone, at once.
- Artifacts, SBOMs and lifecycle Every file stored once by SHA-256, CycloneDX and SPDX out, properties and promotion stages.
- Tokens, apps and environments Every download is tied to a token, an application and an environment. Rules can be scoped to them.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.