Developers and approvals
Waivers: time boxed exceptions
Sometimes a team really does need that version for another month. A waiver says so in writing, for exactly that, and then it ends.
Three kinds. A known advisory serves a version safe version resolution would leave out, and names the advisory ids, so a new advisory published later is never covered by an old waiver. A license stops enforcement holding that exact license on those versions. Cooling off serves versions still inside the waiting period.
Advisory and cooling off waivers can be limited to one application or environment, so a waiver for dev never opens production. Developers ask with a reason and a ticket or change number. Approvers approve, reject or revoke, or grant one straight away. Every waiver expires, at most 90 days after it is granted by default, and the finding then applies again on its own.
Approvers get a daily email about waivers waiting and ones running out within a week, and the dashboard has a card for them. The kill switch, malware verdicts and integrity alerts can never be waived.
In short
- Advisory, license and cooling off waivers
- Scoped to an application or environment
- A reason and a ticket on every one
- Every waiver expires, 90 days at most by default
- Kills, malware and integrity alerts cannot be waived
In the documentation
- Deciding waivers Administrator Guide
- Ask for a waiver Developer Guide
Goes well with
- Safe version resolution Versions with serious advisories are left out, so a range quietly settles on the newest safe one.
- License policy Allowed, needs review and blocked SPDX lists, with holds that follow a license change.
- Cooling off new releases Brand new versions wait a few days before your builds see them, which is when hijacks get caught.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.