Gate: packages

Introduction

The “packages” gate allows users to perform checks against the packages discovered in an SBOM. It has a different set of triggers for each kind of rule set:

• Image rule sets — triggers for requiring specific packages, denylisting unwanted packages, filtering on package metadata, and verifying package integrity against the package database. See the example use cases and Reference: packages.
• SBOM rule sets — the match trigger, which Anchore Enterprise evaluates against every package in an app version. See SBOM Rule Sets: match Trigger.

The packages gate requires the Anchore Enforce license entitlement. See Gate Licensing.

Example Use-cases

Scenario 1

Goal: Create a rule that results in a STOP action if libssl packages are not found in an image SBOM.

Example rule set configuration in Anchore Enterprise

Gate: packages
Trigger: required package
Required Parameters: name = “libssl”
Action: STOP

Scenario 2

Goal: Create a rule that results in a STOP action if libssl-dev packages are found in an image SBOM but running on a version other than 1.1.1-1ubuntu2.1~18.04.23.

Example rule set configuration in Anchore Enterprise

Gate: packages
Trigger: metadata
Optional Parameters: name = “libssl-dev”, name comparison = “=”, version = “1.1.1-1ubuntu2.1~18.04.23”, version comparison = “!=”
Action: STOP

Reference: packages

The minimum version match of the required_package trigger and the version comparison of the denylist trigger compare versions using the version rules of each package’s type, the same rules Anchore Enterprise uses for vulnerability matching.

Enable the Package Database

The verify trigger requires the package database to be loaded into the policy engine. This setting is disabled by default in newer deployments of Anchore Enterprise, though it was previously enabled by default. Only enable this setting if you intend to use the verify trigger, as loading the package database has a significant performance impact on the database.

You can confirm the current value of this setting from the System -> Configuration screen by searching for “load”.

To enable it, change enable_package_db_load from false to true:

services:
  policy_engine:
    enable_package_db_load: true

SBOM Rule Sets: match Trigger

In an SBOM rule set, the packages gate’s match trigger fires once for each package in the app version that matches the criteria you set. Use it to fail or flag a release that ships a banned package, or a package older than a minimum version.

A rule must set at least one of name, version and type.

How Packages Are Matched

• Every criterion must match. A package matches only when all of the criteria you set match. Criteria you leave out are not checked.
• Matching ignores case. Log4j-Core and log4j-core are the same name.
• ~= and !~= take glob patterns. * matches any run of characters and ? matches one character, so a version of 2.* with ~= matches every 2.x release. = and != compare exact strings.
• >, >=, < and <= compare versions by package type. They use the version rules of each package’s ecosystem, the same rules Anchore Enterprise uses for vulnerability matching, so 1.10.0 is greater than 1.9.0. If a package’s version cannot be compared, the rule records an evaluation error for that package instead of treating it as not matching. Evaluation errors are listed by the experimental GET /exp/apps/{app_id}/versions/{version_id}/policy/evaluation-errors endpoint.

Each matching package produces one finding, which names the package’s name, version, type and PURL, and the assets that contain it.

Examples

Fail any release that includes a Log4j 2 core library:

{
  "action": "STOP",
  "gate": "packages",
  "trigger": "match",
  "params": [
    { "name": "name", "value": "log4j-core" },
    { "name": "version", "value": "2.*" },
    { "name": "version_comparison", "value": "~=" }
  ]
}

Warn when a release includes a Java jackson-databind library older than 2.15.0:

{
  "action": "WARN",
  "gate": "packages",
  "trigger": "match",
  "params": [
    { "name": "name", "value": "jackson-databind" },
    { "name": "type", "value": "java-archive" },
    { "name": "version", "value": "2.15.0" },
    { "name": "version_comparison", "value": "<" }
  ]
}

Review Package Findings

• In the Anchore Enterprise GUI, select the Packages gate on the app version’s Compliance tab. See Evaluate Policy Against an App Version.
• With the API, call GET /apps/{app_id}/versions/{version_id}/policy/findings/packages.
• To export the findings as CSV, see Export the Compliance Report.