Gateway - Detect and control software package downloads with package registry security

<p>Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/">HTTP policies</a> using <code>pkg.*</code> selectors to allow or block package downloads.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="supported-ecosystems">Supported ecosystems</h4><a class="anchor-link" href="#supported-ecosystems"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Gateway detects package downloads for the following ecosystems:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Ecosystem</th> <th>Namespace</th> </tr> </thead> <tbody> <tr> <td>npm</td> <td>Scope (for example, <code>@babel</code>)</td> </tr> <tr> <td>PyPI</td> <td>--</td> </tr> <tr> <td>RubyGems</td> <td>--</td> </tr> <tr> <td>Cargo</td> <td>--</td> </tr> <tr> <td>Go</td> <td>Module path</td> </tr> <tr> <td>Maven</td> <td>Group ID</td> </tr> <tr> <td>NuGet</td> <td>--</td> </tr> </tbody> </table></div> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="selectors">Selectors</h4><a class="anchor-link" href="#selectors"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>In the dashboard, select <strong>Package Ecosystem</strong> to access the package registry selectors. After selecting a single ecosystem, nested fields for package name, version, and namespace become available. Five <code>pkg.*</code> selectors are available for HTTP policies with the Allow and Block actions:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Selector</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>pkg.ecosystem</code></td> <td>The package ecosystem detected from the request URL.</td> </tr> <tr> <td><code>pkg.name</code></td> <td>The package name extracted from the download URL.</td> </tr> <tr> <td><code>pkg.version</code></td> <td>The package version, with support for ecosystem-aware comparison operators.</td> </tr> <tr> <td><code>pkg.namespace</code></td> <td>The package namespace, when the ecosystem supports one.</td> </tr> <tr> <td><code>pkg.purl</code></td> <td>The <a href="https://github.com/package-url/purl-spec" target="_blank" rel="noopener">Package URL (PURL)<span class="external-link"> ↗︎</span></a> derived from the detected coordinates. Available in the API only.</td> </tr> </tbody> </table></div> <p>Detection is based on the registry protocol rather than the hostname, so it works the same way whether traffic goes to a public registry, a corporate proxy such as Artifactory or Nexus, or a self-hosted mirror.</p> <p>Package registry security requires <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/">TLS decryption</a> to be turned on.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/package-registry-security/">Package registry security</a>.</p>