Teams often treat “uploaded” as “scanned.” What you actually need to stop is risky versions still being pulled / installed / restored downstream, and whether license policy is enforced. A CI report alone—or scanning without blocking—will not catch a three-month-old release still referenced company-wide.
This guide is for DevOps / security interfaces: first wire AngusRepo × AngusSecurity, then configure Repo scan policies and the download gate.
Product boundary (match production):
- AngusRepo = in-repository governance (policies, vuln desk, download enforcement)—not a supply-chain security platform.
- Vuln / deep SCA runs in AngusSecurity (engines include Trivy by default). Without integration, Repo usually creates no vuln scan jobs—only limited local metadata license analysis.
- Push/upload does not auto-check by default; “refuse download when checks fail” is off by default. “No vulns yet” ≠ safe.
- Some older docs still say “built-in Trivy”—trust the Security integration status and current console.
1. Perspective: two lights, not one
| Light | Where it shows | Meaning |
|---|---|---|
| Finding / Job | AngusSecurity Checks | Engine finished? CVE/license detail? Cross-repo trends? |
| Download gate | AngusRepo protocol path | On fail → quarantine → client 403; files stay on disk |
On the ingest path: Repo creates the task and enforces download; Security runs the engine and callbacks. Org-level allow/deny lists, alerts, and reports live mainly in Security. For checks started from Repo, Repo’s distribution scenario and license-gate tier take precedence for that run; allow/deny lists still come from Security.
| Capability | Not linked | Linked (platform deep scan on) |
|---|---|---|
| Dependency/artifact vulns (SCA) | No vuln jobs | Security executes; writes back to Repo desk |
| License compliance | Local metadata only (limited) | Platform deep scan + write-back; lists in Security |
| Code security / secrets | No results | Optional on policy; not for container repos; no source in package → not executed |
| “View in AngusSecurity” | No job deep link | Artifact detail links to Security job |
| Refuse download on fail | Switch exists, but weak without vuln results | Repo quarantines and blocks pull |
2. Integration data flow
publish → HOSTED (artifact stored)
→ Repo: policy trigger (on-push / schedule / Scan now) → ScanTask
→ inbound call to Security (integration app + clientSecret)
→ Security: ScanJob (ARTIFACT / IMAGE + sca, …) → fetch & scan
→ callback to Repo (Finding preview / gate signal) → optional full Finding pull
→ Repo: evaluate quarantine from policy
→ client pull: still blocked by Repo download gate (not Security on the protocol)
Policies bind to: HOSTED / PROXY ✅; GROUP / Raw ❌. Topology: HOSTED/PROXY/GROUP.
CI covers this build’s feedback; the artifact side covers released coordinates over time—fan-out, unified block, org-consistent policy.
3. Link Security and open the download gate
Link AngusSecurity from Repo
Path: System settings → Security integration (admin).
| Console field | Meaning |
|---|---|
| Enable platform deep scan | Off → local metadata license only; no new vuln jobs |
| AngusSecurity base URL | Security API root |
| AngusRepo public base URL | Required across hosts so Security can fetch artifacts & callback |
| clientSecret | Issued by one-click ensure; masked in UI—rotate if lost |
| Console deep-link base | Powers “View in AngusSecurity” |
Suggested actions:
- Fill both base URLs → Test connection and enable integration.
- In Security Admin → Settings → Integrations, confirm the Repo app is ACTIVE.
- On probe failure the link degrades—new vuln jobs stop until network/secret is fixed.
- Never paste
clientSecretinto tickets; use Rotate credentials.
If your edition lacks one-click ensure, use the same fields as shown in your console. HMAC/callback details: integration post + official API docs.
Scan policy: report first, do not block
Path: Security → Policies → Create (or repository Scan).
| Field | Recommendation |
|---|---|
| Apply to repository | HOSTED (e.g. maven-releases / npm-hosted); add critical PROXY next |
| Checks | Default: dependency/artifact vulns + license; add code/secrets only for non-container repos |
| Auto-check on push/upload | On so new packages create jobs |
| Scheduled scan | Cover backlog; optional force-rescan for audit trails |
| Refuse download when checks fail | Off first—report only |
Then Scan now on a test artifact:
- Repo Scan history shows a completed task;
- Vulnerabilities / Licenses populated;
- Security Checks shows the Job;
- Artifact detail offers View in AngusSecurity.
UI copy: this page is the vuln desk, policies, and disposition—execution runs in AngusSecurity.
Gray-enable refuse download
Cadence (never global block on day one):
- See — baseline key HOSTED.
- Triage — centralize FP/license exceptions with reason/expiry. After the gate is on, suppress/accept risk does not clear quarantine.
- Warn — Critical / high-risk licenses with a fix window.
- Block — enable on one non-prod repo → verify 403 → then gray production.
| Gate field | Meaning |
|---|---|
| Refuse download when checks fail | Quarantine on fail; deny download/preview/image pull; incomplete/failed checks also deny |
| Vuln severity threshold | Default High |
| License gate | Off / refuse incompatible / also refuse unknown |
Strictest threshold wins across policies. Existing artifacts quarantine only after the next check—Scan now for immediate effect. Disable gate with no other open gates → quarantine clears immediately.
4. Licenses: lists in Security, scenario in Repo
| Item | Owner |
|---|---|
| Allow/deny lists, custom licenses | AngusSecurity → Policies & gates |
| Distribution scenario | Repo repository setting (else system default); sent on Repo-started checks |
| LICENSE-file-only inference | Display only—not gated |
Vulns ask “can we run it?”; licenses ask “may we?” Exceptions need reason and expiry—no scattered per-project allowlists. See License compliance.
5. Verification (integration + gate)
Integration
- [ ] Platform deep scan on; probe OK
- [ ] Security integration app ACTIVE
- [ ] Push or Scan now visible on both sides
- [ ] Artifact detail deep-links to Security Job
Gate (non-prod)
- Enable refuse-download.
- Publish a known-failing coordinate (or temporarily lower threshold).
- Downstream
pull/install→ expect 403. - Disable gate → download works again (rollback drill).
- Export one SBOM from scan history.
Pipeline: build → (optional) CI pre-scan → push Repo → wait for gate → deploy only downloadable coordinates. Pre-scan does not replace the Repo gate.
6. Failure table
| Symptom | Likely cause | Fix |
|---|---|---|
| Upload OK, never scanned | not linked / deep scan off / no on-push policy | check Security integration + policy |
| “No vulns” treated as safe | LOCAL_ONLY or job never ran | scan history + integration status |
| Repo task, no Security Job | app not ACTIVE, network, secret | retest connection; Security Integrations |
| Security green, Repo still 403 | two lights: threshold/gate mismatch | align policy; check Repo quarantine |
| Suppressed but still 403 | suppress does not unquarantine when gated | bump version or threshold + rescan |
| Bind policy to GROUP | forbidden | policies on member HOSTED/PROXY |
| Container policy with SAST | save rejected | containers: vulns + license only |
| Cross-host fetch fails | Repo public base URL missing | set public base URL |
7. Team acceptance checklist
- [ ] Agree: upload ≠ scanned; vuln engines run in Security
- [ ] Integration done; key HOSTED has enabled policies
- [ ] On-push or schedule on; baseline complete
- [ ] Non-prod 403 + rollback verified
- [ ] License lists in Security; distribution scenario in Repo; exceptions auditable
- [ ] Token owners assigned (Deploy Token)
FAQ
Can we enable the gate without AngusSecurity?
The switch lives in Repo, but without vuln scan results the CVE side barely works. Do not claim “artifact vuln governance” while unlinked.
Is the Repo gate the same as Security’s release gate?
No. Security owns Findings/ops; protocol blocking is in Repo. Keep one written baseline for both sides to avoid green/red split.
What is the main ingest signal?
For artifacts/images: SCA (+ license). SAST/secrets fit non-container repos with package source; source repos/PRs belong on AngusGit / Security code paths.
Takeaways
- Link Security → Repo policy triggers → Security runs engines → callback → Repo may refuse download.
- Unlinked: never treat “no vulns yet” as safe.
- Cadence: see → triage → warn → enable refuse-download.
Top comments (0)