The Artifact Firewall enforces rules on five package types: npm, PyPI, Maven, NuGet and Hex. The Virtual Registry classifies each request and routes only those five to the firewall, so a rule written against any other ecosystem matches nothing, whatever enable_firewall says.
Enforcement takes two forms, and most ecosystems use both:
deny becomes a 403 carrying the rule’s reason. This is what stops a client that pins a version.The difference between deny and hide is the download: both keep a version away from a client resolving “latest”, and only deny blocks a request that names the version outright.
The packument is filtered. Denied and hidden versions stay listed, and the latest dist-tag is re-pointed at the highest version no rule objects to, so a plain npm install resolves to that one. A client that pins a blocked version therefore gets an error saying it is blocked, rather than one saying the version does not exist.
Tarball downloads (/<package>/-/<package>-<version>.tgz) are authorized. A denied version returns 403, a hidden one is served.
Quarantine windows work here without further configuration, since the packument carries a publish time for every version.
The simple index is filtered, in both its HTML form and its PEP 691 JSON form. A denied version’s files are removed from the index. A hidden version’s files are marked yanked with the rule’s reason, which is the mechanism PyPI itself uses for a withdrawn release: pip skips a yanked file unless the requirement pins that exact version.
Downloads are served from the URLs the index hands out and are not authorized a second time, so what the index says is what is enforced.
Quarantine windows on the JSON index use the publish times it carries. The HTML index carries none, so a lookup against the PyPI JSON API is needed, configured with pypi.api_url. Without it, quarantine is not applied to clients using the HTML index.
maven-metadata.xml is filtered, for releases and for snapshots. Denied and hidden versions are removed from the version list, so a build resolving a range or a LATEST never sees them.
Downloads of a .jar, .war, .aar or .zip below the version directory are authorized, and a denied version returns 403.
Two kinds of file stream through untouched whatever the verdict:
.pom and Gradle’s .module. Maven reads the POM of every candidate version while resolving a conflict, including versions it then discards, so denying one would fail the whole resolve rather than the single artifact it describes. A build that pins a denied version reads the POM and is then blocked on the artifact..sha1, .md5, .sha256, .sha512 and .asc. A client has to be able to verify what it did download.Quarantine windows need publish times, which Maven repositories do not carry in their metadata. They are looked up through Maven Central’s Solr endpoint, configured with maven.solr_url, falling back to a HEAD request against the POM when Solr answers nothing.
The registration pages, the flat container index.json, the service index, and the query and autocomplete responses are all filtered. Denied and hidden versions are removed from the version lists.
.nupkg downloads are authorized, and a denied version returns 403.
Quarantine windows use the published timestamp on the registration catalog entry. The flat container index carries no timestamps, so a client resolving through it is not quarantined.
The Hex package manifest cannot be filtered. It is a protobuf payload signed by the repository, and the client verifies that signature against a key in its repository configuration before trusting the contents, so any edit makes hex_core reject the response outright rather than fall back to the unedited one.
Enforcement is on the download instead. A tarball request (/tarballs/<name>-<version>.tar) is authorized and a denied version returns 403. A rule that denies a package as a whole, with no version, also blocks the manifest request, which fails the resolve before a version is chosen.
Documentation tarballs are not package content and are not routed through the firewall.