DOCSEARCHbyAlgolia
Submit Docs

Bytesafe Documentation

website·Indexed 34 days ago

https://docs-v1.bytesafe.dev/

Documentation for Bytesafe, a platform for managing private registries, dependency firewalls, and software composition analysis (SCA). Includes guides on configuring npm and Maven, setting up SAML SSO with providers like Okta and Auth0, managing license compliance, and using policies and plugins to automate package workflows.

Tokens
27K
Snippets
73
Records
230
Agent score
56%

What's inside Bytesafe

  1. Overview of Bytesafe Dependency Firewall

    The Bytesafe Dependency Firewall acts as a secure perimeter and first line of defense for an organization's software supply chain. It intercepts new packages being downloaded from public registries and validates them against defined security and license compliance policies before they can be used by developers or CI/CD systems. This prevents malicious code and vulnerable open-source packages from entering the production environment.

  2. Overview of License Compliance in Bytesafe

    Bytesafe provides tools to manage license restrictions and obligations for open source dependencies. It ensures that packages used in a workspace comply with defined organizational policies. The system consists of three main components: License Policies (rules for allowing/blocking licenses), the License Compliance Plugin (which identifies licenses and flags/quarantines packages), and License Dashboards (holistic overview of compliance and open issues). Note that full license text identification is a premium plan feature; free plan users are limited to declared licenses found in project files (e.g., package.json, pom.xml, .nuspec).

  3. Overview of SAML Single Sign-On (SSO) for Bytesafe

    Bytesafe supports SAML 2.0 for Single Sign-On (SSO), allowing organizations to manage users centrally through an existing Identity Provider (IdP).

    When SAML is enabled, new users are automatically assigned a Read-Only role. This ensures that adding new users via SSO does not impact billing. Workspace administrators can manually upgrade these users via role escalation requests if higher permissions are needed.

  4. Overview of Bytesafe Dependency Firewall

    Bytesafe is a dependency firewall and flexible package management tool that provides fully managed npm and maven artifact registries. It allows teams to secure their software supply chain through the following core capabilities:

    • Dependency Firewall: Centralized control of the single source of truth for registries.
    • Security: Continuous scanning and monitoring of dependencies for vulnerabilities.
    • License Compliance: Ensuring packages adhere to organizational policies.
    • Remediation: Identifying and tracking the fix of dependency issues.
    • Simplicity: Automation of package flows and token management.

  5. Overview of Bytesafe Account and Profile management

    Bytesafe provides a suite of tools to manage organizational access and user personalization. Key capabilities include:

    • Identity Management: Support for Single Sign-On (SSO) via SAML (for existing Identity Providers) or Social Logins (GitHub, Google, and Microsoft).
    • User Personalization: Profile settings to customize individual user accounts.
    • Communication: Notification management for Workspace activity.
    • Security & Access: Two-Factor Authentication (2FA) and Role-Based Access Control (RBAC) to secure and manage permissions.

  6. Aggregate multiple package sources using Bytesafe registry upstreams

    Bytesafe allows a single registry to connect to multiple upstreams (such as public registries, private registries, or Git repositories). This eliminates the need for developers to manually switch between different registries.

    Common use cases include:

    • Overruling public package versions with patched versions from a specific registry.
    • Combining third-party and internal private packages into one endpoint.
    • Integrating single packages hosted in Git repositories alongside standard registry packages.

  7. Manage Bytesafe workspace integrations

    Bytesafe allows you to connect your workspace to external services to enable notifications, sync repositories, or connect to third-party automation tools. Integrations are managed within the application under the Settings menu in the Integrations tab.

    Available integrations include:

    • Slack: Send Bytesafe notifications to Slack channels.
    • GitHub: Use GitHub repositories as Upstreams and integrate with GitHub Issues.
    • Zapier: Connect Bytesafe to over 2,000 other web services.

  8. Prevent registry changes using the Freeze policy

    The Freeze policy makes a Bytesafe registry read-only, preventing any modifications to its contents. This ensures that new packages and versions are only introduced through a controlled process. When enabled, all attempts to pull, push, publish, deploy, or delete packages, tags, and versions are denied with a 'registry is read-only' error message. Additionally, the policy blocks requests for package version information from being forwarded to upstream registries, preventing unintended installation failures when new versions are released upstream.

  9. Understand Bytesafe notification types and delivery

    Bytesafe notifications keep users updated on workspace changes, specifically covering user events, subscription updates, account updates, and issue alerts. Notifications are always displayed within the Bytesafe platform and are sent via email to the user's linked address by default.

  10. Prevent use of risky packages with Bytesafe Quarantine

    Bytesafe Quarantine is a Dependency Firewall feature that blocks packages identified as risks from being used in developer or build environments. A quarantined package cannot be installed by developers or downstream registries, nor can it be pushed to upstream registries. Quarantined packages are visually identified in the workspace by a red border and marker, and can be managed via the quarantine metric on the registry dashboard.

  11. Understand the role of Bytesafe CLI vs Package Managers

    Bytesafe CLI is used for managing packages within Bytesafe registries (e.g., pulling packages from an upstream into a registry). It complements, but does not replace, standard package managers like npm, yarn, pnpm, or mvn, which are used to fetch and install dependencies into a local project workspace.

  12. Prevent packages from being added to a registry using Block policy

    The Block policy prevents specific packages or package versions from being added to a registry. This is achieved by creating a definition list for each registry where the policy is enabled. Note that this policy does not automatically block dependencies of a blocked package; those must be added to the block list explicitly if they also need to be prevented.