Review and download packages on a connected staging system, scan and record them, move them across the boundary as a controlled bundle with checksums, verify on arrival, then publish into the internal registry. The inside network never talks to the public registry, so every package has a record of how it arrived.
Why this needs its own process
Some environments cannot reach the internet by design. Developers there still need libraries and updates. Without a clear path, teams copy files by hand from personal machines, which is the riskiest option.
A good process makes the safe path the easy path, with a predictable turnaround.
The flow
- Request. A developer files an intake request naming the package, version and need, as usual.
- Stage. On a connected system, resolve the full dependency tree for that version and download every artifact.
- Check. Scan the set for known vulnerabilities, malicious package reports and license problems. Record results.
- Bundle. Package the artifacts with a manifest listing names, versions and checksums.
- Transfer. Move the bundle using the approved method for your environment, with a named person responsible.
- Verify. Inside, recompute checksums and compare to the manifest before importing.
- Publish. Import into the internal registry and mark the package approved for that environment.
- Record. Keep the request, scan results, manifest and import log together.
Controls at each step
| Stage | Control |
|---|---|
| Staging | Dedicated system, no access to secrets, logged downloads |
| Check | Same rules as the connected environment, so approvals match |
| Transfer | Two person rule for high tier environments, media scanned |
| Arrival | Checksum verification, import only through the registry's upload path |
| Inside | Direct installs from outside sources blocked, only the internal registry allowed |
Handling updates
Security fixes need a fast path. Define an expedited route for patches to already approved packages, with a target time. A slow update process tempts people to stay on vulnerable versions.
Sync on a schedule for approved packages too. A weekly bundle of patch releases for the approved list is easier to review than an ad hoc request every time.
Keep the SBOM
Generate an SBOM for each bundle and for each internal build. Inside a restricted network you cannot query the internet for advisories, so bring advisory data in the same way and rescan the inside inventory when it updates.
Quick check
Can we mirror a whole public registry inside?
Check the registry's terms first. Some forbid full copies. A filtered set of approved packages is smaller and easier to review.
How do we learn about new advisories?
Import advisory data with the same bundle process and rescan your inside inventory on arrival.
Safeguard scans dependencies and builds SBOMs, runs reachability analysis, and applies policies and gates on pull requests, so the rules in this post can be checked automatically. Autonomous fix PRs are off by default, with every category on Manual. You can run a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
