Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/NetRiseInc/provenance-cli/llms.txt

Use this file to discover all available pages before exploring further.

Conditions are the matching criteria inside a rule’s match block. Each condition maps to a field name and a value. All 15 conditions are listed below.

​
Quick reference

ConditionValue typeMatches when…
advisory_relationship"direct" or "indirect"Package has an advisory with this relationship
advisory_nameslist of glob patternsAdvisory name matches any listed pattern
has_breached_credentialstrueAny contributor has breached credentials
bus_factor_belownumberRepository bus factor is below threshold
signed_commit_ratio_belowfloatSigned commit ratio is below threshold
contributor_countrieslist of ISO country codesAny contributor is from a listed country
repo_archivedtrueRepository is archived
repo_deprecatedtruePackage or repository is deprecated
scorecard_score_belowfloatOpenSSF Scorecard score is below threshold
no_recent_commits_daysnumberNo commits in the last N days
license_spdxlist of SPDX identifiersLicense matches any listed identifier
key_change_detectedtrueSigning key change detected for any contributor
contributor_emailslist of glob patternsAny contributor email matches a pattern
repo_urlslist of glob patternsRepository URL matches any pattern
package_purlglob stringPackage PURL matches glob
Multiple conditions in a single rule are AND-joined — all must match for the rule to trigger. For OR logic, write separate rules with the same action.

​
Advisory conditions

​
advisory_relationship
string
Matches when the package has an advisory with the specified relationship. Accepted values are "direct" (the package itself is affected) or "indirect" (an upstream dependency is affected).
match:
  advisory_relationship: direct
​
advisory_names
string[]
Matches when any advisory on the package has a name matching at least one glob pattern in the list. Supports * wildcards.
match:
  advisory_names:
    - "NETR-*"
    - "CVE-*"

​
Contributor security conditions

​
has_breached_credentials
boolean
Matches when one or more contributors associated with the package’s repository have credentials found in known data breaches. Set to true to flag affected packages.The engine checks the repository health API’s contributors_with_breached_creds count first, then falls back to individual contributor security data.
match:
  has_breached_credentials: true
​
key_change_detected
boolean
Matches when a signing key change has been detected for any contributor. A key change can indicate legitimate key rotation or account compromise. Set to true to flag packages where this occurred.This condition fetches contributor security data for a sample of up to 10 contributors and short-circuits on the first match.
match:
  key_change_detected: true
​
signed_commit_ratio_below
number
Matches when the ratio of signed commits to total commits is below the specified threshold. A value of 0.5 means fewer than 50% of commits are signed.This condition fetches contributor security data for a sample of up to 15 contributors.
match:
  signed_commit_ratio_below: 0.5
​
contributor_countries
string[]
Matches when any contributor is from one of the listed countries. Values are ISO 3166-1 alpha-2 country codes (e.g. CU, KP, IR). The engine also accepts full country names and maps them to codes automatically.
match:
  contributor_countries:
    - CU   # Cuba
    - IR   # Iran
    - KP   # North Korea
    - SY   # Syria
    - RU   # Russia
​
contributor_emails
string[]
Matches when any contributor’s email address matches at least one glob pattern. Supports * wildcards. Checks the contributors[].email field from the package’s repository details.
match:
  contributor_emails:
    - "jiat0218@gmail.com"
    - "*@gmail.com"
    - "*noreply*"

​
Repository health conditions

​
bus_factor_below
number
Matches when the repository’s bus factor — the number of contributors whose absence would critically impact the project — is below the specified threshold. A bus factor of 1 means a single person controls the project.
match:
  bus_factor_below: 2
​
repo_archived
boolean
Matches when the repository has been archived on its hosting platform. Archived repositories receive no further updates or security patches. Set to true to flag archived repos.
match:
  repo_archived: true
​
repo_deprecated
boolean
Matches when the package or repository has been explicitly marked as deprecated. Set to true to flag deprecated packages.
match:
  repo_deprecated: true
​
scorecard_score_below
number
Matches when the repository’s OpenSSF Scorecard score is below the specified threshold. Scorecard scores range from 0 to 10.
match:
  scorecard_score_below: 5.0
​
no_recent_commits_days
number
Matches when no commits have been made to the repository in the last N days. Use this to flag stale or abandoned projects.
match:
  no_recent_commits_days: 365

​
Package and license conditions

​
license_spdx
string[]
Matches when the package or repository license matches any of the listed SPDX identifiers. Use NONE to match packages with no license assertion (NOASSERTION or empty).
match:
  license_spdx:
    - NOASSERTION
    - NONE
    - GPL-3.0-only
​
repo_urls
string[]
Matches when the package’s repository URL matches at least one glob pattern. Use this to block or flag packages from specific organizations or hosting providers.
match:
  repo_urls:
    - "*github.com/blocked-org/*"
    - "*tukaani-project*"
​
package_purl
string
Matches when the package’s PURL (Package URL) matches the specified glob pattern. This condition is most commonly used with allow rules to exempt specific packages from other rules.
match:
  package_purl: "pkg:deb/debian/curl@*"

​
Data requirements

Conditions require different API data. The engine fetches only what is needed.
These conditions cause the engine to call the repo health API for the package’s repository URL. Results are cached per URL within a single invocation.
  • bus_factor_below
  • repo_archived
  • repo_deprecated
  • scorecard_score_below
  • no_recent_commits_days
  • has_breached_credentials
  • contributor_countries
  • license_spdx
These conditions cause the engine to fetch security data for a sample of contributors from the package’s repository.
  • key_change_detected — evaluates contributor security data for signing key changes
  • signed_commit_ratio_below — evaluates signed commit ratio from contributor security data; falls back to per-contributor data in the package response
Contributor security data is cached per email address within a single invocation.
These conditions are evaluated from the standard package API response, which is always fetched.
  • advisory_relationship
  • advisory_names
  • contributor_emails
  • repo_urls
  • package_purl

Build docs developers (and LLMs) love

Get started for freeTalk to us