Goal
Make publish-time scanning an operable production control, not only an API code path.
Deployment
- Run a pinned ClamAV/clamd service beside the registry with freshclam signature updates.
- Keep the daemon private to the host/network namespace and set resource limits.
- Configure scanner host/port, timeout, maximum bytes, and required/fail-closed mode.
- Add health/readiness reporting that distinguishes process health from scanner readiness.
- Document a staged rollout: shadow/observe in non-production, block EICAR, enforce fail-closed, then monitor.
- Document rollback that does not silently publish unscanned packages.
Observability
- Counters by verdict and publish surface.
- Scan latency and error/timeout counts.
- Signature/database age and scanner readiness.
- Structured audit event containing package/version/commit, publisher identity, artifact hash, verdict, engine, signature, and timestamp.
- Alerts for scanner unavailable, stale definitions, abnormal blocked/review rate, and latency saturation.
- No tokens, tarball bytes, or disclosure text in logs/metrics.
Verification/runbook
- EICAR canary is blocked end-to-end.
- A clean fixture publishes through every route.
- Scanner outage yields 503 and zero new installable artifacts.
- Batch atomicity and retry behavior are rehearsed.
- Operators have steps for triage, false-positive review, definition updates, and safe recovery.