2026-01-09 19:26:48 +05:30
|
|
|
# Trusted Packages
|
|
|
|
|
|
|
|
|
|
`pmg` allows you to trust a package. Trusted packages are not scanned and always allowed to be installed.
|
|
|
|
|
|
|
|
|
|
## Configuration
|
|
|
|
|
|
|
|
|
|
Trusted packages are configured in the `config.yml` file. See [config template](../config/config.template.yml) for the configuration schema.
|
|
|
|
|
If you don't have a `config.yml` file, you can create one by running `pmg setup install`.
|
|
|
|
|
|
|
|
|
|
### Example
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
trusted_packages:
|
2026-01-09 22:03:42 +05:30
|
|
|
- purl: pkg:npm/@safedep/pmg
|
2026-01-09 19:26:48 +05:30
|
|
|
reason: "All versions of PMG are trusted"
|
|
|
|
|
- purl: pkg:npm/express@4.18.0
|
|
|
|
|
reason: "Version 4.18.0 of Express is a trusted package"
|
|
|
|
|
```
|
