SafeDep Documentation

The PMG dependency cooldown holds back package versions that are younger than a set age. The cloud policy sets this age for every PMG endpoint of your tenant with no change to each machine.

This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See pricing. Each endpoint needs PMG with cloud.policy on.

The setting is package_admission.cooldown.min_age. PMG applies it. The pull request check does not apply a cooldown yet.

Set the cooldown for the tenant

Open the policy settings document:

safedep policy edit -m "Cooldown 5 days"

Set the value in the policy base:
base: package_admission: cooldown: min_age: 5d
The value is a duration, as 5d or 120h, from 0 to 365 days. PMG rounds it up to whole days. 0 turns the cooldown off.
Save the file, close the editor, and publish the change that the command created:
safedep policy change show 18 safedep policy change publish 18 -m "Cooldown 5 days"
Use the change number that safedep policy edit printed. A shorter cooldown loosens the policy, and so does the first cooldown that you set, because no layer set the field before. For a change that loosens, the publish asks you to confirm it.

Set the cooldown for a group of endpoints

Add a policy override with a selector. This override sets a longer cooldown on macOS endpoints:

overrides:
  - name: macs
    priority: 100
    description: Longer cooldown on macOS laptops
    selector:
      matchLabels: {reported/os: darwin}
    spec:
      package_admission:
        cooldown:
          min_age: 7d

To select a group that you choose, give its endpoints a custom/ label first. See Target a Group.

Exempt one package

To install a new version of one package before the cooldown ends, create a trust entry with the scope cooldown:

safedep policy rule create --trust pkg:npm/my-internal-sdk --scope cooldown \
  --reason "First-party SDK, tested on release" --expires 90d

What the cloud value changes in PMG

When the policy sets the cooldown, PMG uses the cloud value instead of dependency_cooldown.enabled and dependency_cooldown.days in its config file and in PMG_* environment variables. PMG refuses --skip-dependency-cooldown. The skip list in the PMG config still applies. One exception: under global_lockdown: true, a managed config file that sets dependency_cooldown.enabled or dependency_cooldown.days keeps its value, and PMG reports the field as locked. See Apply the Cloud Policy in PMG.

Check the value on one endpoint

safedep endpoint policy show arjuns-mbp --field package_admission.cooldown.min_age

The output shows the value, the layer that set it, and the exceptions that PMG reported, such as a locked field.

Next steps

Hold Back Newly Published Versions

How the PMG cooldown works.

Target a Group

Label endpoints and write a policy override.

Explain a Decision

List the installs that the cooldown blocked.

MDM

Set the Dependency Cooldown from the Cloud

Set the cooldown for the tenant

Set the cooldown for a group of endpoints

Exempt one package

What the cloud value changes in PMG

Check the value on one endpoint

Next steps

Hold Back Newly Published Versions

Target a Group

Explain a Decision

​Set the cooldown for the tenant

​Set the cooldown for a group of endpoints

​Exempt one package

​What the cloud value changes in PMG

​Check the value on one endpoint

​Next steps

Hold Back Newly Published Versions

Target a Group

Explain a Decision

Set the cooldown for the tenant

Set the cooldown for a group of endpoints

Exempt one package

What the cloud value changes in PMG

Check the value on one endpoint

Next steps