The purpose is to mitigate OSS supply chain attacks by preventing the installation that have been recently published on conda-forge or other channels. This gives time for security research to discover and report threats and yank package versions with critical vulnerabilities or corrupted with malware.
Options that exist in other package managers:
pip: --uploaded-prior-touv: --exclude-newerpixi: exclude-newer
Ideally the option should accept relative dates specifications (such as P7D) rather than just absolute dates.
The purpose is to mitigate OSS supply chain attacks by preventing the installation that have been recently published on conda-forge or other channels. This gives time for security research to discover and report threats and yank package versions with critical vulnerabilities or corrupted with malware.
Options that exist in other package managers:
pip:--uploaded-prior-touv:--exclude-newerpixi:exclude-newerIdeally the option should accept relative dates specifications (such as
P7D) rather than just absolute dates.