Package security
This guide helps Posit Connect administrators and security teams use Posit Package Manager to control R and Python package sources. Before you configure Connect, identify the approved R and Python repositories. Coordinate with a Package Manager administrator when you need help with repository setup or authentication.
Choose curated repositories
Use curated CRAN and Python Package Index (PyPI) repositories to control which packages are available to content running on Connect. Follow the R repository setup procedure and Python repository setup procedure in the Package Manager integration guide to obtain repository URLs and configure Connect. The package management recommendation in Security recommendations gives the security context.
R content includes its required packages in the bundle during publishing, and Connect installs them from configured repositories during deployment. Connect automatically installs Python runtime dependencies during deployment. Your curated repositories must provide the runtime packages and transitive dependencies needed for both languages. Review R runtime dependency guidance and Python runtime dependency guidance for package lists.
On Python 3.10 and later, Connect installs truststore on a best-effort basis, so a missing truststore package does not fail the environment build. If your repository uses an allow list, add truststore to it to retain automatic trust of the operating system certificate store.
Restrict R package sources
Set R.PackageRepositoryResolution to strict and define approved sources with RPackageRepository. Connect then ignores repositories supplied with published content and restores packages only from configured RPackageRepository entries.
Connect fails to start if R.PackageRepositoryResolution is strict and no RPackageRepository is configured.
When the server uses strict, content cannot override the resolution mode through package_repository_resolution in manifest.json. Deployments fail if a required package is missing from the configured repositories. See the R strict mode example and manifest override guidance for details.
Restrict Python package sources
Set Python.PackageRepositoryResolution to strict to remove package-source lines, including --find-links, from content’s requirements.txt, and define approved indexes with PythonPackageRepository. The strict setting removes content-specified package-source lines, but system-level installer indexes can remain active.
When you configure PythonPackageRepository, Connect passes those indexes as command-line arguments. These arguments override the default index settings in /etc/uv/uv.toml and /etc/pip.conf. Extra indexes in those files remain active, so the installer searches both Connect-configured indexes and system-level extra indexes. Neither uv nor pip guarantees priority among indexes. Both search all configured indexes and install whichever version best satisfies the requirement, regardless of source. To use only Connect-configured indexes, remove [[index]] entries from /etc/uv/uv.toml and index-url and extra-index-url entries from /etc/pip.conf. If packages must come from one specific index, configure only that index. See content index resolution and index precedence for configuration details.
Authenticate to restricted repositories
Follow the authenticated repository integration guide to configure identity federation in Package Manager and create the integration in Connect. Connect and Package Manager require two-way network connectivity for the integration to work.
Use the integration’s access control list (ACL) to limit which content owners receive repository credentials. Publishers without access to any Package Manager integrations build without Package Manager authentication, and package installation can fail. Removing a publisher from the ACL prevents that publisher from using the integration in new deployments. Connect applies the change to already-deployed content only when that content is rebuilt. Content does not need an integration_requests entry in manifest.json. Enabled integrations supply short-lived access tokens during package restoration.