Skip to content

Commit

Permalink
Merge pull request #1034 from chocolatey/fix/security-mdx-link-syntax
Browse files Browse the repository at this point in the history
(fix) Correct link syntax in security.mdx
  • Loading branch information
st3phhays authored Jul 9, 2024
2 parents 76f6598 + b37d010 commit b499a38
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/content/docs/en-us/information/security.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@ For using Chocolatey, if you are using the community repository, you will need t

For specific IP addresses to whitelist, please see the following: [https://www.cloudflare.com/ips/](https://www.cloudflare.com/ips/)

If you are using the community package repository, you would also need to whitelist the official distribution location for **EVERY** package that you intend to manage (unless you had a licensed edition **and** the downloads have been cached on the Chocolatey customer CDN). This is due to distribution rights and the community repo being publicly available (discussed above at <Xref title="community.chocolatey.org Packages](#chocolateyorg-packages)), so those community packages are not able to embed binaries directly into the package and must download those resources at runtime. Licensed editions of Chocolatey take advantage of a [CDN cache" value="private-cdn" /> of those downloaded resources, which is used instead of reaching out to those remote locations to ensure availability.
If you are using the community package repository, you would also need to whitelist the official distribution location for **EVERY** package that you intend to manage (unless you had a licensed edition **and** the downloads have been cached on the Chocolatey customer CDN). This is due to distribution rights and the community repo being publicly available (discussed above at [community.chocolatey.org Packages](#communitychocolateyorg-packages)), so those community packages are not able to embed binaries directly into the package and must download those resources at runtime. Licensed editions of Chocolatey take advantage of a <Xref title="CDN cache" value="private-cdn" /> of those downloaded resources, which is used instead of reaching out to those remote locations to ensure availability.

Keep in mind that the Chocolatey CDN can only download resources for packages that it has been able to cache. While it is currently able to cache 70% of the existing packages ([https://chocolatey.org/stats](https://chocolatey.org/stats)) for actuals - use PackagesCached divided by UniquePackages), we always recommend running `choco search pkgid` (or `choco info pkgid`) to determine if it has the "Downloads cached for licensed users" aspect, or look on the package page for the indicator that the packages are cached. If it does not, you would either need to go through the process of internalization for that package, or look to whitelisting whatever resources that package needed to download.

Expand Down Expand Up @@ -296,4 +296,4 @@ A non-administrative user should choose to install Chocolatey in a directory som
## Report Issue

- Report general security issue - please email security [at] chocolatey dot io.
- Report package malware/security/other package issue - please use the Report Abuse link directly on the package page on [https://community.chocolatey.org/packages](https://community.chocolatey.org/packages).
- Report package malware/security/other package issue - please use the Report Abuse link directly on the package page on [https://community.chocolatey.org/packages](https://community.chocolatey.org/packages).

0 comments on commit b499a38

Please sign in to comment.