The platform is deployed in the customer’s infrastructure

Russian software developer “Bazis” has introduced the Basis Repository platform for the secure storage and verification of software components. The solution allows companies to control the use of third-party libraries and open-source software, check them for vulnerabilities, and establish unified access rules for all development teams.

The platform is deployed in the customer’s infrastructure, including isolated environments. Organizations can independently define acceptable software sources, licenses, and component versions. Developers only get access to verified elements or those whose use has been specifically approved by designated specialists. Exceptions are recorded, specifying the reason and validity period of the authorization.

Scans can be run manually or on a schedule. If a new vulnerability is discovered in a previously approved component, the system allows restricting its download for all teams. During analysis, a list of software components and their versions is generated, and vulnerability information is cross-referenced with the Threat Data Bank of the FSTEC of Russia.

Basis Repository also tracks software licenses and support lifecycles. To verify the composition of transferred packages, a signed passport is provided, allowing users to verify received files against the approved version. User actions are recorded in an audit log, and permissions are allocated according to roles.

The solution supports RPM and DEB Linux packages, Docker/OCI container images, npm, Maven, PyPI, and binary archives. The platform can be managed via a web interface and API.

According to “Bazis”, the core mechanisms of Basis Repository were developed on its proprietary codebase. Third-party open-source solutions are used for specific technical tasks. The company explained the creation of the platform by the growing business need to control the security of third-party components used in software development.