GRN-E005 unsupported-source


Default severity	`info`
Kind	absolute rule: fires on the new version alone, whatever the trusted version looked like.
Status	Specified for 1.0, not yet implemented

What it checks

A dependency comes from a source Garnet Guard doesn't check: a git URL, a local path, a direct file URL, or a registry other than PyPI and npm.

Why it matters

Garnet Guard's rules are written against registry metadata. A dependency from somewhere else isn't compared at all, and the report says so rather than leaving it out.

Example finding

Illustrative. The rule is specified but not yet implemented.

uv.lock: INFO
  INFO  GRN-E005 unsupported-source: examplelib comes from git+https://github.com/example/examplelib@3f2a1c9, which isn't checked

How to resolve it

Nothing to do if you meant it. Review changes to that dependency by hand, as you would any vendored code.

Allowlisting

This rule reports at info, which doesn't change the verdict. To hide it, turn it off in policy:

[garnet.rules]
"GRN-E005" = "off"