---
component: provenance-governor
version: "1.7"
slug: provenance-governor/policy-type-resolved-dependencies-repositories
canonical_url: "https://docs.gradle.com/develocity/provenance-governor/1.7/policy-type-resolved-dependencies-repositories/"
title: "ResolvedDependenciesRepositories Policy"
description: "Reference for the ResolvedDependenciesRepositories policy type."
keywords:
  - "attestation"
  - "supply chain"
  - "configuration"
status: current
---

<!-- llms-index: https://docs.gradle.com/develocity/llms.txt -->

# ResolvedDependenciesRepositories Policy

<a id="preamble"></a>

The `ResolvedDependenciesRepositories` policy enforces constraints on the repositories used for dependency resolution. It evaluates against [Resolved Dependencies Repositories attestations](https://docs.gradle.com/develocity/provenance-governor/1.7/attestation-resolved-dependencies-repositories/) (predicate type `[https://gradle.com/attestation/resolved-dependencies-repositories/v1](https://gradle.com/attestation/resolved-dependencies-repositories/v1)`).

<a id="spec-fields"></a>

## Spec Fields

**uris** — A list of repository URIs that dependencies are allowed (or disallowed) to be resolved from.

**matchingStrategy** — `must-match` requires that all dependency resolution repositories match one of the specified URIs. `none-match` requires that no repository matches any specified URI.

<a id="example"></a>

## Example

**Allow only approved dependency resolution repositories:**

```
apiVersion: policy.gradle.com/v1
kind: ResolvedDependenciesRepositories
metadata:
  name: must-match-repositories
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Allow resolved dependencies repositories
  remediation: Remove offending repository from build configuration
  matchingStrategy: must-match
  uris:
    - https://artifacts.example.com/maven2
    - https://repo.example.com/artifactory/libs-release-candidates-local/
    - https://plugins.gradle.org/m2/
    - https://repo.example.com/artifactory/public
```