# chainctl libraries policy update

URL: https://deploy-preview-3626--ornate-narwhal-088216.netlify.app/platform/chainctl/chainctl-docs/chainctl_libraries_policy_update.md
Last Modified: July 22, 2026
Tags: chainctl, Reference, Product

 chainctl libraries policy update Update a custom Libraries policy.
Synopsis Update a CUSTOM Libraries policy for an organization.
By default –block, –allow, and –blocked-license ADD to the policy’s existing lists: a new –block purl or –blocked-license identifier is appended (duplicates are ignored) and a new –allow purl replaces any existing allow entry for the same purl. Use –remove-block, –remove-allow, and –remove-blocked-license to drop entries, or –replace-block, –replace-allow, and –replace-blocked-licenses to replace an entire list with the flag’s entries (pass a replace flag with no entries to clear that list).
Packages are identified by their package URL (purl); see “chainctl libraries policy create –help” for the supported purl formats and the blocked-license matching semantics.
chainctl libraries policy update POLICY [--cooldown-days N] [--block ...] [--allow ...] [--blocked-license ...] [--remove-block ...] [--remove-allow ...] [--remove-blocked-license ...] [--replace-block] [--replace-allow] [--replace-blocked-licenses] [flags] Examples # Add a package to the existing block list (other entries are kept) chainctl libraries policy update trusted --parent=example.com \ --block=purl=pkg:pypi/evil # Add or update an allow-list override for a package chainctl libraries policy update trusted --parent=example.com \ --allow=purl=pkg:npm/left-pad,override-cooldown=true # Remove entries from the block and allow lists by purl chainctl libraries policy update trusted --parent=example.com \ --remove-block=pkg:pypi/evil \ --remove-allow=pkg:npm/left-pad # Replace the entire block list, discarding the previous entries chainctl libraries policy update trusted --parent=example.com \ --replace-block --block=purl=pkg:pypi/only-this # Clear the allow list entirely chainctl libraries policy update trusted --parent=example.com --replace-allow # Add a license to the blocked-licenses list (existing entries are kept) chainctl libraries policy update no-copyleft --parent=example.com \ --blocked-license=SSPL-1.0 # Remove a license from the blocked-licenses list chainctl libraries policy update no-copyleft --parent=example.com \ --remove-blocked-license=GPL-3.0 # Clear the blocked-licenses list entirely chainctl libraries policy update no-copyleft --parent=example.com \ --replace-blocked-licenses Options --allow stringArray A package permitted to override gates, as comma-separated key=value pairs: purl=<package-url>[,override-cooldown=true][,override-malware=true][,justification="..."]. Added to the existing allow list, replacing any existing entry for the same purl (use --replace-allow to replace the whole list instead). Repeatable. --block stringArray A package to always deny, as purl=<package-url> (pkg:pypi/<name>, pkg:npm/<name>, pkg:maven/<group>/<artifact>); append @<version> to block a single version. Added to the existing block list (use --replace-block to replace it instead). Repeatable. --blocked-license stringArray An SPDX license identifier to add to the blocked-licenses list (e.g. GPL-3.0). Added to the existing list (use --replace-blocked-licenses to replace it instead). Repeatable. --cooldown-days int32 The cooldown window in days (0 disables, 1-30 explicit, omit to inherit the default). (default -1) --description string The updated description of the policy. --parent string The name or id of the organization that owns the policy. --remove-allow stringArray A package to remove from the allow list, as a purl or purl=<package-url> (match the purl shown by 'describe'). Repeatable. --remove-block stringArray A package to remove from the block list, as a purl or purl=<package-url> (match the purl shown by 'describe'). Repeatable. --remove-blocked-license stringArray An SPDX license identifier to remove from the blocked-licenses list (case-insensitive). Repeatable. --replace-allow Replace the entire allow list with the --allow entries instead of adding to it; pass with no --allow to clear the allow list. --replace-block Replace the entire block list with the --block entries instead of adding to it; pass with no --block to clear the block list. --replace-blocked-licenses Replace the entire blocked-licenses list with the --blocked-license entries instead of adding to it; pass with no --blocked-license to clear the list. Options inherited from parent commands --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev") --audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev") --config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly. --console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev") --force-color Force color output even when stdout is not a TTY. -h, --help Help for chainctl --issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev") --log-level string Set the log level (debug, info) (default "ERROR") -o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide] -v, --v int Set the log verbosity level. SEE ALSO chainctl libraries policy	- Manage Libraries policies.