DependencyTrack / DependencyTrack/dependency-track
Add Support for Nexus IQ
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Sonatype Nexus IQ includes a Component Details API that can accept basic metadata (GAV, SHA-1, etc) and return a list of security issues. The components being queried on do not need to be in a Nexus repository - IQ acts as an intermediary by making a request to Sonatype Data Services and returns the result.
For orgs using IQ, this would be preferred to using Dependency-Check as an internal scanner. If an IQ server is specified, this should disable the Dependency-Check scanner (and possibly the NPM Audit scanner) and all scans should be performed by a NexusIqScanner implementation for increased accuracy.
Refer to: https://help.sonatype.com/iqserver/rest-apis/component-details-api---v2
Todo:
Investigate vulnerabilities not reported by OSVDB/VulnDB or NVD. I believe they have their own Sonatype vuln identifier as well. Need to confirm.
Contributor guide
Assessment
This issue has not been assessed yet.