DependencyTrack / DependencyTrack/dependency-track

Add Support for Nexus IQ

Open
#178 2 comments 0 reactions 1 assignee Claimed by @stevespringett View on GitHub
enhancement p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Sonatype Nexus IQ includes a Component Details API that can accept basic metadata (GAV, SHA-1, etc) and return a list of security issues. The components being queried on do not need to be in a Nexus repository - IQ acts as an intermediary by making a request to Sonatype Data Services and returns the result.

For orgs using IQ, this would be preferred to using Dependency-Check as an internal scanner. If an IQ server is specified, this should disable the Dependency-Check scanner (and possibly the NPM Audit scanner) and all scans should be performed by a NexusIqScanner implementation for increased accuracy.

Refer to: https://help.sonatype.com/iqserver/rest-apis/component-details-api---v2

Todo:
Investigate vulnerabilities not reported by OSVDB/VulnDB or NVD. I believe they have their own Sonatype vuln identifier as well. Need to confirm.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.