Nexus Documentation - Nexus IQ Server 1.26 - Sonatype.com

Documentation Nexus IQ Server 1.26

23.1. Evaluating Project Components with Sonatype CLM Server

The evaluate goal scans the dependencies and build artifacts of a project and directly submits the information to a Sonatype CLM Server for policy evaluation.

If a policy violation is found and the CLM stage is configured to Fail, the Maven build will fail. If invoked for an aggregator project, dependencies of all child modules will be considered.

The evaluate goal requires the Sonatype CLM Server URL as well as the application ID to be configured. Optionally a CLM stage can be configured.

The command line arguments are:

clm.serverUrl the URL for the CLM server, this parameter is required.
clm.serverId used for authentication and must match the id given to the CLM Server specified in your Maven settings.
clm.username the username used to authenticate access to the CLM server.

| | | | This is not required when using clm.serverId, but can be used to
overwrite those settings. |

clm.password the password for the username indicated above.

| | | | This is not required when using clm.serverId, but can be used to
overwrite those settings. |

clm.pkiAuthentication delegate to the JVM for authentication.
clm.applicationId the application identifier for the application to run policy against, this parameter is required
clm.resultFile the path for specifying the location of a JSON file where the following information will be stored:
applicationId : Application ID
- scanId : Organization ID
- reportHtmlUrl : URL to the HTML version of the report
- reportPdfUrl : URL to the PDF version of the report
- reportDataUrl : URL to the Data version of the report (for use via CURL, or similar tool)
clm.stage the stage to run policy against with the possible values of develop, build, stage-release, release and operate with a default value of build.
clm.additionalScopes the additional scopes you would like CLM to include components from during the evaluation. Values include test, provided, and system. In cases where you want to include more than one of these, separate the list using a comma (see examples below).

An example invocation is:

mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.additionalScopes=test,provided,system -Dclm.applicationId=test -Dclm.serverUrl=http://localhost:8070

You can avoid specifying the parameters on the command line by adding them to your settings.xml or pom.xml as properties.

 <properties>
    <clm.serverUrl>http://localhost:8070</clm.serverUrl>
    <clm.applicationId>test</clm.applicationId>
 </properties>

Sonatype CLM for Maven can be executed against an aggregator project. When executed in an aggregator project, it calculates the dependencies and transitive dependencies of all child modules and takes all of them into account for the policy evaluation.

The evaluate goal logs its activity and provides the location of the generated report.

[INFO] --- clm-maven-plugin:2.6.0-01:evaluate (default) @ test-app ---
[INFO] Starting scan...
[INFO] Scanning ../repository/org/codehaus/plexus/plexus-utils/3.0/plexus-utils-3.0.jar...
[INFO] Scanning ../repository/org/apache/maven/maven-settings/3.0/maven-settings-3.0.jar...
[INFO] Scanning target/test-app-1.0-SNAPSHOT.jar...
[INFO] Saved module scan to /opt/test-app/target/sonatype-clm/scan.xml.gz
[INFO] Uploading scan to http://localhost:8070 ...
[INFO] Evaluating policies... (ETA 5s)
[INFO] Policy Action: None
Summary of policy violations: 0 critical, 0 severe, 0 moderate
The detailed report can be viewed online at
http://localhost:8070/ui/links/application/test/report/f4582a1570634dc2ac8

| | | | The evaluate goal cannot be bound to a lifecycle phase. |

After a successful build the report can be accessed in the Sonatype CLM server under the application that was configured. A direct link is provided on the log.

23.1.1. Authentication

To configure authentication to the CLM Server, you will need to add your Sonatype CLM Server information to your Maven settings.xml file:

<settings>
   ...
   <servers>
      <server>
         <id>clm_server</id>
         <username>my__clm_login</username>
         <password>my_clm_password</password>
         <!--username and password are not required if using JVM (PKI) authentication-->
     </server>
     ...
   </servers>
   ...
</setting>

| | | | In our example we have not encrypted our password. This is generally
recommended. The Apache Maven project provides
instructions for
password encryption. Additionally, username and password can still be specified
at the command line, and will be used in place of these settings. |

23.1.2. Simplifying Command Line Invocations

If you happen to use the plugin frequently by running it manually on the command line and want to shorten the command line even more, you can add a plugin group entry to your Maven settings.xml file:

 <settings>
   ...
   <pluginGroups>
     <pluginGroup>com.sonatype.clm</pluginGroup>
     ...
   </pluginGroups>
   ...
 </settings>

This enables you to invoke the plugin using its shorthand prefix form:

mvn ... clm:index

23.1.3. Skipping Executions

The clm.skip parameter can be used, when a CLM plugin execution is configured in your project’s pom.xml file, but you want to avoid the execution for a particular build. An example execution is:

mvn clean install -Dclm.skip=true

The parameter can also be set in your IDE configuration for Maven build executions or as a property in your settings.xml or pom.xml:

 <properties>
    <clm.skip>true</clm.skip>
 </properties>