Policy Compliant Component Selection

Policy Compliant Component Selection

The DevSecOps best practice for build reliability is to specify exact versions of open source dependencies in the build manifest. A common norm for some projects is to leave the dependency versions undefined or defined as a range of versions. When the latest version has violations blocked by Repository Firewall the npm client errors without a clear path forward.

Policy-compliant component selection filters requests to prevent clients from selecting versions that violate your policies. This feature runs automatically when components are requested from quarantine-enabled proxy repositories.

Configuration for Nexus Repository 3 Pro

Prerequisites

Enable Policy Compliant Component Selection

  1. In Nexus Repository, select the proxy repository from the Repositories view under the Settings menu
  2. Check the Filter component versions that fail Sonatype Repository Firewall policy option and Save the changes.

Configure Cache Settings

The Maximum metadata age setting controls how often Nexus Repository refreshes metadata from the remote repository. Lower values refresh metadata more often, but they can also increase outbound requests to the remote repository and IQ Server for metadata evaluation.

For Policy Compliant Component Selection, choose a value that balances timely metadata updates with request volume for your environment. Avoid setting Maximum metadata age to 0 unless you specifically want Nexus Repository to check for metadata updates on every request.

  1. In Nexus Repository, select the proxy repository from the Repositories view under the Settings menu.
  2. Choose a metadata retrieval cache period that balances timely metadata updates with request volume for your environment.

Configuration for JFrog Artifactory

Prerequisites

Enable Policy Compliant Component Selection

In the firewall.properties configuration file for Firewall for JFrog Artifactory, add a line for each repository you want to enable Policy Compliant Component Selection:

firebase.repo.my-remote-repo=policyCompliantComponentSelection

Configure Cache Settings

The Metadata Retrieval Cache Period setting controls how often Artifactory refreshes metadata. Reducing this value does not improve Policy Compliant Component Selection performance. Lower values can increase outbound requests to the remote repository and IQ Server for metadata evaluation.

Choose a Metadata Retrieval Cache Period that balances timely metadata updates with request volume for your environment.

General Info

  1. What is Policy-Compliant Component Selection?

Policy Compliant Component Selection is a feature of the Repository Firewall that delivers the most recent policy-compliant version of a requested component when you install your dependencies. When your dependencies specify a range of versions for a dependency, this feature prevents new releases with policy violations from interrupting your development process. This is useful for applications with large dependency trees and transitive dependencies.

Generally, automatically requesting the latest version of a dependency is not recommended.

  1. Why should I enable this feature?

Enabling this feature can keep your projects running smoothly as Repository Firewall's Release Integrity features review each new release for malicious behavior. With Policy Compliant Component Selection, Repository Firewall reduces its impact on development while still providing maximum protection for your applications.

  1. Does Policy Compliant Component Selection only work with the Release Integrity policy?

Policy Compliant Component Selection works for any policy set to Fail at the Proxy Stage - not just the Release Integrity policy. Failing unknown components is also not required for this feature to function. Be sure to check your auto-release settings as they complement this feature.

  1. What ecosystems are currently supported?

npm and PyPI are currently supported for Repository Firewall.

  1. What are the minimum requirements to use this feature?

Do not enable this feature without using the minimum version of both Nexus Repository 3 and IQ Server.

Using the Policy Compliant Component Selection on Nexus Repository versions older than 3.38.1 and/or IQ Server versions older than 134 will result in performance issues.

See the prerequisites above.

  1. Will versions audited by Policy Compliant Component Selection show up in my Repository Results view?

Only the versions downloaded to your repository, the versions used by Policy Compliant Component Selection will appear on the Repository Results.

Unsupported versions of IQ Server may result in unused versions appearing on your Repository Results screen.

  1. What if there is no policy-compliant version of a package?

You will receive a "no package found" error. This is not the same as a quarantined component.

You will not be redirected to the Quarantined Component view.