# Release Integrity

New releases of open-source components introduce high risk to your build pipeline as they may hide malware, critical security vulnerabilities, or unapproved licenses.

Release Integrity is a collection of features in the Repository Firewall that protect you from intentionally harmful components.

#### Suspicious and Malicious Protection

- Machine Learning (ML) system for identifying potentially malicious releases
- Repository Firewall blocks dangerous releases by default
- Protect your build pipeline from software supply chain attacks

#### Automatic Quarantine Release

- Firewall automatically releases components from quarantine that no longer have failing violations
- Automatically release suspicious components deemed safe by the Sonatype Research team
- Reduce costs of assessing components coming into your build environment

#### Policy Compliant Component Selection

- Configure your repository manager to only deliver versions without failing policy violations
- This keeps new versions from breaking your builds or disrupting development

## Release Integrity

When an open-source component or new version is published, Sonatype’s AI and Machine Learning tools analyze the release and flag it when detecting unusual release behavior. Typical releases are assigned a normal rating while flagged components are sent to the Sonatype Research team for detailed review. During this review, components are assigned a Suspicious Integrity Rating to be temporarily quarantined. Components discovered with dangerous behavior are labeled Malicious and left in quarantine. Components have their Integrity Rating updated to Normal after passing the review process.

**Note**  
The Integrity-Rating policy is automatically created when the Repository Firewall license is installed. This operation only occurs once, even if the license is installed again. The Integrity-Rating policy is configured to guard against malicious components.

This feature is designed to be used along with Repository Firewall's [Automatic Quarantine Release](https://help.sonatype.com/en/automatic-quarantine-release.html "Automatic Quarantine Release") to allow components re-assigned a normal integrity rating to be released without intervention by security teams.

## Enable Automatic Release

Automatically releasing components from quarantine keeps your environment running smoothly and reduces the needed effort managing components. We recommend allowing Automatic Release for Integrity Rating Policy Condition type and match state at a minimum.

See [Automatic Quarantine Release](https://help.sonatype.com/en/automatic-quarantine-release.html "Automatic Quarantine Release")

## Integrity-Rating Policy

The Integrity-Rating Policy looks at a component's Release Integrity Score and creates violations for components with _Pending_ or _Suspicious_ values. These statuses are given to new components when Sonatype's machine-learning tools find anything suspicious or unusual in the release.

| Release Integrity Score | Description |
| --- | --- |
| Unknown | - The component is unknown to Sonatype's identity system<br>  <br>- New components from public ecosystems are logged in minutes and queued for review |
| Pending | - The component has been logged with Sonatype's Integrity Rating ML system for review |
| Suspicious | - Signals from the component release indicate a threat<br>  <br>- Validation is prioritized by Sonatype's data security team |
| Normal | - The component has been assessed and appears normal |
| Not Applicable | - This component is not covered by the Integrity Rating system |

### Managing the Integrity-Rating Policy

The Integrity-Rating Policy is set using the following constraints. The action is set to Fail on the Proxy stage.

- Pending integrity rating - is in violation if the following is true: `Integrity Rating` is `Pending`

- Suspicious integrity rating - is in violation if the following is true: `Integrity Rating` is `Suspicious`

## Security Malicious Policy

The Security-Malicious policy is also triggered when a component is found to be malicious.  This information is from the `Security Vulnerability Category` and is labeled `Malicious Code`.

## Sample Malicious Components

The Sonatype data team maintains sample malicious components for [npm](https://www.npmjs.com/package/@sonatype/policy-demo), [maven](https://central.sonatype.com/artifact/org.sonatype/maven-policy-demo/1.0.0), [python](https://pypi.org/project/python-policy-demo/), [hugging face,](https://huggingface.co/) and [nuget](https://www.nuget.org/packages/Sonatype.sonatype-policy-demo.Package) projects to use in testing the Integrity Rating policy with the Repository Firewall. These components are not vulnerable in any way but will result in policy violations when used in an application analysis or when requested through the Repository Firewall.

| npm Version | Integrity Rating |
| --- | --- |
| "@sonatype/policy-demo" : "2.0.0" | Normal |
| "@sonatype/policy-demo" : "2.1.0" | Suspicious; malicious Security Vulnerability Category |
| "@sonatype/policy-demo" : "2.2.0" | Suspicious |
| "@sonatype/policy-demo" : "2.3.0" | Pending |

| Maven Version | Integrity Rating |
| --- | --- |
| pkg:maven/org.sonatype/maven-policy-demo@1.0.0 | Normal |
| pkg:maven/org.sonatype/maven-policy-demo@1.1.0 | Suspicious; malicious Security Vulnerability Category |
| pkg:maven/org.sonatype/maven-policy-demo@1.2.0 | Suspicious |
| pkg:maven/org.sonatype/maven-policy-demo@1.3.0 | Pending |

| Python Version | Integrity Rating |
| --- | --- |
| pkg:pypi/python-policy-demo@1.0.0 | Normal |
| pkg:pypi/python-policy-demo@1.1.0 | Suspicious; malicious Security Vulnerability Category |
| pkg:pypi/python-policy-demo@1.2.0 | Suspicious |
| pkg:pypi/python-policy-demo@1.3.0 | Pending |

| Hugging Face Version | Integrity Rating |
| --- | --- |
| 153045c9891f90cc8b9a1a28c77727065e62831b | Normal |
| 538f4075f93b173f75f10e505448c4d1ddb05515 | Suspicious; malicious Security Vulnerability Category |
| 5793ec913638e247ac9311e7b085d43a74e80a03 | Suspicious |
| 9f69193fe915031a1cb5be8adef4a40b43778e9a | Pending |

| NuGet Version | Integrity Rating |
| --- | --- |
| Sonatype.sonatype-policy-demo.Package 1.0.0 | Normal |
| Sonatype.sonatype-policy-demo.Package 1.1.0 | Suspicious; malicious Security Vulnerability Category |
| Sonatype.sonatype-policy-demo.Package 1.2.0 | Suspicious |
| Sonatype.sonatype-policy-demo.Package 1.3.0 | Pending |