Repository Results View

The repository results view is an audit of the components from a proxy repository when the Repository Firewall is enabled. This view lists the components requested through the proxy and any violations found near the time the component was requested.

Outline of the Firewall Evaluation

Components are evaluated when first requested through the proxy repository to quarantine components with unacceptable risk before they are downloaded through the proxy. The results of this evaluation are stored with the component as of the time it was first requested.

1. Component is requested for the first time from a proxy repository.
2. The component is fetched from the remote repository and evaluated by Repository Firewall using the policy scoped to the proxy repository. This point-in-time evaluation is retained with the component.
3. When the component is found in violation of the policy, it is put into quarantine and prohibited from being downloaded through Nexus Repository.
4. For 14 days, the quarantined component is re-evaluated by the Automatic Quarantine Release capability. If the quarantining policies are resolved during this time, the component is released from quarantine and made available for download.
5. Components added to the proxy repository are not evaluated again unless triggered by the Re-evaluate Repository action on the proxy.
6. Components deleted from the repository are managed as if they are a new component when requested.

Automatic Quarantine Release

This configuration re-evaluates components every hour for 14 days after they are first quarantined. After the 14-day period, components are no longer evaluated to minimize load on the service. When the quarantine policies are resolved during this time, the component is released from quarantine and made available for download.

The frequency that quarantined components are re-evaluated may be adjusted from the default of once an hour (60 minutes) using the Auto Release Task configuration.

See Automatic Quarantine Release

Re-evaluate Repository

You may perform a complete re-evaluation of all the components within the repository by selecting the Re-evaluate Repository action. This performs another evaluation for every component within the repository.

• This action does not quarantine any components when new violations are discovered. This is to limit the impact on production builds that may now depend on those components.
• Quarantined components in quarantine for over 14 days are not automatically removed from quarantine.

The time to finish a complete re-evaluation of a proxy repository depends on the number of components in the repository. This re-evaluation may introduce significant load on the server for repositories that have a large number of components.

We recommend limiting how often the Re-evaluate Repository audit is done to avoid strain on production services or delaying new requests through the proxy.

Repository Summary

The summary section contains metrics on the health and contents of the repository. Here you will find the total number of components, the number of violations that affect some of the components, and a spread of the severity of those violations. You will also see if any components have been quarantined and are blocked from downloading through the proxy.

Repository Components

This table lists all the components in the proxy repository and their associated violations found as of their last evaluation. By default, the view is aggregated by components while only displaying the highest policy violation for that component.

The table includes the following timestamps:

| Evaluation Time | Displays the most recent time a component was evaluated by Repository Firewall. | | Quarantine Time | Displays the date and time a component entered quarantine. This value is displayed only for components that are currently quarantined. Components that have never been quarantined or that have been released from quarantine display an empty value. |

This distinction helps identify whether a timestamp represents a component evaluation or an active quarantine state.

• View the component details

Select an individual component from the list to view the component's detail page.

• Switch 'off' the aggregate by components toggle to see all violations

When the toggle is 'on', only the highest-threat violation is displayed for the component. Select the component to view all violations for the component.

• Release quarantined components

Components are released from quarantine by waiving the policy failing violations on the component. Waive the violations from the component details page. Once the failing violations have been waived, the components are released from quarantine.

• Filtering the repository results

Results may be filtered by the match state and the violation status.

• Match State

  • All - no filter
  • Exact - Components identifiable by Sonatype
  • Unknown - Components unknown to Sonatype

• Violations

  • all/none - no filter
  • Not Violating - components with no violations
  • Open - violations not waived or remediated
  • Quarantined - components that have been quarantined due to a failing violation
  • Waived - violations that have been waived

Viewing results in Nexus Repository

As developers request components from a proxy repository, Firewall audits them using the policies in the IQ Server. There are a couple of ways to navigate this report.

The IQ Policy Violations are summarized in the Nexus Repository Pro and detailed in IQ Server.

In Nexus Repository Pro 3, the audit results are summarized in the IQ Policy Violations column of the Repositories view.

This view is located in the Repository sub-menu of the Administration menu.

The IQ Policy Violations column includes the following items:

• A count of components by their highest policy violation level.
• A count of quarantined components.
• A link to Repository Results on IQ Server.

The IQ Policy Violations column alerts you if there are any errors in the audit and quarantine process. If there is an error a red exclamation mark will appear to the right of the Repository Results along with a description of the error. Additional information will be available in the Nexus Repository logs.