Sonatype + GitLab | Better Together
INTEGRATION
Sonatype + GitLab Accelerating DevOps Together
The GitLab experience enhanced by best-in-class vulnerability insights from Sonatype.
New
[The integration between Sonatype Lifecycle and GitLab Ultimate just got better with new security workflows that deliver Sonatype vulnerability insights directly into GitLab reporting. Learn More
The GitLab Experience + Industry-Leading Software Supply Chain Security
Malware Firewall
Defend your DevOps infrastructure with the world's only enterprise class malicious OSS protection
Repository
Manage artifacts and proxy OSS components as the nexus of your GitLab
License Obligations
Scan and understand the components in your GitLab repos for Legal and IP leakage risk
Source Control
Seamlessly onboard Source Control repositories with deep GitLab integration
Build
Scans integrated with builds orchestrated and executed by GitLab
Developers
Merge Request automation to accelerate dependency management
Operate
Integrated into your DevOps and Release processes to ensure released software is secure via automation including GitLab Pipelines
Secure Your Pipeline, Empower Your Team
Proactive Malicious Protection
Get Sonatype vulnerability findings within your GitLab reporting for a comprehensive view of risk across projects.
Enhanced Developer Efficiency
Smarter recommendations to accelerate development beyond dependency scanning or Renovate bot.
Proven Binary Artifact Repository
Work where and how you want with world-class security that runs with any binary artifact repository or without one.
Code with Confidence When You Have Sonatype Data
Malicious open source packages detected... and counting
.8 0
1,8 0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
8 0
6
2
9
5
1
7
4
0
6
2
9
5
1
7
4
0
6
2
9
5
1
7
4
0
6
2
9
5
1
8 0
2
3
5
7
8
0
1
3
5
6
8
0
1
3
4
6
8
9
1
3
4
6
8
9
1
2
4
6
7
9
1
2
4
5
7
9
0
2
4
5
7
9
0
1,8 0
2
5
7
9
2
4
6
9
1
3
6
8
0
3
5
7
0
2
4
7
9
1
4
6
8
1
3
5
8
0
2
4
7
9
1
4
6
8
1
3
5
8
0
2
5
7
9
2
4
6
9
1
3
6
8
0
3
5
8 n0
9
7
6
5
3
2
0
9
8
6
5
4
2
1
0
8
7
5
4
3
1
0
9
7
6
4
3
2
0
9
8
6
5
4
2
1
9
8
7
5
4
3
1
0
9
7
6
4
3
2
0
9
8
6
5
4
2
1
9
8
7
5
4
3
1
0
9
7
6
4
3
2
1 8 0
2
4
6
8
0
2
4
6
8
0
2
4
6
8
1
3
5
7
9
1
3
5
7
9
1
3
5
7
9
1
3
5
7
9
1
3
5
7
0
2
4
6
8
0
2
4
6
8
0
2
4
6
8
0
2
4
6
8
0
2
4
6
8
0
2
4
6
9
1
3
5
7
9
1
3
5
7
9
1
3
5
7
Why Sonatype + GitLab Are Better Together
When used together, Sonatype and GitLab accelerate DevSecOps and enhance security to foster a culture of continuous innovation. Sonatype makes GitLab work better by using the industry's best data source to identify and fix more vulnerabilities.
Developer Efficiency
Accelerate development with upgrade recommendations that are smarter than 'latest version.'
Comprehensive Reporting
Get a holistic view of risk across all your projects Sonatype Platform reporting capabilities.
Security Insights
Gain robust security insights within your GitLab workflows to manage vulnerabilities more effectively.
The Only Enterprise-Class Software Supply Chain Security that Integrates into the GitLab Workflow
Proactive OSS Malware and Vulnerability Protection
- Intercept known and zero-day threats from infiltrating your software supply chain.
- Continuously scan your code base for security vulnerabilities.
- Shift left by addressing security issues during the earliest stages of development.
Software Security That Doesn't Slow Down Development
- Use only secure and approved components for comprehensive dependency management.
- Scale without compromise and control the lifecycle of staged builds directly from your CI/CD server.
- Drive developer productivity while reducing build failures and security risks.
Enhance Your GitLab Security with Sonatype to Accelerate DevOps
| #### Features | GitLab + Sonatype |
|---|---|
| Malicious OSS Protection | yes The only enterprise malicious OSS protection |
| OSS Security Data | yes World's deepest, broadest and most accurate OSS data set |
| Central Policy Engine | yes Policy engine with robust rules set alongside application and stage context to determine notification and enforcement |
| Source Control | yes Enterprise class source control based on git |
| Legal License Risk Reduction and Compliance | yes Open source component legal review in less than 10 minutes |
| Binary Artifact Repository | yes Strong repository offering with light integration at the Repo level |
| OSS Reporting and Management | yes Real-time visibility to OSS usage throughout your application landscape and enterprise reporting |
| DevOps Pipelines Automation | yes Fully supported GitLab CI with Sonatype Plugin |
| Dependency Management Automation | yes Smart suggestions with merge request and dependency management automation based on the world best data system |
GitLab + Sonatype
| Features | |
|---|---|
| Malicious OSS Protection | yes The only enterprise malicious OSS protection |
| OSS Security Data | yes World's deepest, broadest and most accurate OSS data set |
| Central Policy Engine | yes Policy engine with robust rules set alongside application and stage context to determine notification and enforcement |
| Source Control | yes Enterprise class source control based on git |
| Legal License Risk Reduction and Compliance | yes Open source component legal review in less than 10 minutes |
| Binary Artifact Repository | yes Strong repository offering with light integration at the Repo level |
| OSS Reporting and Management | yes Real-time visibility to OSS usage throughout your application landscape and enterprise reporting |
| DevOps Pipelines Automation | yes Fully supported GitLab CI with Sonatype Plugin |
| Dependency Management Automation | yes Smart suggestions with merge request and dependency management automation based on the world best data system |
Resources
Sonatype GitLab Integration
Documentation on integration and configuration
Sonatype Community
Details on GitLab Ultimate integration
Frequently Asked Questions
Why is GitLab security not enough?
Good enough is not enough. Sonatype augments GitLab with best-in-class vulnerability data and securing findings. By using both solutions, developers can save time spent fixing security issues.
How can GitLab and Sonatype users maximize the investments they have already made in DevOps tools?
Users can maximize the investments they have already made by leveraging best-of-breed technologies for application security and repository managers. The GitLab and Sonatype integration allows users to embed security into the DevOps tools they are already using. This helps them shift security left in the SDLC, creates better developer experiences, and increases release velocity.
How easy is it to integrate Sonatype and GitLab?
Sonatype can be easily integrated with GitLab by following the prescribed documentation guidelines.
We leverage the application permissions as configured in GitLab for access control. The integration of these tools enhances the overall development experience by combining:
- Repository/Artifactory
- Security
- Collaboration
- Version control
Do you have to replace GitLab to work with Sonatype?
No, Sonatype complements the developer experience with GitLab. The Sonatype GitLab integration allows you to automatically create trustworthy pull requests for accelerating dependency management. Developers can remediate with recommendations context about policy violations in pull requests. This is backed up by Sonatype’s prioritization engine giving developers confidence that they’re being recommended the best version available and removing friction in their GitLab pipeline.
Why do you need a reliable security partner like Sonatype along with your DevOps tool?
The question to ask is how much time you spend fixing false positives or false negatives. The more you automate, the more you also have to automate security. You need a reliable partner to do that, or development speed is impeded and can cause things like delayed release dates, etc.
How can customers enhance their ROI with Sonatype and GitLab combination?
The Sonatype-GitLab integrated experience is not just about innovation; it's about maximizing your ROI by investing in security and efficiency. The integration reduces security risks, streamlines workflows, and ensures compliance.
How does Sonatype improve collaboration between Development and Security?
Sonatype brings together automation, development, security, and release processes to reduce the risk of security vulnerabilities and time spent developing software.
How Sonatype and GitLab when used together provide a DevSecOps Accelerator?
Sonatype and GitLab, when used together, provide a DevSecOps Accelerator enabling your organization to elevate its development practices, enhance security, and foster a culture of continuous innovation. Sonatype makes GitLab work better by using the industry’s best data source to identify and fix 8x more vulnerabilities than they do, 10x faster than they do.