If your repository contained a jar file with a known vulnerability, how would you know? What would it mean to have that sort of visibility into your repository health? This is probably not something you consider often, since one of the benefits of having a repository manager is enforcing component standards. But as you know, organizations still struggle to ensure that developers and build systems only acquire components from the repository manager. Which is why having the ability to run a Repository Health Check is an added benefit every repository manager should be aware of.
Explore how quick and easy it is to identify specific components with security vulnerabilities and unacceptable licenses in this quick how-to tutorial of Repository Health Check (RHC) 2.0, available in Sonatype Nexus Repository 3.3.
NOTE: If you're running an older version of Sonatype Nexus Repository, you'll see some new features, but you'll need to upgrade for the full experience, including download trends.
Sign into the Sonatype Nexus Repository UI and go to the Repositories feature in the admin section. The Health Check column is where we'll start.
First, click the Analyze button to enable RHC on a repository. A dialog box appears, giving you the opportunity to enable RHC on all supported repositories or just the repository you selected.
Choose "Yes, only this repository" if you want to try out RHC on the repository you selected. Once you do this, the Analyze button is replaced with an Analyzing… status. The initial scan might take several minutes.
(Tip: hit the Refresh button periodically to see when the scan is complete.)
Once the scan completes, an empty bar chart will appear. Over time, this chart will be populated with the following data:
-
The total number of asset downloads over the last 30 days.
-
The total number of bad asset downloads over the last 30 days (i.e. assets belonging to components with vulnerabilities).
-
Bar chart showing a rolling 30 day trend for both of the above.
Hover your mouse over the chart to see the RHC summary for this repository. Initially, the summary will look like this:
As assets are downloaded, the summary will gradually fill out with data. After a year, the summary will look like this:
If you're running Pro, click the View Detailed Report button to access the same detailed RHC report that existed in the previous version of RHC.
-4.png?width=541&height=287&name=image%20(1)-4.png)
And that's it. As always, we'd love to hear what you think. Drop us a line at nexus-feedback@sonatype.com.
Tags
Discover a Better Way to SCA
Forrester evaluated 10 SCA providers and recognized Sonatype with the highest possible scores. Learn why Sonatype was named a leader in Forrester Wave™ for SCA.