Nexus Analyzer

[Henri Gomez]

Hi all,

We get in trouble some days ago being unable to fetch contents from repository.sonatype.org.

After some analysis, we discovered Sonatype blocked one of our IP.

We contacted Sonatype support and they confirmed our IP was was blocked due to excessive requests to https://repository.sonatype.org/service/local/identify/sha1

Problem appears in March 2014, and it seems at this time, DC by default tried to resolve artifacts using sha1 requests to repository.sonatype.org

Is it still the current situation ?

If so, I would highly suggest to disable it since DC users could be black listed and blocked from repository.sonatype.org, Nexus site also used to fetch regular artifacts

Regards

[Steve Springett]

Henri,

By default, the CLI, Maven plugin and Ant task have the Nexus analyzer enabled by default. The Jenkins plugin has this analyzer disabled by default. A local Nexus server can also be specified so that you're no relying on Maven Central for results.

Will, 

Any thoughts on how to remediate this type of situation going forward?

--Steve

[Jeremy Long]

Likely need to cache results locally or disable the analyzer by default..  thoughts?

Jeremy

--
You received this message because you are subscribed to the Google Groups "Dependency Check" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dependency-che...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Steve Springett]

Caching the results makes a lot of sense, especially if we can do so using the existing data directory, either in a database or text file.

[colezlaw]

As Jeremy mentioned, if you've got an internal Nexus repository, you can configure that. In dependencycheck.properties, set analyzer.nexus.url to your internal Nexus repository.

We've talked about caching, and another possibility might be to not use Nexus if POM properties were identified.

I'll also work on the Maven Central search analyzer which will (hopefully) replace Sonatype as the default. You can continue to use Nexus internally, but the default global one would be to use the service API at search.maven.org.

[Brian Fox]

Hi Jeremy, using our service to look up hashes is ok, we just didn't understand what the usage was all about. That said, it would be better if you could use search.maven.org instead for the lookups. The api is documented at http://search.maven.org/#api and a hash lookup would be like this:

http://search.maven.org/solrsearch/select?q=1:%2235379fb6526fd019f331542b4e9ae2e566c57933%22&rows=20&wt=json

you can also use wt=xml if you prefer that over json.

Now that we know what this usage is, we don't accidentally block anyone but let us know how we can help move you to the search instance.

Thanks,

Brian

[William Stranathan]

Fantastic! Thanks to Sonatype for getting back to us on this!

Yes - I have plans to switch to solrsearch, but was reviewing the ToS this morning and was also afraid there we might hit the same velocity restrictions - but your email makes me feel a lot better about the transition.

Jeremy - I'll make the switch to solr a priority. 

--
You received this message because you are subscribed to a topic in the Google Groups "Dependency Check" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/dependency-check/wBN17b0OOtA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to dependency-che...@googlegroups.com.