Sonatype Repository Firewall
Sonatype Repository Firewall is the first line of defense for controlling the open-source components allowed into your Software Development Lifecycle.
Prevent Malware - from entering your software supply chain
Automatically Evaluate - every new component against your custom governance policies
Automatically Quarantine - components before they are available in your artifact repository
Sonatype's IQ Server powers the Repository Firewall. The integration connects to your artifact repository to oversee the enforcement of your open-source consumption policies.
View the latest release in the IQ Server Release Notes
Paths to Getting Started
The Repository Firewall license is available as a fully managed Cloud solution or a self-hosted deployment where you manage the service.
Firewall Cloud
Firewall Cloud reduces time-to-value by skipping the time needed to provision hardware and the costs of managing the self-hosted service. Only one quick step set up your tenant and IdP (identity provider) before jumping into protecting your infrastructure.
Getting started with Firewall Cloud
Self-Hosted
The Self-Hosted solution deploys as you want; as a single-node or a multi-regional, highly available service without restrictions. Built on the same platform as Lifecycle and SBOM Manager to scale with your organizational requirements.
Getting started with Repository Firewall
Repository Firewall Product Information
Repository Firewall can be used without IQ Server or an artifact repository, but some functionality is available only when those components are configured. Repository Firewall is compatible with Sonatype Nexus Repository 3 Pro and JFrog Artifactory.
Note
If IQ Server or an artifact repository is not configured, Repository Firewall functionality is limited.
Minimum Requirements by Deployment
Deployment Tier | IQ Server | Nexus Repository | Notes |
|---|---|---|---|
Nexus Repository Pro+ (Cloud) | N/A | N/A | Repository Firewall is included in the Pro+ subscription. |
Nexus Repository Pro+ (Self-hosted) | 208 | 3.97.0 | Repository Firewall is included in the Pro+ subscription. IQ Server needs to be manually installed and configured with Nexus Repository. |
Nexus Repository Pro (Cloud) | N/A | N/A | Needs an additional Repository Firewall license. |
Nexus Repository Pro (Self-Hosted) | 134+ | 3.38.1 | Needs an additional Repository Firewall license. IQ Server needs to be manually installed and configured with Nexus Repository |
JFrog Artifactory (Self-Hosted) | 134+ | 7.2.6 | Provided through Firewall for Artifactory Plugin. Does not support Cloud Deployments. |
Below is a matrix of Sonatype server product versions minimally verified for Repository Firewall features. This does not mean all features are supported by these versions.
The table suggests that major issues should not be encountered when running these minimal versions congruently.
If you encounter problems with any of the versions listed, we advise upgrading to the most recent version first to attempt resolution of the issue.
Repository Firewall is powered by the IQ Server
IQ Server | Nexus Repository 3 | Nexus Repository 2 |
|---|---|---|
138 | 3.58.0 | |
106 | 3.30.0 | |
1.46.0 | 3.12.1 | 2.14.8 |
1.42.0 | 3.8.0 | 2.14.6 |
1.33.0 | 3.7.1 | 2.14.5 |
Not Supported | 3.4.0 | 2.14.4 |
Repository Firewall Features
Features | Sonatype Nexus Repository 3 | JFrog Artifactory |
|---|---|---|
|
| |
|
| |
Available for; npm, Maven, PyPI, Hugging Face, and NuGet |
|
|
|
| |
|
| |
|
| |
|
| |
PCCS for npm | IQ.134, NX-3.44 | plugin 2.4.4 |
PCCS for PyPI | IQ.167, NX-3.61 |
For JFrog Artifactory requirements, installation, and configuration instructions, see JFrog Artifactory Setup.
Package Support for Repository Firewall
The following ecosystems and proxy URLs are the supported package repositories for the Repository Firewall.
Note
The ABF, Manifest, and ABF/Manifest scan types described in Lifecycle analysis do not apply to Repository Firewall. Repository Firewall supports hash-based matching for Maven, npm, PyPI, NuGet, RubyGems, and Docker. Other supported formats use request-based matching.
This is not a comprehensive list of sources for Sonatype Component Intelligence.
Package Manager | Public Repository |
|---|---|
CocoaPods | https://cdn.cocoapods.org |
Composer | https://repo.packagist.org |
Conan | https://center.conan.io (supports Conan v1 and Conan v2) |
Conda | https://repo.anaconda.com/pkgs |
Docker IQ 194 & Nexus Repository 3.83.0 not supported by Firewall for Artifactory | https://registry-1.docker.io |
Go Modules | https://index.golang.org (detection of pre-release versions is not supported) |
Hugging Face IQ 191 & Nexus Repository 3.80.0 | https://huggingface.co Provides enforcement on the following extensions: .bin, .pt, .pth, .h5, .msgpack, .onnx, .ot, .safetensors, .gguf, .pkl, .pickle |
Maven | https://repo.maven.apache.org/maven2 https://maven.google.com https://maven.repository.redhat.com/ga/ |
npm | https://registry.npmjs.org |
NuGet | https://nuget.org |
PyPI | https://pypi.org |
Pub (Dart/Flutter) IQ 208 & NEXUS Repository 3.97.0 | https://pub.dev |
RubyGems | https://rubygems.org |
Rust/Cargo IQ 181 & NEXUS Repository 3.74.0 | https://index.crates.io |
R Language | https://cran.r-project.org |
Raw NEXUS Repository 3.83.0 | Any static website that's proxied |
Swift Package Manager (SPM) IQ 208 & NEXUS Repository 3.97.0 | https://github.com/ |
Yum/rpm (EPEL) | https://dl.fedoraproject.org |