Sonatype CLI

For automated systems, we recommend passing a user token instead of a username and password. You may consider configuring a dedicated service account with the minimum access privileges.

The authentication credentials require the Evaluate applications permissions for the specific application or organization to perform an analysis. We recommend using the default Application Evaluator role for simplicity.

Parameters such as user credentials should be obfuscated using a parameter file or environment variables.

See Passing CLI parameters from a file for details.

The CLI will need an application configured in the Lifecycle server to determine which policy to use and to associate the finished scan report. Applications may be added beforehand or during evaluation using the Using Automatic application creation with the CLI feature.

Applications may be analyzed as a built archive file or a directory (build workspace) containing the application code.

As a Java application, the CLI is started using a java command with the required parameters. The syntax below represents the minimum set of options required to evaluate an application.

java -jar [sonatype-cli] -a [username:password] -i [--application-id] -s [--server-url] [scan-target]

java -jar nexus-iq-cli*.jar \
  -a username:password \
  -i sandbox-application \
  -s http://localhost:8070 \
  ./sample-application.zip

java -jar ./nexus-iq-cli*.jar

Reachability Analysis with Sonatype CLI

RELEASE 152

You can now configure Sonatype CLI to perform Reachability Analysis, which can detect method signatures in your application code that contain components with potentially exploitable security vulnerabilities. Policy violations occurring due to these vulnerable components are labeled as Reachable and can be viewed on the application report.

How Reachability Analysis Works in Sonatype CLI

Reachability Analysis leverages the Callflow feature in Sonatype CLI.

By including an additional parameter in the CLI command you can enable the Callflow feature. The scan process will then analyze all application and dependency Java (or any JVM language) binaries located in the scan target.

This allows you to detect reachable vulnerabilities, even in proprietary components within your application.

Using Reachability Analysis in Sonatype CLI

On first execution, if Reachability analysis detects a component (belonging to the Maven ecosystem) that has a vulnerable method signature, the application report will show a policy violation with Reachable status.

You can prioritize the remediation of this violation.

Additional options to use in evaluating applications with the Sonatype CLI.

-t, --stage

Specify the development lifecycle stage for the analysis. Defaults to the build stage

-r, --result-file

Send the output to a specific file path as a JSON data object.

See Example Scan Result File

-m, --metadata-file

Specify the file path providing a JSON object containing the commit hash for the SCM integrations.

{"commitHash": "<git-commit-hash>"}

--module-exclude

Specify module files to ignore via Apache Ant-styled patterns. Repeat the option for multiple specifications.

**/sonatype-clm/module.xml

-w, --fail-on-policy-warnings

Causes a failure of the evaluation if any warnings are encountered.

-e, --ignore-system-errors

Ignore system errors (e.g. IO, Network, server, etc.) when running on continuous integration servers to avoid unintentional build failures.

-E, --ignore-scanning-errors

Ignore scanning errors (e.g. invalid files, inaccessible files, etc) when the code base contains invalid files for testing purposes. Scanning these files may cause unintentional build failures.

-X, --debug

Enables debug logging for troubleshooting. Use with caution as this log may expose sensitive information.

-h, --help

Output help context for CLI.

-v, --version

Output version of the CLI

-k, --keep-scan-file

Retain the temporary scan file normally deleted at the end of the scan.

-o

Set the directory to write scan output files.

-D includeSha256=true

-D excludeMavenDependencyManagement=true

test/dir/*/*.jar test/*/*.ear