Analysis

We examine binary fingerprints (similar to a truncated sha1 hash) of the files and not just the file names and manifests. ABF examines everything included in the application after the build, including any embedded dependencies. An ABF scan will not return false positives in its report. Sonatype data is tied to the component fingerprints of any files where the vulnerability is discovered. When a vulnerability is reported it is because the component fingerprint is in your application. Depending on the environment, there are a few points where this might be confusing.

Scans performed before the application has been built do not have open-source dependencies to fingerprint and must therefore leverage package-lock and manifest files to scan. This happens when directly analyzing the source control repositories or software bill of materials earlier in the development lifecycle. The Lifecycle scanners can use the lock or manifest files to get an idea of what should be in the final application. This will include any transitive dependencies if they are included in the lock file. Otherwise, it will report on only what is requested in the manifest.

Sonatype Lifecycle uses data derived from our automated vulnerability detection system — basically, a big funnel of sources (NVD, GitHub commits, OSS Index, Sonatype research, etc.) that is processed with automated techniques such as data filtering, aggregation, and machine learning algorithms.

For most ecosystems, Sonatype researchers triage incoming data and determine if there is a vulnerability, creating a research ticket for further investigation when necessary. Tickets are prioritized and then entered into our human-curated research process. When research is complete, it goes into our data mart which feeds Sonatype Data Services. Data from the Sonatype Data Services is what you’ll then see in the Lifecycle Dashboard and Application Composition report after an application scan.

For ecosystems with only Security/Identity data, we report any known security vulnerabilities but may not include in-depth research or license data.

The table below lists the ecosystems (languages, package managers, etc.) that Sonatype Lifecycle supports.

Ecosystems that are supported by Sonatype Advanced Legal Pack are indicated as ALP.

The examples in this section use IQ Server CLI to scan components in Maven format.

For more examples on scanning components from other popular package managers/package formats refer to Referencing Package URL (purl) and Component Identifiers.