Maybe it doesn't allow you to make changes to the library. Sometimes with open source software, the license is a bit more restrictive than might be convenient for what you are doing.

E.g., it checks the license that is being used in it. Then, it checks a number of things for each of those libraries. It does this for our Java libraries, JavaScript, and other things that it finds. Every time that a new build is created in our CI server, Nexus IQ server will check exactly what libraries that we're using. We use it to categorize and index all libraries used in our software. That is the only product that we use, though there are other affiliated products Sonatype offers which integrates with it. We either waive it or I'll acknowledge it depending on how much it's used throughout the system and how many different components are being built with that bad library. If we have nines we'll let it in, but I'll tag the developers and they'll have to do a little triage to figure out if the problem that is being reported is something we utilize in our system - if it's something that affects us - and if it's not, we flag it as such and let it go. If it's a 10, we don't let it into our system the firewall server stops it. We're addressing anything that is a nine and above. We have the developers develop in their Dev and Test environments, and as the code moves through each environment - Test and a QA environment - it goes through a build process. Our environment is your standard, three-tiered environment. We have the firewall sitting in front to make sure we don't let anything real bad into the system. We have Nexus Firewall on, but it's only on for the highest level of vulnerabilities.

Everything being developed for our big application comes through that tool. All of our third-party libraries, everything, comes through our Nexus, which is what the IQ Server and Jenkins are hooked into. We use it to automate open source governance and minimize risk.

Every time we do a build, Jenkins reaches out and kicks off a scan from the IQ Server.

We have it implemented and integrated into our CI/CD pipeline, for when we do builds.

Nexus iq download