Skip to content
Visual Studio Code plugin for Nexus IQ
TypeScript HTML CSS Other
Branch: master
Clone or download
sonatype-community
sonatype-community chore(release): 0.7.1 [skip ci]
## [0.7.1](v0.7.0...v0.7.1) (2019-12-17)

### Bug Fixes

* Fix market place link ([#76](#76)) ([72ff663](72ff663))
Latest commit 886fbd7 Dec 17, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.circleci fix: Improve changelog Dec 13, 2019
.vscode Refactor and fun times (#36) Oct 28, 2019
ext-src feat(sorting): default sort policy descending (#75) Dec 17, 2019
media clean unused assets Nov 22, 2019
public Refactor and fun times (#36) Oct 28, 2019
resources docs: updated complete changelog (#73) Dec 17, 2019
scripts fix: just do a tiny release to see if R works when packaged (#62) Nov 26, 2019
src docs: updated complete changelog (#73) Dec 17, 2019
types/react-loader-spinner Add React support (#7) Aug 23, 2019
.env Add React support (#7) Aug 23, 2019
.gitignore Refactor to add semantic-release (#55) Nov 22, 2019
.releaserc.json fix: Improve changelog Dec 13, 2019
.vscodeignore fix: re-exclude ext-src/ Nov 22, 2019
CHANGELOG.md chore(release): 0.7.1 [skip ci] Dec 17, 2019
CONTRIBUTING.md Improved documentation Nov 21, 2019
LICENSE.txt Initial release to marketplace May 31, 2019
README.md fix: Fix market place link (#76) Dec 17, 2019
TODO.md Initial release to marketplace May 31, 2019
generate-format.sh Refactor and fun times (#36) Oct 28, 2019
images.d.ts Add React support (#7) Aug 23, 2019
package-lock.json chore(release): 0.7.1 [skip ci] Dec 17, 2019
package.json chore(release): 0.7.1 [skip ci] Dec 17, 2019
tsconfig.extension.json Refactor and fun times (#36) Oct 28, 2019
tsconfig.json Fingers crossed Nov 22, 2019
tsconfig.prod.json Add React support (#7) Aug 23, 2019
tsconfig.test.json Add React support (#7) Aug 23, 2019
tslint.json Refactor and fun times (#36) Oct 28, 2019
vsc-extension-quickstart.md initial commit May 30, 2019
yarn.lock docs: updated complete changelog (#73) Dec 17, 2019

README.md

Sonatype Nexus IQ Plugin for VS Code

Visual Studio Marketplace Version

Scan your libraries against either the free OSS Index vulnerability database or the Sonatype Nexus IQ Server. Drill down into all of your dependencies to examine each package version for security vulnerabilities. With IQ Server, it also provides policy and license details.

Features

  • Scan npm, Maven, RubyGems, Go (dep and go mod), R (see known quirks) or PyPi projects (Go is only supported on Linux or OS/X)
  • See all components with vulnerable components highlighted

Sonatype Nexus IQ Scan

1574377213618

OSS Index Scan

1574377213618

Themes

1574377213618

Requirements

  • To enable the IQ Scan, you will need a Sonatype Nexus IQ Lifecycle License but the OSS Index scan will work for all users
  • The plugin requires npm, golang, maven, ruby / bundler, or python and pip to be installed, depending on which language you are using. It will not install these as a part of the plugin

Extension Settings

  • Configuration is done in the VSCode Preferences > Settings > Sonatype Explorer

VS Code Settings

If you are using IQ Server, you can enter your password which will be stored in cleartext, or for additional security you can leave this blank and whenever you start VS Code (and if you have the Nexus Explorer Data Source set to iqServer) you will be prompted for a password:

VSCode Settings

If you are using IQ Server v76 or above, you can create a user token and save this in the password field instead. The added benefit of doing this is that you are not storing your IQ Server password in plaintext, and rather a user token that can be deleted, etc... if need be.

Known Quirks

We try and use other tooling whenever possible, to avoid reinventing the wheel (that's what Open Source is about anyways, right!). However due to using this tooling, we are at the mercy of it, sometimes, so here's a list of quirks we've ran into while developing/using this extension ourself.

npm

  • We run either npm shrinkwrap, npm list, or yarn list depending on what tool chain you are using.
  • If we are unable to parse your dependencies, it's likely one of those commands is throwing an error, and you should make sure it isn't.
  • Projects that use both npm and yarn can be confusing to a program, as we have to pick one to work with. If you experience issues, bear this in mind, it's likely that you have both a package-lock.json and a yarn.lock, and our lil extension is going "OH NOES!" because one is out of date, etc...

RubyGems

  • Ruby Gems support depends on the installation of ruby, and bundler
  • If your ruby version mismatches what is declared in your Gemfile, bundler will not run properly
  • If you use rbenv, ensure your .ruby-version file matches your Gemfile
  • In order for the command we use to get your dependency list to output to succeed, you need to have run bundle install, as bundle show cannot track down what you use locally otherwise

Golang

go mod
  • Golang support depends on an installation of Golang
  • We run go mod list -m all to get your dependency list
  • This includes test dependencies, so it might be noisy
  • It would seem due to this running in VS Code, it runs in a slightly different shell/user, and thus it downloads your dependencies. We set this to /tmp/gocache in code, which may not work on Windows (PRs welcome!), so it might be slowish on it's first run
dep
  • We parse the Gopkg.lock toml file provided by dep
  • Some dep versions do not use semver, so unless you are using a version that looks like 1.0.0 etc... you won't get results from OSS Index or IQ Server
  • dep support works on Windows/OS X/Linux, as we are not running any OS specific commands

R (Cran)

  • R support depends on R being available, and your project needs a .Rbuildignore file otherwise we cannot determine it's an R project
  • This extension also runs an R script to get your installed packages (currently the best way we know of to do this), the way we get these can be seen at scripts/installed.r in our GitHub repo
  • The way the R script runs, it finds all of the packages you've installed in the R environment, so not just for your project. This is because there is really no way to query for project specific packages, and appears to be a limitation of R.

Various and Sundry

  • Projects with both RubyGems and NPM (Gemfile.lock, and package.json), or similar, this extension currently picks one format, and scans for it. We haven't built a path to scan multiple project types, but that would be lovely. PRs welcome :)

  • "My project has 3,000 dependencies, why is this so slow?!?". We chunk up requests to OSS Index (free solution) in sections of 128 dependencies, so for 3,000 dependencies, you are making 24 https POST requests for information, and then it's merging those results, etc... We'd love to know your feedback on the tool, so if you do run into this, open up an issue and let us know! Same goes for IQ Server, there could be quite a bit to process.

Development

Development requires running this project in Visual Studio Code, for ease of testing etc...

You'll need a working version of nodejs (we have been using 10.x and higher), and then:

npm i

Then:

npm run build

Then:

Debug > Start Debugging

If you are working on functionality that requires IQ Server, you'll need an instance running, and configured in the settings for the project. OSS Index should work right out of the box.

We highly suggest installing "Webview Developer Tools" for this project, as the front end is written in React, and it's nice to have that to see what's going on. All of the React specific code can be found in src. The rest of the code is contained within ext-src and this is what communicates with either OSS Index or IQ Server.

Contributing

We care a lot about making the world a safer place, and that's why we created this extension. If you as well want to speed up the pace of software development by working on this project, jump on in! Before you start work, create a new issue, or comment on an existing issue, to let others know you are!

The Fine Print

It is worth noting that this is NOT SUPPORTED by Sonatype, and is a contribution of ours to the open source community (read: you!)

Remember:

  • Use this contribution at the risk tolerance that you have
  • Do NOT file Sonatype support tickets related to this Visual Studio Code extension in regard to this project
  • DO file issues here on GitHub, so that the community can pitch in

Phew, that was easier than I thought. Last but not least of all:

Have fun creating and using this extension and the Sonatype OSS Index, we are glad to have you here!

Getting help

Looking to contribute to our code but need some help? There's a few ways to get information:

You can’t perform that action at this time.