Skip to main content

Nexus scanner reference

You can run Nexus scans on your repositories using a Security step: create a CI Build or Security Tests stage, add a Security step, and then add the setting:value pairs as specified below.

Before you begin​

Docker-in-Docker requirements​

note

Docker-in-Docker is not required for ingestion workflows where the scan data has already been generated.

You need to include a Docker-in-Docker background service in your stage if either of these conditions apply:

  • You configured your scanner using a generic Security step rather than a scanner-specific template such as Aqua Trivy, Bandit, Mend, Snyk, etc.
  • You’re scanning a container image using an Orchestration or Extraction workflow.
Set up a Docker-in-Docker background step

  1. Go to the stage where you want to run the scan.

  2. In Overview, add the shared path /var/run.

  3. In Execution, do the following:

    1. Click Add Step and then choose Background.
    2. Configure the Background step as follows:
      1. Dependency Name = dind
      2. Container Registry = The Docker connector to download the DinD image. If you don't have one defined, go to Docker connector settings reference.
      3. Image = docker:dind
      4. Under Optional Configuration, select the Privileged checkbox.
Configure the background step

Root access requirements​

You need to run the scan step with root access if either of the following apply:

  • You need to run a Docker-in-Docker background service.

  • You need to add trusted certificates to your scan images at runtime.

note

You can set up your STO scan images and pipelines to run scans as non-root and establish trust for your own proxies using self-signed certificates. For more information, go to Configure STO to Download Images from a Private Registry.

Security step settings​

Nexus configuration in a Security step
Configuring a Nexus scan in a Security step

Target and variant​

The following settings are required for every Security step:

  • target_name A user-defined label for the code repository, container, application, or configuration to scan.
  • variant A user-defined label for the branch, tag, or other target variant to scan.
note

Make sure that you give unique, descriptive names for the target and variant. This makes navigating your scan results in the STO UI much easier.

You can see the target name, type, and variant in the Test Targets UI:

Target name, type, and branch

For more information, go to Targets, baselines, and variants in STO.

Nexus scan settings​

  • product_name = nexusiq
  • scan_type = repository
  • policy_type = orchestratedScan or dataLoad
  • When policy_type is set to orchestratedScan:
    • product_domain — The URL of your NexusIQ instance.
    • product_access_id — The password used to log in to the NexusIQ UI.
    • product_access_token — The password used to log in to the NexusIQ UI. (This is not an API access token.)
    • product_organization_id — The organization defined in Nexus. You can use the Organzations API to get a list of all your organizations.
    • product_project_name — The application ID of the Nexus application. This also corresponds to application-id used in the NexusIQ CLI.
    • product_lookup_type
      • accepted value(s): byPrivateId, byPublicId
    • When product_lookup_type is set to byPublicId:
      • product_public_id
    • When product_lookup_type is set to byPrivateId:
      • product_private_id
    • product_config_name
      • Accepted values(s): default
  • fail_on_severity - See Fail on Severity.

Ingestion file​

The following setting is required for Security steps where the policy_type is ingestionOnly.

  • ingestion_file The results data file to use when running an Ingestion scan. You should specify the full path to the data file in your workspace, such as /shared/customer_artifacts/my_scan_results.json. STO steps can ingest scan data in SARIF and Harness Custom JSON format.

The following steps outline the general workflow for ingesting scan data into your pipeline:

  1. Specify a shared folder for your scan results, such as /shared/customer_artifacts. You can do this in the Overview tab of the Security stage where you're ingesting your data.

  2. Create a Run step that copies your scan results to the shared folder. You can run your scan externally, before you run the build, or set up the Run step to run the scan and then copy the results.

  3. Add a Security step after the Run step and add the target name, variant, and ingestion_file settings as described above.

For a complete workflow description and example, go to Ingest Scan Results into an STO Pipeline.

Fail on Severity​

Every Security step has a Fail on Severity setting. If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. You can specify one of the following:

  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
  • INFO
  • NONE — Do not fail on severity

The YAML definition looks like this: fail_on_severity : critical # | high | medium | low | info | none