A User Guide to Reports in Sonatype CLM
As we mentioned previously, component violations can be waived for a single component in a single application, all the way up to all components in all applications. This means, that a violation for a component in your application could have been waived elsewhere. A good practice when reviewing the Application Composition Report is to check and see what violations have been waived for components in your application. Here are a couple examples of why this is important:
- Scenario 1: A violation for a component has been waived, and the component has additional violations. Depending on the view selected, at least one of these additional violations will be displayed.
- Scenario 2: The only violation for a component has been waived. Given that the component has no additional violations, it will be moved into the None policy threat group (light blue) in the Summary view, while the other views will only show the waived violation.
To view waived violations for your components, follow the instruction below.
- First, access an application composition report.
-
Navigate to the Policy tab on the report. Just above the list of components, and to the right of the report, you will see three options in the Violations filter:
- Summary - this is the default view of the Policy tab. It is important to note, that even though this view will display all components, only the highest threat violation per component is displayed. In this view, components with waived violations may have been moved to the None policy threat group (light blue).
- All - clicking this filter option will display every violation for all components in your application. This may result in the appearance of duplicates in the component list. Violations that have been waived will be indicated by a white flag icon.
- Waived - clicking this filter option will display only the waived violations. In this view, you will only see those components where violations have been waived. Each component will have a white flag icon, and it is likely you will not see all components. This view may also produce the appearance of duplicated components.
- Click on a component to display the Component Information Panel (CIP). For an example, see Figure 7.2, “Waiver Button”.
- At the top of the of the component list, click on the View Existing Waivers button. A modal will be displayed showing all the waivers for the component, as well as the associated descriptions.
- Click the remove icon, which resembles a minus sign.
- A message will ask you to confirm this removal. Click the Remove button to continue.
Note
Because some waivers can be set for all applications, and even all components, it’s important to understand the impact of removing a waiver. Be sure to verify with the application or organization owner, the intended scope of the waiver.
