List of Figures

2.1. Installing a Product License on Sonatype CLM Server

2.2. Sonatype CLM Server End User License Agreement Window

2.3. Installed Product License on Sonatype CLM Server

2.4. Login

2.5. Create User

2.6. Edit User

2.7. Sample LDAP Server Configuration

2.8. User Mapping

2.9. Group Mapping

2.10. Dynamic Group Options

2.11. Testing LDAP Server

2.12. Checking User Mapping

2.13. Checking User Login

2.14. Mapping Users to roles

2.15. Mapping Groups When Not Included With Search

3.1. Using New Organization button

3.2. Using Global Create Button

3.3. Using New Application button

3.4. Using Global Create Button

3.5. Editing a Policy and its Attributes

3.6. Using New Policy Button

3.7. Using Global Create Button

3.8. Naming the Policy

3.9. Editing the Policy Threat Level

3.10. Example Constraint

3.11. Adding Constraints

3.12. Policy Actions Example

3.13. Policy Notifications Example

3.14. Using New Label Button

3.15. Using Global Create Button

3.16. Label Example

3.17. Creating a Label Condition

3.18. Using New License Threat Group Button

3.19. Using Global Create Button

3.20. Creating a License Threat Group

3.21. Creating a Condition Evaluating a License Threat Group

3.22. Creating a Condition Evaluating an unassigned License Threat Group

3.23. Example of Applied Tags

3.24. Using New Tag Button

3.25. Using Global Create Button

3.26. Creating a Tag

3.27. Example of Tags with Description

3.28. Evaluate an Application

3.29. Violations Report after Scan

3.30. Reporting Area

3.31. Application Area

3.32. Summary Tab of an Application Composition Report

3.33. Policy Tab of an Application Composition Report

3.34. Security Issues Tab of an Application Composition Report

3.35. License Analysis Tab of an Application Composition Report

3.36. Component Information Panel CIP for a Specific Component

3.37. Policy Section for a Specific Component Displayed on the Component Information Panel

3.38. Organization View with Import Button

3.39. Import Policy Dialog

3.40. Example of a Policy Monitoring Email

3.41. Access Application Management Area

3.42. Selecting a Sonatype CLM Stage to Monitor

3.43. Adding Email Recipient

3.44. Policy Monitoring Notification Example

3.45. Sample Email Notification

4.1. Summary Tab of the Application Composition Report

4.2. Reporting Area

4.3. Application Area

4.4. The Four Tabs

4.5. Security Issues Summary

4.6. License Analysis Summary

4.7. Policy Tab

4.8. Security Issues Tab

4.9. License Analysis Tab

4.10. Application Composition Report Buttons For Printing and Reevaluation

4.11. Component Information Panel CIP Example

4.12. CIP, Policy Section

4.13. CIP, Similar Section

4.14. CIP, Occurrences Section

4.15. CIP, Licenses Section

4.16. CIP, Edit Vulnerabilities Section

4.17. CIP, Labels Section

4.18. CIP, Claim Component

4.19. CIP, Audit

4.20. Security Issues Tab

4.21. Component Information Panel (CIP)

4.22. Security Information Modal

4.23. Editing Vulnerabilities

4.24. Example of Component with Security Issue, but No Policy Violation

4.25. License Analysis Tab

4.26. The Default License Threat Groups

4.27. Component Information Panel (CIP)

4.28. Editing License Using the Select Option

4.29. Unknown Component

4.30. Filter and Matching Options

4.31. Proprietary Component

4.32. Proprietary Packages Configuration via the Sonatype CLM Server

4.33. Claim a Component

4.34. Claimed Component Indicator

4.35. Update or Revoke Claimed Component Indicator

4.36. Labels at the CLM Server Level

4.37. Assigning a Label

4.38. Waiver Visualization on Policy Tab

4.39. Waiver Button

4.40. Options to Apply Waiver to the Application or the Entire Organization

4.41. View and Remove Waivers

4.42. Application Composition Report Buttons For Printing and Reevaluation

4.43. Summary Section of a Application Composition Report in PDF Format

4.44. Policy Violations Section of a Application Composition Report in PDF Format

4.45. Security Issues Section of a Application Composition Report in PDF Format

4.46. License Analysis Section of a Application Composition Report in PDF Format

4.47. Components Section of a Application Composition Report in PDF Format

5.1. Dashboard Default View

5.2. Accessing the Dashboard

5.3. Dashboard Filter Example

5.4. Filtering the Dashboard

5.5. Dashboard Visuals

5.6. Counts

5.7. Matches

5.8. Policy Violation Summary

5.9. Newest Risk

5.10. Highest Risk - By Component

5.11. Highest Risk - By Application

5.12. Component Detail Page

6.1. Jenkins Global Configuration Menu

6.2. Global Configuration of Sonatype CLM for CI in Jenkins

6.3. Sonatype CLM Build Scan Configuration for a Build Step

6.4. Post-build Action Configuration as Example for a Sonatype CLM for CI Configuration

6.5. Job Overview Page with Links to the Application Composition Report and Application Management

6.6. Left Menu with Link to the Application Composition Report

7.1. Eclipse Dialog to Install New Software with Sonatype CLM for Eclipse

7.2. Activating the Component Info View of Sonatype CLM for Eclipse

7.3. Warning after initial installation

7.4. Sonatype CLM for Eclipse Configuration Dialog

7.5. Example Component Info View

7.6. Details for a Component in the Component Info View

7.7. Properties of a Component for a Version Range

7.8. Filter Dialog for the Component Info View

7.9. Example Component Details Display

7.10. Migrating to a Newer Component Version

7.11. Applying a Dependency Version Upgrade

7.12. Selecting Dependency Version or Property Upgrade

7.13. Applying a Property Upgrade

8.1. The Central Role of A Repository Manager in Your Infrastructure

8.2. CLM configuration tab in Nexus

8.3. CLM configuration tab after Test Connection

8.4. Typical Search Results in Nexus Pro

8.5. Nexus Search Showing All Versions

8.6. Accessing the Component Info Tab

8.7. Component Information Panel

8.8. Component Information Panel Example

8.9. CIP Text

8.10. CIP Graph

8.11. View Details Button

8.12. View Details

8.13. Staging Profile with a CLM Application Configured

8.14. Staging and Release Configuration for a Policy in the CLM Server

8.15. Staging Repository Activity with a CLM Evaluation Failure and Details

9.1. SonarQube Overview

9.2. SonarQube Plugin Directory

9.3. SonarQube Settings Menu

9.4. SonarQube CLM Server Settings

9.5. SonarQube Sonatype CLM Configuration Menu

9.6. SonarQube Sonatype CLM Application Selection

9.7. SonarQube Configure Widgets Menu

9.8. SonarQube Search for CLM Widget

9.9. SonarQube Configure Sonatype CLM Widget options

9.10. SonarQube Sonatype CLM Widget Example

10.1. Application Overview and Application Identifier

10.2. Violations Report After an Evaluation

11.1. Creating a Maven Run Configuration for a CLM Evaluation in IntelliJ

11.2. Maven Projects View with the CLM Evalulation Run Configuration in IntelliJ

11.3. CLM for Maven Output in the Run Console in IntelliJ

11.4. Project View with the pom.xml in NetBeans

11.5. Maven Goal Setup for a CLM Evaluation in NetBeans

11.6. CLM for Maven Output in the Output Window in NetBeans