Sonatype Repository Firewall

The major use case for Sonatype Repository is for open-source libraries, third-party libraries, and scanning. It gives you the vulnerabilities and security vulnerabilities of these third-party libraries.

In terms of lifecycle management and integration with CI/CD pipelines, we assess the pipelines with Fortify integrated into part of the pipeline. When you run the pipeline, part of it is the scanning, and you get the vulnerabilities and the issues in this pipeline.

The biggest advantage of Sonatype is that you get an idea about the open source or third-party libraries vulnerabilities. You know if there are any fixes for them and if it is utilized in our environment. It gives you an idea of the security posture of your used libraries, third-party libraries, and open source components. It also shows you the vulnerabilities and what is being done. Recently, we acquired Sonatype Repository Firewall , which is very useful for security because you can block things and allow things.

The Health Check feature for repositories is for identifying vulnerabilities, basically. It normally marks something as vulnerable, but it also checks if it is accepted or not.

Health checks contribute to my identification procedure because if we have a vulnerability, some vulnerabilities are in that library, but it does not necessarily mean that the whole library is vulnerable because of one function that might not be in our code. So I check if that is really a vulnerability or not.

The ability of Sonatype to manage NPM , Docker , and Maven helps us with development environments because if someone needs one of these frameworks, we can connect with third-party libraries and have them stored here. We also know the health of it and sometimes receive live checks and feedback.

Hosting, proxying, and grouping repositories have a major benefit by being centralized for our organization. You know what you have and what you do not, and maintain a secure environment, knowing its security posture.

For Sonatype, there is a feature for waiving a vulnerable component that cannot be fixed due to limitations. However, I wish Sonatype would improve notifications regarding waivers, so the security team knows to look into it instead of relying on user emails or checking ourselves.

I think the price for the product is on the high side, as some components are very expensive, such as Sonatype Repository Firewall . It is not a cheap product, but security can come at a cost.

Time definitely is saved because security is a requirement, and it provides great value, although everyone likes things to be cheaper. But at the end of the day, you pay for what you have to.

I started using this product before 2023, possibly in 2022 or 2019, but I do not have the exact dates because I was not involved in that process when they brought it in.

Sonatype Repository is reliable and stable.

My impression of customer support and technical service from Sonatype is positive.

I would give them a nine for support on a scale from zero to ten.

The installation process and deployment procedure for Sonatype is complex because the administration team handles that, and I know they stay after hours to do it, but I did not participate to know the details.

We are customers of Sonatype; we get the product, we use it, and we buy it.

I have not worked with any competitors yet, so I cannot compare Sonatype to anything right now, but I know they are one of the top ones in the market.

Sonatype is pretty much a leader and stands out in their field.

We have it on-premises; all is on-prem because sometimes the offerings of the cloud are not here in our country. The cloud area is still evolving, and we are not cloud-based yet.

Many companies, including ours, use Nexus Repository  due to concerns about malware and critical vulnerabilities. There should be a specific method to prevent malicious packages from entering the internal network, so our company uses Nexus Repository . We usually consider adding the firewall feature on top of the Repository, with the main purpose being to block malicious packages.

The firewall is the only solution that supports Nexus Repository. This firewall comes with an accurate database, which can identify most malicious code from entering. It relies on the Sonatype accurate database, so the accuracy is excellent. There is no other option except Sonatype deploy to the firewall.

There are several features lacking in the current offering, particularly concerning container support and AI packages, like humming phase support. However, I have heard that it is on the roadmap for 2025.

I have been using this solution for four years.

It is software, so there is always a possibility of bugs, however, they are quite fast in fixing these bugs. It is quite stable.

There is an option to scale the capacity using an external database, and then you also have support. I do not think there is any issue with scalability.

The customer service is fantastic. They provide the required responses and relevant support, which is the biggest advantage of using Sonatype.

I do not have handling experience with another firewall. Sonatype Firewall is the only one I have been using. There is only one other alternative.

The initial setup is quite straightforward and easy. It is not complicated.

Just a couple of staff members can complete the installation and configuration.

Also, I consider it average. Some people might consider it expensive, however, since it supports many beautiful features, I would say it is worth it.

We looked at Sonatype or Gather. There are not that many options.

I would give the solution eight out of ten. I would look at the comparison of Sonatype to some other firewalls. There is room for improvement, especially mentioning container support and AI packages.