• English

    • Integrating OSS Index

    In addition to the internal CodeScoring Index database, you can also connect a third-party feed Sonatype OSS Index for advanced analysis.

    Integration is configured in Settings -> OSS Index. Authenticated requests require Email and the API Token obtained when registering with Sonatype OSS Index.

    Using OSS Index requires enabling Active for SCA and saving the settings. When saving an active integration, the system checks OSS Index availability.

    OSS Index

    Request and cache settings

    FieldDescriptionDefault
    Cache timeout (seconds)Base retention period for OSS Index results in the cache.3600
    Cache timeout jitter max (seconds)Upper bound of a random addition to the cache lifetime, from 0 to the specified value.1800
    Connect timeout (seconds)Time to wait for a connection to OSS Index.60
    Read timeout (seconds)Time to wait for response data.60
    Write timeout (seconds)Time to wait when sending request data.60
    Pool timeout (seconds)Time to wait for a connection from the HTTP client pool.60
    Max parallelismMaximum number of concurrent requests to OSS Index within one analysis.4

    All numeric parameters accept positive integers. The maximum cache timeout jitter also accepts 0, which disables the random addition. With default values, results are cached for 3600 to 5400 seconds.

    Saved changes apply to subsequent operations. An analysis already in progress may continue using previous values.

    Data quality disclaimer

    The OSS Index integration uses a third-party Sonatype OSS Index feed. Data from this source may include false positives and inaccuracies, so it is recommended to use it as an additional source and separately validate results before making blocking decisions.

    Important:

    1. OSS Index is used only during SCA startup.
    2. OSS Index will refer to a third-party URL: https://ossindex.sonatype.org/.
    3. SCA speed may decrease when using OSS Index.
    4. When using OSS Index without a token, the system may return data different from authorized requests.
    Was this page helpful?