#Ivy configuration (SBT / Apache Ivy)

OSA Proxy supports Apache Ivy format repositories, which are commonly used in Scala projects and sbt build tools. The service scans downloaded artifacts and verifies them against security policies.

#Configuration in osa-proxy.yml

ivy:
  enabled: true
  repository:
    - name: ivy
      registry: https://scala.jfrog.io/artifactory/ivy-releases
      scan-package: true
      work-mode: strict_wait
      layout: sbt-default

#Repository parameters

#Path layouts

To scan packages (scan-package: true), OSA Proxy must extract component coordinates from the file path. Therefore, such a repository must explicitly select a pattern using layout. The following patterns are built into OSA Proxy and do not need to be added to the root layouts section:

• sbt-default — standard sbt directory structure with scalaVersion and sbtVersion support;
• ivy-default — standard Apache Ivy directory structure.

#Custom layouts

The root layouts section is needed only for a non-standard directory structure. Define a custom pattern there, then reference its name in ivy.repository[*].layout:

layouts:
  custom-sbt: "[organisation]/[module]/(scala_[scalaVersion]/)[revision]/[type]s/[artifact].[ext]"

ivy:
  enabled: true
  repository:
    - name: my-ivy
      registry: https://ivy.example.com
      layout: custom-sbt

The pattern must contain an organization token ([organisation], [org], or [orgPath]), a module token ([module]), and a revision token ([revision] or [baseRev]).

#Connecting sbt

To route dependency downloads through OSA Proxy, add a resolver in build.sbt:

resolvers += Resolver.url(
  "osa-proxy-ivy",
  url("https://osa-proxy.example.com/ivy/")
)(Resolver.ivyStylePatterns)

#Blocking behavior

When a client requests a file, OSA Proxy:

1. Matches the request path against the configured layout to extract the organization, module name, and version.
2. Evaluates the downloaded artifact in CodeScoring (when scan-package: true).
3. If the component violates security policies, OSA Proxy aborts the download and returns the configured HTTP status code (default 403).