Integration with CodeScoring.OSA

CodeScoring.Save can be used with OSA Proxy in two setups: OSA Proxy in front of Save, or between Save and an external registry. In both setups, OSA Proxy checks requests passing through it using CodeScoring.OSA and blocks unsafe components depending on the selected work-mode.

OSA Proxy in Front of Save

Package managers send requests to OSA Proxy, with Save acting as its upstream repository:

Package manager -> OSA Proxy -> CodeScoring.Save proxy repository -> external upstream

Set the registry field of the OSA Proxy repository to the Save repository URL. Configure clients to use the OSA Proxy URL. Checks also apply when downloading packages already cached in Save.

OSA Proxy Configuration Example

Configuration is performed in OSA Proxy. For each supported format, the corresponding section is enabled and the list of repositories is specified:

maven:
  enabled: true
  repository:
    - name: save-maven
      scan-manifest: true
      scan-package: true
      work-mode: strict_wait
      registry: https://save.example.com/cs-save/maven/<project>/maven-central-proxy

npm:
  enabled: true
  repository:
    - name: save-npm
      scan-manifest: true
      scan-package: true
      remove-blocked-versions: true
      work-mode: strict_wait
      registry: https://save.example.com/cs-save/npm/<project>/npmjs-proxy

codescoring:
  url: https://codescoring.example.com
  token: "<API_TOKEN>"
  work-mode: strict_wait
  osa-proxy-url: https://osa-proxy.example.com
  block-on-codescoring-errors: true
  block-status-code: 403

For PyPI, packages-registry is specified additionally; for Go, sumdb-registry; for Docker, auth-token-url if the upstream registry requires a separate token service.

OSA Proxy Between Save and an External Registry

Package managers send requests to Save, and the Save proxy repository retrieves components through OSA Proxy:

Package manager -> CodeScoring.Save proxy repository -> OSA Proxy -> external upstream

In OSA Proxy, set registry to the external registry, for example:

maven:
  enabled: true
  repository:
    - name: maven-central
      registry: https://repo1.maven.org/maven2
      scan-manifest: true
      scan-package: true
      work-mode: strict_wait

In Save, create or edit a Maven proxy repository and set Proxy URL to https://osa-proxy.example.com/maven-central/. Package managers connect to this Save repository using its regular URL: https://save.example.com/cs-save/maven/<project>/<repository>/.

The OSA Proxy connection settings in the codescoring section are the same for both setups.

Save Cache

In this setup, OSA Proxy checks requests that Save sends upstream. Packages served from Save's own cache without an upstream request do not pass through OSA Proxy again.

Operation Modes

Check behavior is controlled by the work-mode parameter. It can be set globally in the codescoring section or overridden for a specific repository.

Supported modes:

warmup — loads data into the CodeScoring cache without blocking components;
spectator — loads data into the CodeScoring cache without blocking components and saves component request results in the platform;
moderate — blocks components that fail policy checks; unscanned components can still be downloaded;
strict — blocks components that fail policy checks; unscanned components cannot be downloaded;
strict_wait — blocks components that fail policy checks; unscanned components are checked with waiting.

Limitations

Checks through OSA Proxy apply to traffic that passes through OSA Proxy. To check downloads from a hosted Save repository, place OSA Proxy in front of it and set registry to the hosted repository URL. Publishing artifacts to Save does not itself trigger an OSA Proxy check.

Security policies are configured in CodeScoring. OSA Proxy uses the CodeScoring API to scan components, retrieve package information, and check policies, but does not create policies inside Save.

#Integration with CodeScoring.OSA

#OSA Proxy in Front of Save

#OSA Proxy Configuration Example

#OSA Proxy Between Save and an External Registry

#Operation Modes

#Limitations

#See Also