diff --git a/docs/faq.rst b/docs/faq.rst index 615bc63c1b..f5b82f242a 100644 --- a/docs/faq.rst +++ b/docs/faq.rst @@ -117,6 +117,13 @@ ScanCode.io supports **multiple input types** for your projects: - **Git Repository**: Clone a Git repository using its HTTPS URL. See :ref:`inputs_git_repository`. +- **JFrog Artifactory**: Fetch artifacts from on-premise or cloud Artifactory + repositories. + See :ref:`inputs_artifactory`. + +- **Sonatype Nexus**: Fetch artifacts from Nexus Repository Manager instances. + See :ref:`inputs_nexus`. + For complete details on all input methods, refer to the :ref:`inputs` documentation. What is the difference between scan_codebase and scan_single_package pipelines? diff --git a/docs/inputs.rst b/docs/inputs.rst index 2e78fd4a4b..d87acd2203 100644 --- a/docs/inputs.rst +++ b/docs/inputs.rst @@ -220,3 +220,76 @@ for details on: - :ref:`HTTP request headers ` (e.g., for GitHub tokens) - :ref:`.netrc file ` - :ref:`Docker private registries ` + +.. _inputs_artifactory: + +JFrog Artifactory +----------------- + +ScanCode.io can fetch artifacts from **JFrog Artifactory** repositories using +standard download URLs. + +The URL format follows Artifactory's REST API pattern:: + + https:///artifactory// + +Example:: + + https://mycompany.jfrog.io/artifactory/libs-release/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar + +For **authentication**, configure credentials in your ``.env`` file using one of +these methods: + +Using Basic Authentication:: + + SCANCODEIO_FETCH_BASIC_AUTH="mycompany.jfrog.io=username,password" + +Using API Key (via headers):: + + SCANCODEIO_FETCH_HEADERS="mycompany.jfrog.io=X-JFrog-Art-Api=" + +Using Access Token:: + + SCANCODEIO_FETCH_HEADERS="mycompany.jfrog.io=Authorization=Bearer " + +.. tip:: + You can also use a :ref:`.netrc file ` for + authentication if your organization already maintains one. + +.. _inputs_nexus: + +Sonatype Nexus +-------------- + +ScanCode.io can fetch artifacts from **Sonatype Nexus Repository** (versions 2 and 3) +using standard download URLs. + +For **Nexus 3**, the URL format follows the repository path pattern:: + + https:///repository// + +Example for a Maven artifact:: + + https://nexus.mycompany.com/repository/maven-central/ch/qos/logback/logback-core/1.4.0/logback-core-1.4.0.jar + +Example for a PyPI package:: + + https://nexus.mycompany.com/repository/pypi-proxy/packages/urllib3/1.26.7/urllib3-1.26.7-py2.py3-none-any.whl + +Example for an npm package:: + + https://nexus.mycompany.com/repository/npm-proxy/redis/-/redis-2.8.0.tgz + +For **authentication**, configure credentials in your ``.env`` file: + +Using Basic Authentication:: + + SCANCODEIO_FETCH_BASIC_AUTH="nexus.mycompany.com=username,password" + +Using a Bearer Token:: + + SCANCODEIO_FETCH_HEADERS="nexus.mycompany.com=Authorization=Bearer " + +.. tip:: + You can also use a :ref:`.netrc file ` for + authentication if your organization already maintains one.