IQ Waiver Comment Format Webhook

[amybannatyne]

What is your Project Idea?

Hi,

Essentially I wish to ensure that our nexusIQ waiver comments are written in a specific way; they contain specific information written in simple key/value pairs, and to ensure that this is adhered to at the point of waiver creation, rather than by review later on.

So I'm looking for a little information to get started in terms of general feasibility of the idea, and information regarding how webhooks in NexusIQ are architected, in relation to building a possible hook for nexusIQ which we can use to enforce a specific format for waiver comments. If there are any examples of similar work being done by the community that would be extremely helpful.

Thanks

FYI @sonatype-nexus-community/community-leaders

[madpah]

Hi @amybannatyne - thanks for taking the time to share your idea! 🙇

Have you seen the official Production Documentation on Webhooks for Sonatype Lifecycle and specifically this page?

What you are looking to achieve seems like it will be possible, but might need to be part of a broader approach for it to make wholistic sense.

It would be great to understand more about how Waivers are created or requested today in your organization - do Developers just request these directly in Sonatype Lifecycle, or do you use a ticket management system?

Of course, as a Sonatype Customer, it would be great to link you up with your Customer Success Team to ensure they can also support you in this arena. If you're not sure who that is, feel free to let me know your Organization Name and we can have the appropriate folk reach out directly.

[amybannatyne]

Hi @madpah

Thanks for getting back to me on this. I'm at Vocalink Mastercard - I'm afraid I'm not precisely sure who our customer success rep is as that relationship is managed from a toolset services team whereas I'm in engineering.

I've perused that webhooks documentation and the impression I got was that it would be reasonably straightforward to consume the various webhooks as they are generated, and using that to take an action in some onward system seems a fairly standard scenario, but I wasn't clear on what mechanism, if any, could be used to return an action to NexusIQ such that the waiver could be rejected or accepted at the UI, for the user to then adjust as necessary - even if it's just a bit of generic text appearing above the waiver comment area stating the waiver could not be applied due to not adhering to format rules. I think that's the key piece I'm missing but, as I say, I don't currently understand how the inner workings of nexusIQ hang together and what may or may not be possible.

At the moment, what we do is allow engineers to raise waivers directly in NexusIQ, and then they need to go and raise a ticket on a jira board for a security arch team, which requires them to provide evidence and justification/rationale for the waiver on the ticket, and that prompts the security team to review the waiver and ultimately approve or rescind it. As we've got no means of automatically enforcing that relationship it does rely on a degree of manual review and checking, and ideally I'd like to construct a way to reduce that as far as is possible, this being one such idea. One of the fields I'd want to enforce in the waiver comments is the ID of that ticket.
I'd be delighted to discuss further with a customer success bod if at all possible.

[madpah]

Thanks for sharing your company @amybannatyne - I'll communicate internally and get your assigned Customer Success Engineer to reach out.

From what you describe, you'd need to:

1. Listen for WebHook with Event Type Waiver Request (see here)
2. Use the Policy REST API to Create/Update/Delete Waivers - see here

Your CSE will be able to support the discussion further, but the Sonatype Open Source Community remains here as a vehicle to help if that makes sense.

Some other Community Projects that exist that are somewhat related and might either help, or be somewhere for this functionality to go:

• Sonatype Webhook Handler

Thanks again for engaging. It would be great to get a followup once you've spoken with your CSE so we can either close out this discussion or continue it!

🙏

[madpah]

@amybannatyne - your assigned Customer Success Engineer has reached out directly 😄

[amybannatyne]

@madpah thanks paul, he's made contact, will discuss with him and hopefully feed back anything of interest 👍