Scanning and auditing
relic security scan and audit catalog packages locally with
Syft and scan them on the server. Both exit
with status 1 when a violated rule fails builds.
Files, directories and images
Scan a file:
relic security scan target/app.jar
Scan a local Docker image and an image in a registry:
relic security scan docker:team/app:1.4.0 registry:relic.example.com/docker/team/app:1.4.0
Scan a directory under the watch prod:
relic security scan dist/ --watch prod
Scan an SBOM (CycloneDX, SPDX or Syft JSON). It fails at once with unavailable
when no worker runs Relic Scan:
relic security scan --sbom bom.cdx.json -o json
A project's dependencies
Audit the current directory's lock files and manifests:
relic security audit
Audit a directory under the watch backend:
relic security audit services/api --watch backend
What Relic would block
List the dependencies Relic would block through npm-remote; exit 1 if any:
relic security audit --curation --repository npm-remote
Build runs
See relic build scan in Builds and images.
Policy previews
List the stored files that policies would flag, without applying them (administrators):
relic security policy preview -f policies.yaml
See Policies as code.
Decisions
List blocked downloads; --kind build or release lists the others (viewers):
relic security decisions --kind download
Quarantine
List the files quarantined remote repositories hold (viewers):
relic security quarantine list
Serve a held file (administrators):
relic security quarantine release maven-remote/org/acme/lib/1.0/lib-1.0.jar --reason "reviewed"
Never serve a held file (administrators):
relic security quarantine reject maven-remote/org/acme/lib/1.0/lib-1.0.jar --reason "malicious"
See Quarantine.
Waivers
Ask administrators for an ignore rule:
relic security waiver request --package pkg:npm/lodash@4.17.15 --vulnerability CVE-2020-8203 --reason "the vulnerable function is not reachable"
List pending waivers (everyone's for viewers):
relic security waiver list --status pending
Approve a waiver as a 30-day ignore rule (administrators):
relic security waiver approve 0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e --days 30
Reject a waiver (administrators):
relic security waiver reject 0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e --note "upgrade instead"
Withdraw one of your pending waivers:
relic security waiver withdraw 0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e
See Waivers.