> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure the Package Firewall with Sonatype Nexus Repository
> Route package installation requests through the Package Firewall by configuring Sonatype Nexus Repository proxy repositories.
export const LicenseBadge = ({sku, skus, relation = 'any'}) => {
const DATA_URL = '/snippets/license-sku-data.json';
const CACHE_KEY = 'license-sku-data';
const CACHE_TTL_MS = 60 * 60 * 1000;
const REGISTRY_KEY = '__licenseSkuRegistry';
const FALLBACK_LICENSES_URL = '/introduction/licenses';
const ACCENT = '#26D07C';
const CONJUNCTION = {
any: 'or',
all: 'and'
};
const FONT_STACK = '-apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif';
const [isDark, setIsDark] = useState(false);
const [data, setData] = useState(null);
const [hasFetchError, setHasFetchError] = useState(false);
const skuList = useMemo(() => {
if (Array.isArray(skus) && skus.length > 0) {
return skus.filter(code => typeof code === 'string' && code.trim()).map(c => c.trim());
}
if (typeof sku === 'string' && sku.trim()) {
return [sku.trim()];
}
return [];
}, [sku, skus]);
useEffect(() => {
const check = () => {
const root = document.documentElement;
setIsDark(root.dataset.theme === 'dark' || root.classList.contains('dark'));
};
check();
const observer = new MutationObserver(check);
observer.observe(document.documentElement, {
attributes: true,
attributeFilter: ['data-theme', 'class']
});
return () => observer.disconnect();
}, []);
useEffect(() => {
let cancelled = false;
const readCache = () => {
try {
const raw = sessionStorage.getItem(CACHE_KEY);
if (!raw) return null;
const parsed = JSON.parse(raw);
if (Date.now() - parsed.ts > CACHE_TTL_MS) {
sessionStorage.removeItem(CACHE_KEY);
return null;
}
return parsed.data;
} catch (e) {
return null;
}
};
const writeCache = value => {
try {
sessionStorage.setItem(CACHE_KEY, JSON.stringify({
ts: Date.now(),
data: value
}));
} catch (e) {}
};
const fetchSkuData = async () => {
const cached = readCache();
if (cached) return cached;
if (!globalThis[REGISTRY_KEY]) {
globalThis[REGISTRY_KEY] = {};
}
const registry = globalThis[REGISTRY_KEY];
if (registry[CACHE_KEY]) return registry[CACHE_KEY];
const promise = (async () => {
const resp = await fetch(DATA_URL);
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
const json = await resp.json();
writeCache(json);
return json;
})();
registry[CACHE_KEY] = promise;
promise.finally(() => {
delete registry[CACHE_KEY];
});
return promise;
};
fetchSkuData().then(d => {
if (!cancelled) setData(d);
}).catch(() => {
if (!cancelled) setHasFetchError(true);
});
return () => {
cancelled = true;
};
}, []);
const textColor = isDark ? '#e6edf3' : '#1f2937';
const textMuted = isDark ? 'rgba(230,237,243,0.65)' : 'rgba(31,41,55,0.65)';
const bannerBackground = isDark ? '#161b22' : '#f6f8fa';
const borderColor = isDark ? 'rgba(38,208,124,0.35)' : 'rgba(38,208,124,0.45)';
const linkColor = isDark ? '#4ade80' : '#047857';
const errorBackground = isDark ? '#3b1111' : '#fef2f2';
const errorBorder = isDark ? '#7f1d1d' : '#fecaca';
const errorText = isDark ? '#fecaca' : '#7f1d1d';
const licensesUrl = data?.licensesPageUrl || FALLBACK_LICENSES_URL;
const resolveSkuName = code => {
const entry = data?.skus?.[code];
if (entry?.name) return entry.name;
return null;
};
const formatSkuLabel = code => {
const name = resolveSkuName(code);
if (name) return name;
return code;
};
const joinWithConjunction = (codes, conjunction) => {
const labels = codes.map(formatSkuLabel);
if (labels.length === 0) return '';
if (labels.length === 1) return labels[0];
if (labels.length === 2) return `${labels[0]} ${conjunction} ${labels[1]}`;
const head = labels.slice(0, -1).join(', ');
const tail = labels[labels.length - 1];
return `${head}, ${conjunction} ${tail}`;
};
const buildSkuSentence = codes => {
const conj = CONJUNCTION[relation] || CONJUNCTION.any;
const names = joinWithConjunction(codes, conj);
const noun = codes.length > 1 ? 'licenses' : 'license';
return `${names} ${noun}`;
};
const renderLink = text =>
{text} →
;
const renderBanner = codes =>
Requires
{buildSkuSentence(codes)}
{renderLink('Licenses')}
;
const renderLoading = () =>
Loading license info…
;
const renderInputError = message =>
{message}
;
if (typeof sku === 'string' && Array.isArray(skus)) {
return renderInputError('LicenseBadge: pass either `sku` or `skus`, not both.');
}
if (skuList.length === 0) {
return renderInputError('LicenseBadge: `sku` or `skus` is required.');
}
if (hasFetchError) return renderBanner(skuList);
if (!data) return renderLoading();
return renderBanner(skuList);
};
export const authTarget_0 = "Sonatype Nexus Repository"
Configure Sonatype Nexus Repository to use the Package Firewall URL as the remote storage for a proxy repository instead of the public package registries. Every package installation request flows through Endor Labs, so the Package Firewall can block known malicious packages before they reach your environment.
The Package Firewall evaluates each package request based on the malware check and the configured [Package Firewall policy](/package-firewall/policy) conditions, and handles each request in one of the following methods:
* Block the installation if the package is found in the Endor Labs malware database, or if a policy condition matches with **Block**. Nexus Repository returns `HTTP 404` response. The Package Firewall records a log with the package, version, and reason.
* Allow the installation if a policy condition matches with **Warn**. The Package Firewall records a warning log with the package, version, and reason.
* Allow the installation if the package passes all checks. No log is recorded.
A Package Firewall policy change doesn't take effect immediately for packages Nexus Repository has already cached. Nexus Repository serves cached content without contacting the Package Firewall, so a cached package keeps its earlier outcome until the entry expires or you invalidate it. A package cached before Endor Labs flagged it as malware continues to install, and a package blocked before you added an exception remains blocked. Configure a shorter cache lifetime in your repository settings to make policy changes take effect sooner and send more requests to the Package Firewall. For more information, refer to [Configurable repository fields](https://help.sonatype.com/en/configurable-repository-fields.html).
Nexus Repository returns a generic `HTTP 404` response when it blocks a request without surfacing the specific reason. To see why a package was blocked, review the [Package Firewall logs](/package-firewall/logs).
**Sonatype Nexus Repository requirement**
You must have a Sonatype Nexus Repository instance with permission to create proxy repositories and configure credentials.
## Configure the Package Firewall
Complete the following steps to integrate Sonatype Nexus Repository with the Endor Labs Package Firewall:
1. [Create an API key for the Package Firewall](#create-an-api-key-for-the-package-firewall).
2. [Configure Sonatype Nexus Repository](#configure-sonatype-nexus-repository).
3. [Set up local package managers](#set-up-local-package-managers).
4. [Verify your setup](#verify-your-setup).
### Create an API key for the Package Firewall
Create an API key dedicated to the Package Firewall so that {authTarget_0} can authenticate to it. You can create it through one of the following methods:
* Using the Endor Labs user interface, with the **Package Firewall User** role. See [API keys](/platform-administration/api-keys#create-an-api-key-through-the-endor-labs-user-interface) to learn more.
* Using endorctl, with the `SYSTEM_ROLE_PACKAGE_FIREWALL` role. Make sure to [install and configure endorctl](/developers-api/cli/install-and-configure) before you create the key.
To create the key using endorctl, run the following command and replace:
* `` with your namespace.
* `` with the name of the API key for the Package Firewall use case.
* `` with the API key expiration in ISO 8601 UTC format, for example `2026-12-31T23:59:59Z`.
```bash theme={null}
export NAMESPACE=""
export KEY_NAME=""
endorctl api create -r APIKey -n "$NAMESPACE" --data '{
"meta": { "name": "'"$KEY_NAME"'" },
"spec": {
"permissions": { "roles": ["SYSTEM_ROLE_PACKAGE_FIREWALL"] },
"expiration_time": ""
},
"propagate": true
}'
```
From the response, save the following values in a secure location. Use them as your Package Firewall credentials when you configure the Nexus Repository proxy repository.
* **API key:** `spec.key`
* **API secret:** `spec.secret`
### Configure Sonatype Nexus Repository
Configure a proxy repository in Nexus Repository for each package type you want to route through the Package Firewall. A proxy repository fetches artifacts from an upstream source, so you set the Package Firewall URL as the remote storage.
The remaining repository settings, such as blob store and cleanup policies, are specific to Nexus Repository. Configure them based on your requirements.
1. Sign in to Sonatype Nexus Repository.
2. Select **Settings** > **Repository** > **Repositories**.
3. Click **Create repository**.
4. Select **npm (proxy)** as the recipe.
5. Enter the repository name, such as `endor-firewall-npm`.
6. In **Remote Storage**, enter `https://factory.endorlabs.com/v1/namespaces//firewall/npm/`. Replace `` with your Endor Labs namespace.
7. Select **Authentication** under **HTTP Authentication**.
8. In **Authentication type**, choose **Username**.
9. Enter the API key as the **Username** and the API secret as the **Password**.
10. Click **Create repository**.
1. Sign in to Sonatype Nexus Repository.
2. Select **Settings** > **Repository** > **Repositories**.
3. Click **Create repository**.
4. Select **pypi (proxy)** as the recipe.
5. Enter the repository name, such as `endor-firewall-pypi`.
6. In **Remote Storage**, enter `https://factory.endorlabs.com/v1/namespaces//firewall/pypi/`. Replace `` with your Endor Labs namespace.
7. Select **Authentication** under **HTTP Authentication**.
8. In **Authentication type**, choose **Username**.
9. Enter the API key as the **Username** and the API secret as the **Password**.
10. Click **Create repository**.
1. Sign in to Sonatype Nexus Repository.
2. Select **Settings** > **Repository** > **Repositories**.
3. Click **Create repository**.
4. Select **go (proxy)** as the recipe.
5. Enter the repository name, such as `endor-firewall-go`.
6. In **Remote Storage**, enter `https://factory.endorlabs.com/v1/namespaces//firewall/go/`. Replace `` with your Endor Labs namespace.
7. Select **Authentication** under **HTTP Authentication**.
8. In **Authentication type**, choose **Username**.
9. Enter the API key as the **Username** and the API secret as the **Password**.
10. Click **Create repository**.
To give clients a single endpoint that resolves across multiple Go proxy repositories, create a **go (group)** repository and add `endor-firewall-go` as a member. For more information, refer to [Repository types](https://help.sonatype.com/en/repository-types.html).
1. Sign in to Sonatype Nexus Repository.
2. Select **Settings** > **Repository** > **Repositories**.
3. Click **Create repository**.
4. Select **maven2 (proxy)** as the recipe.
5. Enter the repository name, such as `endor-firewall-maven`.
6. In **Remote Storage**, enter `https://factory.endorlabs.com/v1/namespaces//firewall/maven/`. Replace `` with your Endor Labs namespace.
7. Select **Authentication** under **HTTP Authentication**.
8. In **Authentication type**, choose **Username**.
9. Enter the API key as the **Username** and the API secret as the **Password**.
10. Click **Create repository**.
If you have a Maven group repository that combines several repositories, make sure no other member proxies Maven Central directly. Nexus Repository returns the first member that has the component, so a member with its own path to the public registry serves packages the Package Firewall blocked.
### Set up local package managers
Update your package manager to use the Nexus Repository proxy repository as its source, routing all package installations through the Package Firewall instead of the public registry. Nexus Repository serves each repository at `https:///repository//`. Replace `` with your Nexus Repository host, and the port if your instance uses one, such as `nexus.example.com:8081`. Replace `` with the repository you created.
Each example includes the credentials to add when your proxy repository requires authentication. Omit them if your proxy repository allows anonymous read access. Replace `` and `` with your Nexus Repository credentials, not the Endor Labs API key and secret stored on the proxy repository.
Run the following command to point npm at the proxy repository.
```bash theme={null}
npm config set registry https:///repository/endor-firewall-npm/
```
If your proxy repository requires authentication, encode your credentials as a Base64 string.
```bash theme={null}
echo -n ":" | base64
```
Add the following lines to your `.npmrc` file at the project level, or in the user-level file at `~/.npmrc`. Replace `` with the string you generated.
```text theme={null}
///repository/endor-firewall-npm/:_auth=
always-auth=true
```
Run `npm config get registry` to confirm the registry matches the repository URL.
For more information, refer to [npm registry documentation](https://help.sonatype.com/en/npm-registry.html).
Add the following lines to your `pip.conf` file.
```text theme={null}
[global]
index-url = https:///repository/endor-firewall-pypi/simple
```
If your proxy repository requires authentication, include your credentials in the index URL.
```text theme={null}
[global]
index-url = https://:@/repository/endor-firewall-pypi/simple
```
Run `pip3 config list | grep index-url` to confirm the index URL matches the repository URL.
For more information, refer to [Configure PyPI with Nexus](https://help.sonatype.com/en/configure-pypi-with-nexus.html).
Run the following command to point the Go module proxy at the repository.
```bash theme={null}
go env -w GOPROXY=https:///repository/endor-firewall-go/
```
If your proxy repository requires authentication, Go reads your credentials from a `.netrc` file rather than from the proxy URL.
Run `go env GOPROXY` to confirm the proxy matches the repository URL.
For more information, refer to [Configure Go with Nexus](https://help.sonatype.com/en/configure-go-with-nexus.html).
Add a mirror to your `~/.m2/settings.xml` file that points at the proxy repository. If your proxy repository requires authentication, add a server with the same `` as the mirror.
```xml theme={null}
endor-firewall
Endor Package Firewall
central
https:///repository/endor-firewall-maven/
endor-firewall
```
Run `mvn dependency:resolve` to confirm Maven resolves through the mirror.
For more information, refer to [Maven repository documentation](https://help.sonatype.com/en/maven-repositories.html).
### Verify your setup
To verify your setup, install a package that Endor Labs has classified as malware. The Package Firewall should block the installation and return an `HTTP 404`.
The following are examples of packages classified as malware by Endor Labs.
Run the following command to test the Package Firewall with npm.
```bash theme={null}
npm install endor-firewall-test@1.0.0
```
When the Package Firewall blocks the package, the output looks similar to the following. The `E404` error code and `404 Not Found` response confirm that the firewall blocked the package.
```bash theme={null}
npm error code E404
npm error 404 Not Found - GET https://nexus.example.com/repository/endor-firewall-npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz - Package 'endor-firewall-test' not found
npm error 404
npm error 404 'endor-firewall-test@https://nexus.example.com/repository/endor-firewall-npm/endor-firewall-test/-/endor-firewall-test-1.0.0.tgz' is not in this registry.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.
```
Run the following command to test the Package Firewall with pip.
```bash theme={null}
pip3 install endor-firewall-test==1.0.0
```
When the Package Firewall blocks the package, the output looks similar to the following. The `404` response confirms that the firewall blocked the package.
```bash theme={null}
Looking in indexes: https://nexus.example.com/repository/endor-firewall-pypi/simple
Collecting endor-firewall-test==1.0.0
ERROR: HTTP error 404 while getting https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl#sha256=4df734939186708c595e72e50f5d31296d2ea9e54d5a0afc9e69d4e7d6f0d4b9 (from https://nexus.example.com/repository/endor-firewall-pypi/simple/endor-firewall-test/) (requires-python:>=3.7)
ERROR: Could not install requirement endor-firewall-test==1.0.0 from https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl#sha256=4df734939186708c595e72e50f5d31296d2ea9e54d5a0afc9e69d4e7d6f0d4b9 because of HTTP error 404 Client Error: Not Found for url: https://nexus.example.com/repository/endor-firewall-pypi/packages/endor-firewall-test/1.0.0/endor_firewall_test-1.0.0-py3-none-any.whl (from https://nexus.example.com/repository/endor-firewall-pypi/simple/endor-firewall-test/) (requires-python:>=3.7)
```
Run the following command to test the Package Firewall with Go.
```bash theme={null}
go install github.com/endorlabstest/endor-firewall-test@v1.0.0
```
When the Package Firewall blocks the package, the output looks similar to the following. The `404` response confirms that the firewall blocked the package.
```bash theme={null}
go: github.com/endorlabstest/endor-firewall-test@v1.0.0: reading https://nexus.example.com/repository/endor-firewall-go/github.com/endorlabstest/endor-firewall-test/@v/v1.0.0.info: 404
```
Add `io.github.endorlabs:endor-java-webapp-demo:4.1` as a dependency in your `pom.xml`, then run the following command to test the Package Firewall with Maven.
```bash theme={null}
mvn dependency:resolve
```
When the Package Firewall blocks the package, the output looks similar to the following. Nexus Repository doesn't serve the artifact, so resolution fails with a missing POM warning and a `Could not find artifact` error.
```bash theme={null}
[INFO] Scanning for projects...
[INFO]
[INFO] -----------------------< com.example:my-app >------------------------
[INFO] Building my-app 1.0.0
[INFO] from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
Downloading from endor-firewall: https://nexus.example.com/repository/endor-firewall-maven/io/github/endorlabs/endor-java-webapp-demo/4.1/endor-java-webapp-demo-4.1.pom
[WARNING] The POM for io.github.endorlabs:endor-java-webapp-demo:jar:4.1 is missing, no dependency information available
Downloading from endor-firewall: https://nexus.example.com/repository/endor-firewall-maven/io/github/endorlabs/endor-java-webapp-demo/4.1/endor-java-webapp-demo-4.1.jar
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 4.000 s
[INFO] Finished at: 2026-06-09T14:11:11Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project my-app: Could not resolve dependencies for project com.example:my-app:jar:1.0.0
[ERROR] dependency: io.github.endorlabs:endor-java-webapp-demo:jar:4.1 (compile)
[ERROR] Could not find artifact io.github.endorlabs:endor-java-webapp-demo:jar:4.1 in endor-firewall (https://nexus.example.com/repository/endor-firewall-maven)
[ERROR]
```
After you confirm that the Package Firewall blocks malware, you can view the recorded events. See [View Package Firewall logs](/package-firewall/logs) to learn more.
## Troubleshooting and FAQ
If Endor Labs flags a package as malware after Nexus Repository cached it, Nexus Repository continues to serve it until the cache expires. Reduce the component and metadata maximum age on the proxy repository to shorten that window.
Nexus Repository caches negative responses in its not found cache. After the Package Firewall starts allowing a package, Nexus Repository can keep returning `HTTP 404` until that entry expires. Invalidate the cache on the proxy repository to pick up the change immediately.
* Verify that the Package Firewall URL in the proxy repository remote storage is correct.
* Ensure network connectivity from Nexus Repository to the Package Firewall.
* Ensure your network firewall rules allow outbound connections from Nexus Repository.
* Verify the API key and secret are correct and that the key has the **Package Firewall User** role.
* Confirm that **Authentication** is selected on the proxy repository and that the credentials are saved.
* Check the Nexus Repository logs for authentication errors.