CRACI vs Sonatype

The short answer

Sonatype is best at open-source governance: policies that decide which components are allowed, a firewall that stops bad packages at the repository, and analysis that tells you what ended up in your application. CRACI is a GitHub Actions-compatible CI runner that records every external dependency a build pulls in, and produces the SBOM, provenance and compliance evidence from that record. Sonatype is a scanner and a gatekeeper. CRACI is a recorder. Most teams that need both would run them side by side.

Which Sonatype product is which

Sonatype sells several products, and the names matter for this comparison:

• Sonatype Lifecycle is the software composition analysis (SCA) and policy product, running self-hosted or as SaaS.
• Sonatype Repository Firewall blocks and quarantines components that fail your policies before they enter your repositories. It is designed for Sonatype Nexus Repository. Sonatype Firewall Pro covers other repository managers, such as JFrog Artifactory, Cloudsmith and GitHub Packages, for npm, Maven, PyPI and NuGet.
• Sonatype SBOM Manager imports, monitors and shares SBOMs, with a VEX workflow.

Packaging is changing. Sonatype's pricing page says all Lifecycle capabilities are now included in Sonatype Guide, that new customers buy Guide for SCA and governance, and that Guide also includes the compliance capabilities of SBOM Manager.

At a glance

What Sonatype does well

Policy at scale. Lifecycle ships with 18 default policies and more than 30 customizable constraints covering security, legal and architecture rules. License policies span more than 2,000 open-source licenses. It prioritizes findings with reachability, breaking change and upgrade availability data, and it can open Golden Pull Requests with the suggested upgrades.

Looking at what the build produced. Lifecycle integrations default to Advanced Binary Fingerprinting, which examines everything included in the application after the build, including embedded dependencies, and can identify renamed or modified components. Only then does it fall back to lockfiles and manifests. Every scan report can be exported as a CycloneDX or SPDX SBOM.

Stopping bad packages at the door. Repository Firewall enforces your security, license and quality standards at the point of download and quarantines suspicious components. CRACI has no equivalent today: package blocklisting is on its roadmap.

Fitting any pipeline. Sonatype integrates with Jenkins, GitHub Actions, GitLab CI, Azure DevOps and Bamboo, plus Maven, Gradle and a CLI for other CI servers. CRACI supports GitHub Actions only.

Where CRACI is different

It records the build instead of analyzing its output

Binary fingerprinting tells you what is inside the finished application. It does not tell you what the build downloaded along the way: compilers and toolchains, install scripts, base images, release binaries fetched with curl, or packages restored from a cache. CRACI sees those because it is the runner. A package-aware proxy observes traffic to package sources while the job runs, covering npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so cached packages are still accounted for.

Every SBOM states its own completeness, per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. When the record has a gap, you know.

It controls where the build can go

Repository Firewall governs what comes through the repository. A CRACI egress policy governs what the build can reach at all. Policies are default deny or default allow, with 24 built-in software-source presets and typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git. They are validated before the job starts and fail closed. Together, the two let you make sure build jobs fetch packages only from the sources you approve, and that those sources only serve packages you allow.

It links the artifact to the build and keeps watching

Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it. CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

When to use both

• You already run Nexus Repository with Firewall. Keep it as the gate. Add CRACI so every build has a record of what it fetched, and an egress policy that keeps builds on your approved sources.
• Your legal team relies on Lifecycle license policies. Keep them. CRACI includes declared license metadata in its SBOM export but does not enforce license policy today.
• You collect SBOMs in SBOM Manager. SBOM Manager imports CycloneDX and SPDX, the same formats CRACI exports, so build-time SBOMs can sit next to the ones you already manage.
• Your pipelines are on Jenkins or Azure DevOps. Sonatype fits today. CRACI would need those pipelines on GitHub Actions first.

For the Cyber Resilience Act

Sonatype publishes a CRA user's guide and a CRA checklist, and positions SBOM Manager as its CRA product. Its guide highlights generating VEX files to report on known vulnerabilities in SBOMs, and Nexus Repository as an update site for distributing security updates.

CRACI covers the evidence side from the build: an SBOM for each release with its completeness stated, provenance, continuous vulnerability monitoring, and reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither tool makes a product compliant on its own. See CRA compliance and what the CRA is.

Adding CRACI alongside Sonatype

CRACI replaces the runner, not GitHub Actions. Change runs-on to craci in a workflow, and runs still appear in the GitHub UI. Your Sonatype steps stay in the workflow. Start with one release pipeline, compare CRACI's SBOM with your Lifecycle report, and look at what only one of them saw.