Black Duck is a software composition analysis (SCA) scanning solution that helps organizations manage risks associated with open-source software in terms of security, license compliance, and code quality.
Add a Black Duck scan to your workflows in CloudBees Unify to:
-
Detect open-source and third-party dependencies in software, source code, and artifacts with multiple analysis techniques.
-
Identify code vulnerabilities and receive timely security advisories.
-
Gain insight into security risks and how to fix vulnerabilities.
CloudBees Unify enables you to run a Black Duck scan either implicitly or explicitly.
Explicit and implicit scan types
An implicit scan is automatically triggered, and an explicit scan is one you configure to be invoked in a step of your workflow. To learn more about the differences between explicit and implicit scans, refer to Understanding security center workflows.
To set up implicit scanning, refer to Configure implicit security analysis.
How the scanner works
The Black Duck SCA scanner architectural components are:
-
Client-side: The Black Duck Detect scanning tool, the Signature Scanner command-line tool, and the REST API.
-
Server-side: The Black Duck server.
-
Data center: The Black Duck KnowledgeBase open-source software database.
The scanning process is as follows:
-
The Black Duck Detect tool authenticates with the Black Duck server and initiates the code scan.
-
Codebases are scanned on the client side.
-
The Detect tool uploads the scan data to the Black Duck server. The completed scan data does not contain any source code, to maintain your code security. The scanned data does not contain source code, helping maintain the security of your code. Instead, it contains file and directory signatures and information derived from package management files
-
The scan data is sent to the Black Duck KnowledgeBase, and open-source components in your code are matched and identified. The matching and identification process is based on your package manager data and SHA1 hashes created by the Signature Scanner during the scan of files and directories.
-
The REST API is used to fetch the bearer token and retrieve the scanning results.
-
The matched open-source components are reported as a viewable Bill of Materials that contains the associated security, licensing, and operational risks of the discovered components.
| For more information about the Black Duck SCA scanner, refer to the Black Duck documentation. |