Black Duck

Mon, 01 Jan 0001 00:00:00 +0000

Black Duck is the Software Factory’s most complete Software Composition Analysis (SCA ) solution. It combines four detection techniques to build a complete dependency inventory — including dependencies that other tools miss, such as copy-pasted open source code and components embedded in compiled binaries.

This process helps in identifying known security vulnerabilities (CVEs/BDSAs), license compliance violations, operational risks, and generating a comprehensive Bill of Materials (BOM) for your applications.

Black Duck SCA

Mon, 01 Jan 0001 00:00:00 +0000

This guide outlines practical, step-by-step instructions for integrating Black Duck SCA into your workflow, from initial project setup to CI/CD integration, advanced manual operations, and local IDE scanning.

Prerequisites: You must have Maintainer permissions for your GitLab repository and access to the Black Duck server.

How to Prepare Your Black Duck Project

Before analyzing your source code, you must provision a project space.

Log in to your account on the Black Duck server.
In the top-right corner of the dashboard, click + Create Project.
Enter your Project Name.
Enter an initial Version Name (e.g., main, v1.2.0).
Fill out the desired fields (like Tier or Phase) and click Save.
Ensure your user account (or service account) has Project Code Scanner permissions.

How to Generate and Secure an Authentication Token

Your tools need access to a token to communicate with the server. Never hardcode this token in your source code.

BlackDuck on Software Factory

Black Duck

Black Duck SCA

How to Prepare Your Black Duck Project

How to Generate and Secure an Authentication Token