Artifactory Integration

Overview

Artifactory Integration is the Black Duck mechanism to protect the Software Supply Chain. Since Artifactory is typically one of the last links of that chain, scanning every artifact within a configured set of Artifactory Repositories allows customers to have control of their individual supply chain. By default, this version of the Artifactory Integration automatically blocks downloads from scanned Artifactory Repositories that have a Black Duck SCA Policy Violation. Black Duck SCA policies that are defined as Rapid or Both will be applied to the Artifactory Integration.

Architecture

The architectural approach for Artifactory Integration has been refined in Black Duck SCA 2023.10.0 to support a primary focus on fully hosted deployments. These changes are reflected in the architecture diagram below.

Operation

The Artifactory Integration periodically checks the repositories configured for artifacts that have not yet been scanned, have been updated since the last successful scan, or previously had scan errors and compiles a list.

Files are sent to your hosted Black Duck SCA instance to be scanned and evaluated against policies defined in Black Duck SCA. The Artifactory Integration polls your Black Duck SCA instance for results and, when available, annotates the artifact with results including, but not limited to:

• Scan result (success/failure).

• URL to the scan results on the Black Duck SCA instance.

• Names of any policies that were found to be violated.

Additionally, the ability to block downloads of artifacts found in violation of Black Duck policies can be configured per repository.

Supported Repositories

The following repository types are supported for scanning by Black Duck SCA. The repositories are listed in alphabetical order, and each repository may be added only once.

1. Local Repositories

2. Remote Repositories

   Note: For remote Docker repositories, the blocking strategy "Block unscanned items and scanned items that have policy violations" is not fully supported. This limitation arises because artifacts are cached into the Artifactory file system upon first download, which is necessary for scanning.

3. Virtual Repositories

   Note: If a repository, such as common-repo, is included in multiple virtual repositories—namely virtual-repo-a and virtual-repo-b—and both virtual repositories are listed in the Artifactory configuration on Black Duck, the settings for common-repo from virtual-repo-a will be applied. The settings from virtual-repo-b will be disregarded because virtual-repo-a precedes virtual-repo-b in alphabetical order.