Black Duck® SCA does not have many configuration options.

One option, described below, is to host the Black Duck® SCA scan engine, Black Duck® Detect, in a location other than the default.

See also: Black Duck SCA setup considerations.

Black Duck SCA setup considerations

To run Black Duck SCA in Code Sight, a system must meet certain requirements.

Java support

The system must be configured to run the Java® Development Kit (JDK), release 8 or higher.

Scan engine

We highly recommend that you verify that the locally installed Black Duck SCA scanning component, Black Duck® Detect, is the most recent version. Recent versions of Detect are posted in the Black Duck Artifactory.

The package manager and build support

The package manager for the projects to analyze, and the build tool or tools it uses, must have been installed and be specified in the system’s PATH variable.

User credentials

Each user account must be configured to meet the following conditions:

  • The user must have access to check for component security vulnerabilities.
  • It must be possible to check each component against the projects accessible to the user, and the global policies configured on the Black Duck SCA server.
  • All dependencies must be resolvable. That is to say, each dependency must have been installed using the package manager’s cache, virtual environment, and other environmental settings.

Internet access

To communicate with the Black Duck SCA server, the system must be connected to the Internet.

Remember: Internet access is also needed when you install Code Sight, to download Code Sight itself, and also the Black Duck Detect application, if this is not already present on the system. See Installation.

The plug-in downloads the Detect application from the URL that is saved on the Administration → System Settings page for your Black Duck SCA account. By default, this Hosting location value points to the Black Duck Artifactory. You can configure Black Duck SCA to download Detect from a different location: See Specify a custom download location for Black Duck Detect.

Specify a custom download location for Black Duck Detect

You can change the URL (URI) from which Code Sight downloads Detect, the engine that runs SCA scans and communicates with the Black Duck server.

Version requirements:

Please see the “Black Duck Products and Servers” table on the Code Sight support matrix page.

Requirements for the Detect URL and server installation:

  • The URL must use the HTTP or HTTPS protocol.
  • Detect should be hosted on the server as a ZIP file, with the same file name it has on the Artifactory page.
    Attention: Use the air-gap version that includes NuGet; for example, detect-<version>-air-gap-no-docker.zip.
  • The server where you post the zipped Detect application must not require authentication to retrieve the file.

Steps to change the URL:

  1. Log in to your Black Duck page.
  2.  In the sidebar, click the Admin icon.
  3. On the Administration page, navigate to System Settings → Black Duck® Detect.
  4. In the Hosting Location field, enter your host URL.
  5. Click the Save button to the right.
    From now on, downloads of Detect, including those launched by Code Sight, will obtain the Detect ZIP file from this new location.

Build tools and package managers

Code Sight lets you specify the build tools used for a project that Black Duck scans. The details depend on the IDE.

Eclipse

The tool can be either Apache® Maven™ or npm®.

  • Maven

    Specify the local installation of Maven in Eclipse Preferences: Preferences dialog → Maven → Installations.

    Make sure the Maven installation has permission to execute.

    Attention: Code Sight does not support the EMBEDDED run-time Maven.
  • npm

    The npm executable must be in an accessible location. Add this location to the $PATH environment variable.

IntelliJ

The tool can be either Maven or npm.

  • Maven

    Specify the local installation of Maven in IntelliJ Preferences: Preferences dialog → Build, Execution, Deployment → Build Tools → Maven → Maven home path.

    Make sure the Maven installation has permission to execute.

    Attention: As of IntelliJ 2022.2, Code Sight can run Open Source scans by using the EMBEDDED run-time Maven.
  • npm

    For the Ultimate edition of IntelliJ, Code Sight automatically uses the npm path that is specified in Preferences dialog → Languages & Frameworks → Node.js and NPM → Node Interpreter.

    For the Community edition, save the npm executable in an accessible location from which it can be run. Add this location to the $PATH environment variable.

Visual Studio

The tool can be either NuGet or npm.

  • NuGet

    For the NuGet package manager, no additional configuration is necessary.

  • npm

    The npm executable must be in an accessible location. Add this location to the $PATH environment variable.

Visual Studio Code

The tool can be either Maven or npm.

To specify the location of your preferred build tool, use the Configure Paths panel.