Black Duck SCA analyzes source code by comparing its components to a database of open-source software that tracks known issues.
As performed by Black Duck, the analysis involves the following steps:
- Run Rapid Scan Static (also known as Detect) to scan the current code base and obtain components from the package manager configuration files in the project.
- Check these components against the KnowledgeBase, on the Black Duck server, to learn of security vulnerabilities, policy family, and other metadata: This information helps to understand the nature of the component.
- Recommend ways to mitigate certain vulnerabilities; for example, upgrading the version of a component that is out of date.
The following illustration shows an overview of this process:
Figure 1. Software Composition Analysis with Black Duck
