Basic Properties

Bazel Executable: The path to the Bazel executable.

Bazel Target: The Bazel target (for example, //foo:foolib) for which dependencies are collected. For Detect to run Bazel, this property must be set.

Bazel cquery additional options: A comma-separated list of additional options to pass to the bazel cquery command. e.g., --enable_bzlmod, --enable_workspace

Bazel query additional options: A comma-separated list of additional options to pass to the bazel query command. e.g., --enable_bzlmod, --enable_workspace

default: NONE

Acceptable Values: ALL, NONE, MAVEN_JAR, MAVEN_INSTALL, HASKELL_CABAL_LIBRARY, HTTP_ARCHIVE

Bazel dependency sources: Replaces the deprecated detect.bazel.workspace.rules property. Manually specify which dependency sources to extract. Valid values: MAVEN_INSTALL, MAVEN_JAR, HTTP_ARCHIVE, HASKELL_CABAL_LIBRARY, ALL, NONE. By default (NONE), Detect automatically probes the Bazel dependency graph to determine which sources are present and runs the appropriate pipelines. This property works for both BZLMOD and WORKSPACE projects.

Binary Scan Target: If specified, this file and this file only will be uploaded for binary scan analysis. This property takes precedence over detect.binary.scan.file.name.patterns. The BINARY_SCAN tool does not provide project and version name defaults to Detect, so you need to set project and version names via properties when only the BINARY_SCAN tool is invoked.

Binary Scan Filename Patterns: If specified, files in the source directory whose names match these file name patterns will be zipped and uploaded for binary scan analysis. This property will not be used if detect.binary.scan.file.path is specified. Search depth is controlled by property detect.binary.scan.search.depth. Directories specified via property detect.excluded.directories are excluded from the file search. This property accepts filename globbing-style wildcards. For more information, refer to the Property wildcard support page.

default: oe-init-build-env

BitBake Init Script Name: The name of the build environment init script.

BitBake Package Names: A comma-separated list of package names from which dependencies are extracted.

BitBake Source Arguments: A comma-separated list of arguments to supply when sourcing the build environment init script.

default: 1

BitBake Search Depth: The depth at which Detect will search for files generated by Bitbake.

Black Duck SCA API Token: The access token used to authenticate with the Black Duck SCA Server.

default: false

Offline Mode: This can disable Black Duck SCA communication - if set to true, Detect will not upload BDIO files, or check policies, and it will not download and install the signature scanner. Note that the path to a local instance of the scanner can be provided using the -detect.blackduck.signature.scanner.local.path parameter.

Black Duck SCA URL: URL of the Black Duck SCA server.

default: false

Test Connection to Black Duck SCA: Test the connection to Black Duck SCA with the current configuration.

default: 300

Detect Timeout: The amount of time in seconds Detect will wait for network connection, for scans to finish, and to generate reports (i.e. risk and policy check). When changing this value, keep in mind the checking of policies might have to wait for scans to process which can take some time.

Cargo Executable: The path to the cargo executable.

default: NONE

Acceptable Values: NONE, NORMAL, BUILD, DEV, PROC_MACRO

Cargo Dependency Types Excluded: A comma-separated list of dependency types that will be excluded.

default: false

Ignore All Workspaces: All workspaces are ignored by the Cargo detector.

Conan Executable: The path to the conan executable.

default: NONE

Acceptable Values: NONE, BUILD

Conan Dependency Types Excluded: Set this value to indicate which Conan dependency types Detect should exclude from the BOM.

Additional Conan Arguments: A space-separated list of additional arguments to add to the 'conan info' command line when running Detect against a Conan project. Detect will execute the command 'conan info {additional arguments} .'

Conan Lockfile: The path to the conan lockfile to apply when running 'conan info' to get the dependency graph.

Anaconda Environment Name: The name of the anaconda environment used by your project.

Conda Executable: The path to the conda executable.

cpan Executable: The path to the cpan executable.

dart Executable: The path to the dart executable.

flutter Executable: The path to the flutter executable.

Docker Image Name: The Docker image name (repo:tag) to inspect.

Docker Image ID: The ID (shown in the 'IMAGE ID' column of 'docker images' output) of the target Docker image. The target image must already be local (must appear in the output of 'docker images').

Docker Executable: Path to the docker executable (used to load image inspector Docker images in order to run the Docker Inspector in air gap mode).

default: false

Component Location Analysis Enabled: If set to true, Detect will save an output file named 'components-with-locations.json' in the Scan subdirectory detailing where in the project's source code OSS components are declared.

default: false

Component Location Analysis Status: If set to true, Detect status and exit code will be affected by the status of the Component Location Analysis run.

default: SOURCE

Acceptable Values: SOURCE, IMAGE

Detect Scan Mode: Informs detect of what is being scanned which allows improved user experience when scanning different types of targets.

default: false

Wait For Results: If set to true, Detect will wait for Black Duck SCA products until results are available or the detect.timeout is exceeded.

default: true

Follow Symbolic Links: If set to true, Detect will follow symbolic links when searching for detectors, when searching for files that select detectors (such as Bitbake and Sbt) need, when searching for directories to exclude from signature scan, and when searching for binary scan targets. Symbolic links are not supported for Impact Analysis.

Go Executable: Path to the Go executable.

default: NONE

Acceptable Values: NONE, UNUSED, VENDORED

Go Mod Dependency Types Excluded: Set this value to indicate which Go Mod dependency types Detect should exclude from the BOM.

Go Forge URL: The Go Forge URL to fetch the go.mod descriptor of direct dependencies. If not set, the default Go Forge (https://proxy.golang.org) will be used. This is only applicable to the Go Mod File detector.

default: 30

Go Forge Connection Timeout: The connection timeout in seconds to use when connecting to the Go Forge. If not set, the default connection timeout of 30 seconds will be used.

Gradle Build Command: Gradle command line arguments to add to the gradle/gradlew command line.

default: NONE

Acceptable Values: NONE, UNRESOLVED

Gradle Configuration Types Excluded: Set this value to indicate which Gradle configuration types Detect should exclude from the BOM.

IaC Scan Target Paths: A comma-separated list of paths to perform IaC scans on.

IaC Scan Arguments: A space-separated list of additional arguments to use when running the IaC Scanner.

default: false

Vulnerability Impact Analysis Enabled: If set to true, Detect will attempt to look for *.class files and generate a Vulnerability Impact Analysis Report for upload to Black Duck SCA.

Lerna Executable: Path of the lerna executable.

Maven Build Command: Maven command line arguments to add to the mvn/mvnw command line.

Maven Executable: The path to the Maven executable (mvn or mvnw).

Dependency Scope Included: A comma separated list of Maven scopes. Output will be limited to dependencies within these scopes (overridden by exclude).

Dependency Scope Excluded: A comma separated list of Maven scopes. Output will be limited to dependencies outside these scopes (overrides include).

Additional NPM Command Arguments: A space-separated list of additional arguments that Detect will add at then end of the npm ls command line when Detect executes the NPM CLI Detector on an NPM project.

default: NONE

Acceptable Values: NONE, DEV, PEER, OPTIONAL

Npm Dependency Types Excluded: Set this value to indicate which Npm dependency types Detect should exclude from the BOM.

Nuget Config File: The path to the Nuget.Config file to supply to the nuget exe.

default: https://api.nuget.org/v3/index.json

Nuget Packages Repository URL: The source for nuget packages

default: NONE

Acceptable Values: NONE, DEV

Nuget Dependency Types Excluded: Set this value to indicate which Nuget dependency types Detect should exclude from the BOM.

Bash Executable: Path to the Bash executable.

BDIO Output Directory: The path to the output directory for the generated BDIO file.

BDIO File Name: The desired file name of BDIO file Detect produces in the BDIO Output Directory.

default: 0

Detector Search Depth: Depth of subdirectories within the source directory to which Detect will search for files that indicate whether a detector applies.

Git Executable: Path of the git executable

Java Executable: Path to the Java executable used by Docker Inspector.

Detect Output Path: The path to the output directory.

Scan Output Path: The output directory for all signature scanner output files. If not set, the signature scanner output files will be in a 'scan' subdirectory of the output directory.

Source Path: The source path is the path to the project directory to inspect. If no value is provided, the source path defaults to the current working directory.

Acceptable Values: NONE, DETECTOR, SIGNATURE_SCAN, BINARY_SCAN, IMPACT_ANALYSIS, DOCKER, BAZEL, IAC_SCAN, CONTAINER_SCAN, COMPONENT_LOCATION_ANALYSIS

Detect Tools Excluded: The tools Detect should not allow, in a comma-separated list. Excluded tools will not be run even if all criteria for the tool is met. Exclusion rules always take precedence.

Acceptable Values: ALL, DETECTOR, SIGNATURE_SCAN, BINARY_SCAN, IMPACT_ANALYSIS, DOCKER, BAZEL, IAC_SCAN, CONTAINER_SCAN, COMPONENT_LOCATION_ANALYSIS

Detect Tools Included: The tools Detect should allow in a comma-separated list. Tools in this list (as long as they are not in the excluded list) will run if all criteria of the tool are met. Exclusion rules always take precedence.

Status JSON Output Path: The directory to place a copy of the status.json file.

default: NONE

Acceptable Values: NONE, OPTIONAL

Pear Dependency Types Excluded: Set this value to indicate which Pear dependency types Detect should exclude from the BOM.

default: NONE

Acceptable Values: NONE, DEV

Pipfile Dependency Types Excluded: A comma-separated list of dependency types that will be excluded.

PIP Project Name: The name of your PIP project, to be used if your project's name cannot be correctly inferred from its setup.py file.

PIP Project Version Name: The version of your PIP project, to be used if your project's version name cannot be correctly inferred from its setup.py file.

PIP Requirements Path: A comma-separated list of paths to requirements files, to be used to analyze requirements files with a filename other than requirements.txt or to specify which requirements files should be analyzed.

default: false

PIP Include Only Project Tree: By default, pipenv includes all dependencies found in the graph. Set to true to only include dependencies found underneath the dependency that matches the provided pip project and version name.

Pip Executable: The path to the Pip executable.

default: NONE

Acceptable Values: ALL, NONE, BLOCKER, CRITICAL, MAJOR, MINOR, OK, TRIVIAL, UNSPECIFIED

Fail on Policy Violation Severities: A comma-separated list of policy violation severities that will fail Detect. If this is set to NONE, Detect will not fail due to policy violations. A value of ALL is equivalent to all of the other possible values except NONE.

Fail on Policy Names with Violations: A comma-separated list of policy names with a non-zero number of violations that will fail Detect.

default: BLOCKER,CRITICAL

Acceptable Values: ALL, NONE, BLOCKER, CRITICAL, MAJOR, MINOR, OK, TRIVIAL, UNSPECIFIED

Fail on Stateless Policy Violation Severities: A comma-separated list of policy violation severities that will fail Detect. If this is set to NONE, Detect will not fail due to policy violations. A value of ALL is equivalent to all of the other possible values except NONE. This property works for both stateless and rapid scans.

Project Description: If project description is specified, your project will be created with this description. For updates, see detect.project.version.update.

Project Name: An override for the name to use for the Black Duck SCA project. If not supplied, Detect will attempt to use the tools to figure out a reasonable project name. If that fails, the final part of the directory path where the inspection is taking place will be used.

Project Tier: If a Black Duck SCA project tier is specified, your project will be created with this tier. For updates, see detect.project.version.update.

Version Name: An override for the version to use for the Black Duck SCA project. If not supplied, Detect will attempt to use the tools to figure out a reasonable version name. If that fails, the current date will be used.

Version Nickname: If a project version nickname is specified, your project version will be created with this nickname. For updates, see detect.project.version.update.

Version Notes: If project version notes are specified, your project version will be created with these notes. For updates, see detect.project.version.update.

default: DEVELOPMENT

Acceptable Values: ARCHIVED, DEPRECATED, DEVELOPMENT, PLANNING, PRERELEASE, RELEASED

Version Phase: If project version phase is specified, your project version will be created with this phase. For updates, see detect.project.version.update.

DEPRECATED VALUES: ARCHIVED: With the Black Duck SCA 2026.1.0 release, the ARCHIVED option was deprecated and is no longer supported. To ensure compatibility with both current and upcoming releases, please update your configuration to use a supported project version phase. ARCHIVED: This phase has been deprecated.

default: false

Update Project Version: If set to true, Detect will update the Black Duck SCA project and project version according to configured project and project version properties. (By default, these properties are only set on created projects / project versions.)

Project Version License: If project version license is specified, your project version will be created with this license. For updates, see detect.project.version.update.

default: false

Quack Patch Enabled: If set to true, Detect will invoke Quack Patch -- a tool that uses LLMs to generate code patches for vulnerable transitive components.

LLM Gateway API key: Provides the API key used to authenticate with the configured LLM Gateway.

LLM API URL: Specifies the base URL of the LLM Gateway that the Quack Patch tool will send requests to.

default: false

Generate Notices Report: When set to true, a Black Duck SCA notices report in text form will be created in your source directory.

Notices Report Path: The output directory for notices report. Default is the source directory.

default: false

Generate Risk Report (PDF): When set to true, a Black Duck SCA risk report in PDF form will be created.

default: false

Generate Risk Report (JSON): When set to true, a Black Duck SCA risk report in JSON form will be created.

Risk Report (PDF) Output Path: The output directory for risk report in PDF. Default is the source directory.

Sbt Executable: Path to the Sbt executable.

Signature Scanner Arguments: A space-separated list of additional arguments to use when running the Black Duck SCA signature scanner. Key-value pairs specified as arguments will replace the same entries specifed elswhere. Available signature scanner properties can be determined by specifying '--help' when executing the signature scanner jar file from the command line.

default: false

Signature Scanner Copyright Search: When set to true, user will be able to scan and discover copyright names in Black Duck SCA. Corresponding Signature Scanner CLI Argument: --copyright-search.

default: false

Signature Scanner CSV Archive Output: When set to true Signature Scanner output will be in CSV format. Corresponding Signature Scanner CLI Argument: --outputFormat csv for offline mode, --upload-csv for online mode.

default: false

Signature Scanner Dry Run: If set to true, the signature scanner results are not uploaded to Black Duck SCA, and the scanner results are written to disk via the Signature Scanner CLI argument: --dryRunWriteDir.

default: NONE

Acceptable Values: NONE, SOURCE, BINARY, ALL

Individual File Matching: Users may set this property to indicate what types of files they want to match. Corresponding Signature Scanner CLI Argument: --individualFileMatching.

default: false

Signature Scanner License Search: When set to true, user will be able to scan and discover license names in Black Duck SCA. Corresponding Signature Scanner CLI Argument: --license-search.

Signature Scanner Local Path: To use a local signature scanner, specify the path where the signature scanner was unzipped. This will likely look similar to 'scan.cli-x.y.z' and includes the 'bin, icon, jre, and lib' directories of the expanded scan.cli.

Signature Scanner Target Paths: If this property is not set, the signature scanner target path is the source path (see property detect.source.path). If this property is set, the paths provided in this property's value will be signature scanned instead (the signature scanner will be executed once for each provided path).

default: NONE

Acceptable Values: NONE, SNIPPET_MATCHING, SNIPPET_MATCHING_ONLY

Snippet Matching: Use this value to enable the various snippet scanning modes. For a full explanation, refer to Running a component scan using the Signature Scanner command line. Corresponding Signature Scanner CLI Arguments: --snippet-matching, --snippet-matching-only.

default: DEFAULT

Acceptable Values: DEFAULT, RETAIN_UNMATCHED, DISCARD_UNMATCHED

Reduced Persistence: Use this value to control how unmatched files from signature scans are stored. For a full explanation, refer to about reduced persistence signature scanning.

default: false

Upload source mode: If set to true, the signature scanner will, if supported by your Black Duck SCA version, upload source code to Black Duck SCA. Corresponding Signature Scanner CLI Argument: --upload-source.

uv Executable: The path to the uv executable.

default: false

Ignore All Workspaces: All workspaces are ignored by the Yarn detector for increased performance and precision to scan a massive codebase.