Black Duck integration

Synchronize Seal's remediation findings into Black Duck via the Black Duck API.

The Seal CLI calls the Black Duck API after every seal fix run and updates the corresponding findings on the targeted Black Duck project version.

Before you start

• A Black Duck access token with permissions to update vulnerability findings on the target project.

• The Black Duck project name and the project version name. Black Duck scopes findings by project version, so both are required.

• The Black Duck server URL (your tenant's hosted address).

Configuration

Set these in your CI environment:

SEAL_BLACKDUCK_URL=<black duck server url>
SEAL_BLACKDUCK_TOKEN=<black duck access token>
SEAL_BLACKDUCK_PROJECT=<black duck project name>
SEAL_BLACKDUCK_PROJECT_VERSION_NAME=<black duck project version name>

Or in .seal-config.yml at the project root:

blackduck:
  url: <black duck server url>
  token: <black duck access token>
  project-name: <black duck project name>
  project-version-name: <black duck project version name>

A common pattern for the project version name is to match it to the Git branch being scanned. Whatever scheme you use in Black Duck, pass that value verbatim.

Verify

After a seal fix run with the integration configured, open the targeted Black Duck project version. Vulnerabilities Seal sealed should reflect a remediated state with a Seal-attributed reason.

Related

• How CLI-driven sync works