Multifactor Open Source Detection
Black Duck® multifactor open source scanning technology ensures that you have the most complete and accurate view of open source in your applications and containers. Our open source detection combines build process monitoring and file system scanning to track all open source in use, including components most solutions miss.
Dependency Analysis
Integrates with build tools like Maven and Gradle to track both declared and transitive open source dependencies in applications built in languages like Java and C#.
Codeprint Analysis
Maps string, file, and directory information to the Black Duck KnowledgeBase to identify open source and third-party components in applications built using languages like C & C++.
Binary Analysis
Identifies open source within compiled application libraries and executables. No source code or build system access required.
Snippet Analysis
Finds parts of open source code that have been copied within proprietary code, which can potentially expose you to license violations and conflicts.
Why package declarations aren’t enough
Most other solutions rely solely on package manager declarations to identify open source components. But these solutions miss a lot of open source that may be in your code, including:
- Open source that developers add to your code but don’t declare in package manifests
- Open source in languages like C and C++ that don’t use package managers
- Open source built into containers without the use of a package manager
- Open source within already complied binaries, beyond what’s been declared
In addition, these solutions often provide inaccurate results for transitive dependencies and components where the package declaration doesn’t specify a single version to include in the build.
By combining our proprietary codeprint analysis with dependency analysis, Black Duck provides visibility into open source components not tracked by a package manager, as well as component and version verification for dynamic and transitive dependencies.
Simple integration into your CI/CD pipeline
Black Duck Detect, our open source discovery client, makes it easy to integrate open source detection into your existing development tools and processes. It automatically identifies which languages and package managers you’re using, configures the appropriate integrations for discovery, and finds the most effective way to analyze your code.
Black Duck Technology
Related content
Six Considerations for Securing Your Software Supply Chain
Download the supply chain security solution guide
2022 Gartner® Magic Quadrant™ for Application Security Testing
See why Synopsys is a Leader in AppSec
