Running the tool
Once your Black Duck C/CPP tool is installed, simply run the command:
blackduck-c-cpp -d BUILD_DIR -proj PROJECT_NAME -vers PROJECT_VERSION -bd bd_url -a api_tokenOr, if you have configured a yaml file:
blackduck-c-cpp --config /Users/theUser/myProject/<file name>.yamlCommand line options
To run the Black Duck C/CPP tool, see the command below:
blackduck-c-cpp [-h] [-c CONFIG] [-bc build_cmd] -d BUILD_DIR [-Cov
coverity_root] [-Cd cov_output_dir] [-od output_dir] [-s [SKIP_BUILD]] [-v
[verbose]] -proj PROJECT_NAME -vers PROJECT_VERSION [-Cl CODELOCATION_NAME] -bd
bd_url -a api_token [-as additional_sig_scan_args] [-i [insecure]] [-f [force]]
[-djs [DISABLE_JSON_SPLITTER]] [-si SCAN_INTERVAL] [-jsl json_splitter_limit]
[-dg [debug]] [-st [SKIP_TRANSITIVES]] [-sh [SKIP_INCLUDES]] [-sd
[SKIP_DYNAMIC]] [-off [OFFLINE]] [-md modes] [-uo [USE_OFFLINE_FILES]] [-sc
scan_cli_dir] [-Cc cov_configure_args] [-ac additional_coverity_params] [-es
[EXPAND_SIG_FILES]] [-po PORT]
| Argument | Required | Details |
|---|---|---|
|
|
N |
Show this help message and exit. |
|
|
N |
Configuration file path. |
|
|
N |
Command used to execute the build. |
|
|
Y |
Directory from which to run build. |
|
|
N |
Base directory for Coverity. If not specified, Black Duck C/CPP downloads latest mini-coverity package from GCP for authorized Black Duck customers for Black Duck versions >= 2021.10. To download the Coverity package using GCP, you must open
connection toward |
|
|
N |
Target directory for coverity output files. If not specified,
defaults to
|
|
|
N |
Target directory for Black Duck C/CPP output files. If not
specified, defaults to
|
|
|
N |
Skip build and use previously generated build data. Make sure
that your initial coverity wrapped build uses the
|
|
|
N |
Verbose mode selection. |
|
|
Y |
Black Duck project name. |
|
|
Y |
Black Duck project version. |
|
|
N |
This controls the Black Duck SCA's codelocation. The codelocation_name will overwrite any scans sent to the same codelocation_name, indicating that this is a new scan of a previous code location. Use with caution. |
|
|
Y |
Black Duck SCA URL. |
|
|
Y |
Black Duck SCA API token. Instead of specifying
|
|
|
N |
Any additional args to pass to the signature scanner. |
|
|
N |
Disable SSL verification so self-signed Black Duck SCA certs will be trusted. |
|
|
N |
In case of GCP failure, force use of older version of Coverity (if present). |
|
|
N |
Disable the JSON/BDIO splitter and always upload as a single scan. For using JSON/BDIO splitter, dryrun is needed, so please run in offline mode first. |
|
|
N |
Set the limit for maximum scan node entries per generated BDIO file. |
|
|
N |
Set the limit for maximum scan node entries per single BDIO-entry file. Default value is 5000. |
|
|
N |
Set the number of seconds to wait between scan uploads in case of multiple scans. |
|
|
N |
Set the limit for a scan size in bytes. For using JSON/BDIO splitter, dryrun is needed, so please run in offline mode first. |
|
|
N |
Debug mode selection. Setting debug: True sends all the files we found to all matching types. By default, it will only send files not detected by package manager to BDBA and Signature matching. |
|
|
N |
Skipping all transitive dependencies. |
|
|
N |
Skipping all .h and .hpp files from all types of scan. |
|
|
N |
Skipping all dynamic (SO/DLL) files from all types of scan. |
|
|
N |
Store BDBA and signature ZIP files, signature scan JSON, and raw_bdio.csv to disk if offline mode is true. The |
|
|
N |
Comma separated list of modes to run - |
|
|
N |
Use offline generated files for upload in online mode. |
|
|
N |
Scan cli directory. Ex: Providing |
|
|
N |
Additional configuration commands to cov-configure for
different compilers. Inputs taken are of format
{"compiler":"compiler-type"}. There is a way to use Coverity
template configuration to reduce number of template compiler
configurations with wildcards: example: " |
|
|
N |
Any additional args to pass to Coverity build command.
example: |
|
|
N |
Use |
|
|
N |
Set a custom Black Duck SCA port. |
|
|
N |
Use if this is a Bazel build - make sure you have followed the setup instructions for Coverity. |
|
|
N |
This is same as |
|
|
N | This is same as
|
|
|
N |
Specify Coverity mode to |
|
|
N |
For Linux platforms, force pull 2022.9 or latest version of
Coverity if not auto downloaded by blackduck-c-cpp correctly
by specifying |
Snippet scanning
Black Duck recommends using --snippet-matching when using the Black
Duck C/CPP tool. To use snippet scanning, pass the snippet scanning parameters to
the signature scanner using:
--additional_sig_scan_args <snippet scanning parameter(s)>See Running a component scan using the Signature Scanner command line in the Black Duck Help Guide for more details.
Accessing Black Duck SCA via a proxy
To access the Black Duck SCA server via a proxy, you must set a
SCAN_CLI_OPTS environment variable prior to running the scan.
See Accessing the Black Duck server via a
proxy in the Black Duck Help Guide for details.
Scans exceeding 5GB
Black Duck SCA scans typically have an upper limit of 5GB. You can get around this limitation by following the steps below:
-
Run the Black Duck C/C++ tool in offline mode to generate the scan files and Coverity linkage files by adding the offline parameter to your command:
blackduck-c-cpp -d BUILD_DIR -proj PROJECT_NAME -vers PROJECT_VERSION -bd bd_url -a api_token -off -
Rerun the scan in online mode, add the use offline files parameter to point to your first run generated files, and adding in the splitter parameters on the props page. The values used below are for example purposes:
blackduck-c-cpp -d BUILD_DIR -proj PROJECT_NAME -vers PROJECT_VERSION -bd bd_url -a api_token -uo -bsfl 3000or
blackduck-c-cpp -d BUILD_DIR -proj PROJECT_NAME -vers PROJECT_VERSION -bd bd_url -a api_token -uo -bscn 10000
The second run will take your offline files, run the BDIO splitter on them, and upload them to Black Duck SCA in chunks, avoiding the 5GB scan limit.
Alternatively, you can configure these parameters in a yaml file for ease of use.