Black Duck

Black Duck is the industry-leading software composition analysis (SCA) platform for managing open-source security, license compliance, and code quality risks.

Now operating independently after the acquisition of Synopsys Software Integrity Group, Black Duck provides comprehensive visibility into open-source components across your entire software portfolio.

What is Black Duck?

Black Duck represents decades of expertise in open-source security and license compliance.

The platform scans source code, binaries, and containers to identify all open-source components, map known vulnerabilities, and flag license obligations.

Organizations ranging from startups to Fortune 500 enterprises rely on Black Duck to secure their software supply chain.

The solution differentiates itself through the Black Duck KnowledgeBase, a curated database containing information on over 6 million open-source projects and 15+ billion code files.

This extensive knowledge base, combined with proprietary Black Duck Security Advisories (BDSAs), provides vulnerability intelligence that goes beyond what public databases like the NVD offer.

Key Features

Software Bill of Materials (SBOM) Generation

Black Duck automatically generates comprehensive SBOMs that inventory all open-source and third-party components:

• Export in standard formats (SPDX, CycloneDX, custom)
• Track component versions and dependencies
• Identify transitive dependencies that indirect packages introduce
• Maintain historical SBOM snapshots for audit trails
• Share SBOMs with customers and partners for supply chain transparency

Vulnerability Management

Beyond standard CVE tracking, Black Duck provides enhanced vulnerability intelligence:

• Black Duck Security Advisories (BDSAs) - Security team-curated advisories that often provide earlier warning and more actionable guidance than NVD entries
• Exploitability analysis - Understand which vulnerabilities have known exploits in the wild
• Upgrade guidance - Recommended versions that remediate issues without breaking changes
• Custom vulnerability entries - Add internal security findings to your tracking

License Compliance

Manage open-source license obligations to reduce legal risk:

• Identify all license types across your portfolio
• Flag license conflicts (e.g., GPL components in proprietary software)
• Generate attribution reports for distribution
• Create custom policies based on your organization’s risk tolerance
• Track dual-licensed components and commercial alternatives

Container and Binary Analysis

Scan more than just source code:

• Analyze Docker images and OCI containers
• Scan compiled binaries without access to source
• Identify components in firmware and embedded systems
• Support for package managers across all major ecosystems

Installation and Setup

Synopsys Detect CLI

The primary integration method uses the Synopsys Detect CLI tool:

# Download and run Synopsys Detect
curl -O https://detect.synopsys.com/detect9.sh
chmod +x detect9.sh

# Run a scan
./detect9.sh \
  --blackduck.url=https://your-blackduck-server.com \
  --blackduck.api.token=$BLACKDUCK_API_TOKEN \
  --detect.project.name="my-application" \
  --detect.project.version.name="1.0.0"

Configuration Options

Create a application-blackduck.yml for reusable configuration:

blackduck:
  url: https://your-blackduck-server.com
  api:
    token: ${BLACKDUCK_API_TOKEN}

detect:
  project:
    name: my-application
    version:
      name: ${BUILD_VERSION}
  policy:
    check:
      fail:
        on:
          severities: BLOCKER,CRITICAL
  risk:
    report:
      pdf: true

Integration

GitHub Actions

name: Black Duck SCA

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  blackduck-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Run Black Duck Scan
        uses: synopsys-sig/synopsys-action@v1
        with:
          blackduck_url: ${{ secrets.BLACKDUCK_URL }}
          blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
          blackduck_scan_full: true
          blackduck_scan_failure_severities: 'BLOCKER,CRITICAL'

      - name: Upload SBOM
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: '**/blackduck-sbom.*'

GitLab CI

stages:
  - security

blackduck-scan:
  stage: security
  image: openjdk:17-slim
  variables:
    DETECT_LATEST_RELEASE_VERSION: "9"
  script:
    - apt-get update && apt-get install -y curl bash
    - curl -O https://detect.synopsys.com/detect9.sh
    - chmod +x detect9.sh
    - ./detect9.sh
        --blackduck.url=$BLACKDUCK_URL
        --blackduck.api.token=$BLACKDUCK_API_TOKEN
        --detect.project.name=$CI_PROJECT_NAME
        --detect.project.version.name=$CI_COMMIT_REF_NAME
        --detect.policy.check.fail.on.severities=BLOCKER,CRITICAL
        --detect.risk.report.pdf=true
  artifacts:
    paths:
      - "**/blackduck*.pdf"
    expire_in: 30 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Jenkins Pipeline

pipeline {
    agent any

    environment {
        BLACKDUCK_URL = credentials('blackduck-url')
        BLACKDUCK_API_TOKEN = credentials('blackduck-api-token')
    }

    stages {
        stage('Black Duck Scan') {
            steps {
                synopsys_detect detectProperties: '''
                    --detect.project.name=${JOB_NAME}
                    --detect.project.version.name=${BUILD_NUMBER}
                    --detect.policy.check.fail.on.severities=BLOCKER,CRITICAL
                '''
            }
        }
    }

    post {
        always {
            archiveArtifacts artifacts: '**/blackduck*.pdf', allowEmptyArchive: true
        }
    }
}

When to Use Black Duck

Black Duck is the right choice for organizations that:

• Have significant open-source usage and need comprehensive inventory management
• Face license compliance requirements from customers, partners, or legal teams
• Require enterprise-grade SBOM generation for supply chain transparency
• Need to scan binaries and containers in addition to source code
• Want vulnerability intelligence beyond the NVD with Black Duck Security Advisories
• Operate in regulated industries requiring detailed audit trails and reporting

Consider alternatives like Snyk Open Source or FOSSA if you need a lighter-weight solution, have a smaller application portfolio, or prefer usage-based pricing models.

Open-source options like OWASP Dependency-Check work well for teams with limited budgets who can accept less comprehensive license compliance features.

Black Duck integrates well with its sibling products Coverity (SAST) and Black Duck Binary Analysis for a complete application security platform under one vendor.