What’s New?
Plugin will work as a scheduled event.
Plugin will work as a scheduled event.
WhiteSource provides for the management of open source components security, licenses, and maintenance throughout a software development cycle. It identifies the open source components within a software development lifecycle with security or compliance issues. When issues are detected alerts and remediation assistance is provided. The WhiteSource plugin integrates with WhiteSource to retrieves license risks and security vulnerabilities data from WhiteSource scan results to include in an HCL Accelerate metric.
WhiteSource identifies all open source components and their dependencies in software. WhiteSource secures software from vulnerabilities and enforces license policies throughout the software development lifecycle.
The WhiteSource plug-in retrieves WhiteSource scan results and displays the License Risks and Security Vulnerabilities in HCL Accelerate metric displays.
The following table describes the changes made in each plugin version.
Version | Description |
---|---|
2.0.15 | Converted to a scheduled event plugin. |
1.0.14 | User Access Key Related Changes. |
1.0.10 | Bug Fix. |
1.0.3 | Initial Release. |
To use the WhiteSource plugin, the plugin must be loaded and an instance created before you can configure the plugin integration. You define configuration properties in the user interface or in a JSON file.
The WhiteSource plugin supports endpoint integration which is listed in the following table.
Name | Path | Method |
---|---|---|
WhiteSource Scan | wScan | Post |
To import data from the WhiteSource server, send an HTTP POST request to your endpoint.
There are two methods to integrate the plugin:
The JSON file contains the information for creating a value stream and integrating with the WhiteSource server. The following table describes the information for the creating a HCL Accelerate value stream map.
Configuration properties
The following tables describe the properties used to configure the integration. Each table contains the field name when using the user interface and the property name when using a JSON file.
properties
configuration property.Some properties might not be displayed in the user interface, to see all properties enable the Show Hidden Properties field.
Name | Description | Required | Property Name |
---|---|---|---|
NA | The version of the plugin that you want to use. To view available versions, click the Version History tab. If a value is not specified, the version named latest is used. | No | image |
Integration Name | An assigned name to the value stream. | Yes | name |
Logging Level | The level of Log4j messages to display in the log file. Valid values are: all, debug, info, warn, error, fatal, off, and trace. | No | loggingLevel |
NA | List of plugin configuration properties used to connect and communicate with the WhiteSource server. Enclose the properties within braces. | Yes | properties |
The name of the tenant. | Yes | tenant_id | |
NA | Unique identifier assigned to the plugin. The value for the WhiteSource plugin is ucv-ext-whitesource |
Yes | type |
Product tokens | Add product tokens from whitesource on which we want to run scan | Yes | type |
Project Names | Add project names within the product to make it run at project level | No | type |
Custom field mapping | Add custom field mapping to map image tags with the application name for pipeline | No | type |
Name | Type | Description | Required | Property Name |
---|---|---|---|---|
User Key | String | User Key for authentication with WhiteSource. | Yes | userKey |
URL | String | The base URL of the WhiteSource API. | Yes | asocUrl |
HCL Accelerate User Access Key | Secure | User access key for authentication with HCl Accelerate. | Yes | keySecret |
The following sample code can be used as a template to define the integration within the JSON file for a value stream. Copy and paste the template into the JSON file Integration section and make the appropriate changes.
{ "type": "ucv-ext-whitesource", "tenant_id": "<my-tenant-id>, "name": "<integration-name>, "properties":{
"ucvAccessKey": "<my-ucv-user-access-key>, "userKey" : "<my-user-key>", "productToken" : "<product tokens>", "projectName" : "<project names>", "fieldMapping" : {"application.name": "image.name", "application.externalId": "image.id", "buildUrl": "image.buildUrl", "environment":"image.environment"} } } ]
Uploaded: 29-Mar-2022 06:28
docker pull hclcr.io/accelerate/ucv-ext-whitesource:2.0.15
Uploaded: 27-Jan-2022 12:18
docker pull hclcr.io/accelerate/ucv-ext-whitesource:1.0.14
Uploaded: 28-May-2021 06:14
docker pull hclcr.io/accelerate/ucv-ext-whitesource:1.0.10
Uploaded: 08-Mar-2021 10:14
docker pull hclcr.io/accelerate/ucv-ext-whitesource:1.0.3