About SCA Scan Service

SCA Scan Service (SCASS) is a scalable solution for performing software composition analysis scans outside of the traditional Black Duck SCA environment. SCASS supports Package Manager and Signature Scans, making it a versatile choice for various scanning needs.

This services provides significant benefits for both on-premise and hosted customers:

  • On-premise customers: Resource requirements for non-specialized scanning are greatly reduced, steamlining infrastructure needs.

  • Hosted customers: Cloud Infrastructure efficiency improves with dynamic scaling based on overall scan demand, enhancing performance and reducing operational overhead.

Key functions of SCA Scan Service

SCA Scan Service enables the following functionality:

  • Scanning of provided code artifacts using one or more scan type methodologies.

    • Build artifacts, repositories, binary, and Docker images.

    • Signature, package manager, binary, and Docker container scan type methodologies.

  • Matching of evidence to OSS components.

    • Signatures, packages, and Docker layer digests.

    • Singular and correlative matching techniques.

  • Results delivery.

    • Unopinionated results of identified components, their declared licenses, and their associated vulnerabilities.

    • Intermediate evidence data (BDIO) in support of replay and serviceability.

Scan types

Scan type Configuration Options Code Upload? BDIO Upload? Correlated Scan Support? Match Support
Signature

  • Explicit configuration

  • Automatic configuration

  • File-based evidence

  • Component origin matches
Package manager

  • Explicit configuration

  • Automatic configuration

  • Package-based evidence

  • Component origin matches
Binary

  • Explicit configuration

  • Automatic configuration

  • File-based and package-based evidence

  • Component matches

  • Component version matches

  • Component origin matches
Docker container

  • Explicit configuration

  • Automatic configuration

  • File-based and package-based evidence

  • Component matches

  • Component version matches

  • Component origin matches
Snippet

  • Explicit configuration

  • File-based evidence

  • Component origin matches

Other features

SCASS also enables Correlated Scanning, a new feature that leverages SCASS to enhance match results by combining insights from multiple scanning techniques.

Additionally, SCASS delivers faster delivery of scanning bug fixes, independent of Black Duck release cycles. While scan results are stored transactionally, this streamlined service enhances the flexibility and scalability of scanning across platforms.

Please note, this feature must be enabled on your product registration key to take advantage of the service. With SCASS, you can simplify resource management and enjoy a more scalable scanning experience. Contact your Black Duck representative to learn more.

SCASS system block diagram


SCASS System Block diagram