Package: scantist-karby
KarbyPrerequisiteinstallpipenvaccording to any tutorial.enterKarbymain folder, executepipenv shell, runpipenv installto install the dependencies.There is a filed named.env.example, copy one and change it to.env. This is where we put all the system environment to. Every time you initiate thepipenv shell, the system will read those environment variables. All the credentials, tokens or password should not be directly placed in code, but here in.envRunningnow you should be able to run the script.The entrance issca_tool_scan.py. the full command example ispython sca_tool_scan.py [ossindex|scantist|whitesource] [upload|cmd] <any/git/url> -name <this is optional> -output <this is optional>you may not be able to run this because you don't have snyk credentials in your environmentfor parameter details, you should runpython sca_tool_scan.py -hBasic IdeaMotivationBasically, vulnerability detection tools are aim to find all the components in a given project as well as their vulnerabilities. But different tools are so different in using.karbyis a project aims to collect all of these vulnerability detection tools and simplify their usage.Input and outputThe input should be a single project URL. It could be a git hub URL(for upload scan) or local project directory(for cmd scan).The output should be a CSV file in the format ofScantist. You could see the example inkarby/report_format_example. There should be 2 files, the format is<tool_name>-<component or issue>-<project name>.csv.component file: there are 10 fields in this report, but actually only 2 of them matters:LibraryandVersion. Just leave the rest emptyissue file: there are 10 fields in this report, but actually only 3 of them matters:LibraryLibrary VersionandPublic ID.Public IDis the CVE public Id, if it is not provided, you can also left it empty.Scan typesI defined 2 types of scan:cmdandupload. They are also called:ci scanandairgap scan.cmdscan need the user to provide the localwell-buildproject directory, and trigger the scan locally in command line. Then, you can use any method to collect the result. You can download the report by url or just parse the output from command line. We don't care, but keep it simple and guarantee the final format(Scantist format)uploadscan need the user to provide the github url to trigger the scan. Or say, trigger by calling APIs given by that tool. This method do not require local build, so we call this **un-build ** project scan asairgap scan. Not all tools support thisuploadscan method. Need an example? You can refer to snyk api scan.Scan ToolsWhitesourceMode avaliablecmd: supportupload: support (this will not trigger a new scan, but find the project online by given name)PrerequisiteOne of the following Java versions:Java JDK 8Java JRE 8Java JDK 11Depending on your project type, ensure that the relevant package managers are installed. You can refer to "Prerequisites" section in the following link for more details.https://whitesource.atlassian.net/wiki/spaces/WD/pages/1140852201/Getting+Started+with+the+Unified+AgentSetupDownloadwss-unified-agent.jarfrom the following links:https://unified-agent.s3.amazonaws.com/wss-unified-agent.jarEnvironment VariablesWHITESOURCE_API_KEY: WhiteSource API key, a unique identifier of your organization. Should be a256-bit hex number.WHITESOURCE_USER_KEY: WhiteSource User Key. Can be generated from the Profile page in WhiteSource account. In order to get a scan report, the user key must be generated byadministrators.  Should be a256-bit hex number.WHITESOURCE_PRODUCT_NAME: Name of your product.PATH_TO_WHITESOURCE_JAR(cmdmode only): Path to the Whitesource local agent .jar file (e.g. /path/to/jar/wss-unified-agent.jar)PATH_TO_WHITESOURCE_CFG(cmdmode only, optional): Path to the Whitesource local agent .config file (e.g. /path/to/cfg/wss-unified-agent.cfg). We put a prepared one inside folderesources. If you need any special modification, go toresources/wss-unified-agent.configsnyk (deprecated)Mode avaliablecmd: supportupload: supportPrerequisiteinstall snyk command line tool in the local environment usingnpm install -g snykhttps://support.snyk.io/hc/en-us/articles/360003812538-Install-the-Snyk-CLI#UUID-b346a6dc-682a-471f-bdc2-a82d8e5f8b6esee if snyk is successfully installedsnyk versionEnvironment VariablesSNYK_USR_TOKEN: can be retrieved from personal setting:https://app.snyk.io/manage/integrationsSNYK_ORG_ID: can be retrieved from personal settingSNYK_INTEGRATION_ID: can be retrieved from personal settingscantistMode avaliablecmd: supportupload: not supportPrerequisitedownload scantist-bom-detect.jar fromhttps://scripts.scantist.com/staging/scantist-bom-detect.jarEnvironment VariablesSCANTIST_EMAIL: scantist account emailSCANTIST_PSW: scantist account passwordSCANTIST_BASEURL: target base url, default to "https://api-staging.scantist.io/"SCANTIST_SBD_HOME: path to scantist-bom-detect.jar