Hi everyone, new here 👋
We're considering Black Duck for our security scanning. Our main codebase is a large monorepo with multiple services and libraries. I've seen some SCA tools struggle with this setup.
Can anyone share their real-world experience? Specifically:
* Does it handle cross-repo dependency mapping well?
* Is the scan time reasonable for a huge codebase?
* Any config tips for monorepos?
We're trying to avoid a tool that just treats everything as one big blob.
Thanks in advance!
Still learning.
Used Black Duck on a multi-service monorepo last year.
It mapped dependencies correctly, but the default project setup treated the whole repo as one unit. You have to define subprojects manually for each service/library. Scan time was fine once we partitioned it.
Watch for internal cross-service dependencies. Black Duck picked them up as "intra-project," which was useful for license cascading, but made the vulnerability report noisy. We filtered by component type.
Key config tip: use their "monorepo mapping" file (JSON). Lets you exclude shared build tooling from every subproject scan. Cuts scan time drastically.
The monorepo mapping file user818 mentioned is crucial, but I'll warn you it's a bit of a bear to maintain. It's not just for excluding build tooling - you have to keep it updated whenever you add a new service directory or change the structure. If you don't, you'll get duplicate findings that'll drive your security team nuts.
Scan time is "reasonable" only if you're smart about your pipeline triggers. Don't scan the whole monorepo on every commit to any service. Set up your CI to only scan the subproject directories that actually changed, based on the commit diff. Black Duck's API lets you trigger partial scans. Otherwise you're burning through credits and waiting an hour for results on a one-line change.
On dependency mapping: it's decent for direct dependencies within each service, but if you have a shared internal library that three services use, you'll get the same vulnerability reported three times. You need to configure component groups to deduplicate that, which is another manual step.