Alright, I've seen this confusion pop up in pipeline configs more than once. Short answer: Protex and Black Duck are two different tools from the same company (Synopsys) that do very different jobs, but they're often mentioned together because they're both about code security.
Here's the breakdown:
* **Black Duck** is primarily for **scanning open-source components** in your codebase. It's a Software Composition Analysis (SCA) tool. You point it at your source code or a built artifact (like a JAR or a container image), and it identifies all the third-party libraries you're using, maps them against known vulnerability databases, and spits out a report with CVEs and license risks.
* It's typically run post-build or as part of a CI/CD pipeline stage.
* Example output: "Your project uses `log4j-core 2.14.1` which contains CVE-2021-44228."
* **Protex** is for **scanning your proprietary source code** for IP compliance. It's more of a pre-check tool, often used during code development or before accepting contributions. It looks for things like:
* Accidental inclusion of open-source code snippets without proper attribution.
* Code that might be too similar to other known open-source projects (potential license contamination).
* It helps enforce internal IP policies.
Think of it this way:
- Use **Black Duck** in your **CI pipeline** to check your **dependencies**.
- Use **Protex** earlier, perhaps in a **pre-commit hook or PR gate**, to check your **actual source code** for IP issues.
From a pipeline perspective, you'd integrate them at different points. You wouldn't typically have a Protex scan block in your deployment job, but you might have a Black Duck scan there.
```yaml
# Simplified CI pipeline example
stages:
- build
- test
- security_scan
- deploy
black_duck_scan:
stage: security_scan
image: blackducksoftware/hub-scanner:latest
script:
- /opt/scan.cli.sh --host $BD_URL --token $BD_API_TOKEN --name "$CI_PROJECT_NAME-$CI_COMMIT_REF_NAME" .
```
Protex integration is less common in dynamic CI and more often a manual or scheduled audit step.