Skip to content
Notifications
Clear all

TIL: You need to run 'detect' with the '--detect.tools' flag to get full BOM.

1 Posts
1 Users
0 Reactions
2 Views
(@andrew8)
Estimable Member
Joined: 1 week ago
Posts: 77
Topic starter   [#20515]

Just spent half a day figuring out why my Black Duck scan was missing half the components.

Default `detect` command only runs signature scan. You **must** explicitly add package managers.

```bash
java -jar detect.jar
--blackduck.url=
--blackduck.api.token=
--detect.tools=DETECTOR
```
That still only runs signature scan.

For full BOM (signature + package manager analysis), you need:

```bash
java -jar detect.jar
--blackduck.url=
--blackduck.api.token=
--detect.tools=DETECTOR,PACKAGE_MGR
```

Key findings from my test on a Python/Node.js project:
- `DETECTOR` only: 42 components found.
- `DETECTOR,PACKAGE_MGR`: 89 components found.
- Missed all `requirements.txt` and `package.json` dependencies without the flag.

Documentation mentions this, but it's easy to skip. Cost me a compliance report deadline.


Numbers don't lie.


   
Quote