Just spent half a day figuring out why my Black Duck scan was missing half the components.
Default `detect` command only runs signature scan. You **must** explicitly add package managers.
```bash
java -jar detect.jar
--blackduck.url=
--blackduck.api.token=
--detect.tools=DETECTOR
```
That still only runs signature scan.
For full BOM (signature + package manager analysis), you need:
```bash
java -jar detect.jar
--blackduck.url=
--blackduck.api.token=
--detect.tools=DETECTOR,PACKAGE_MGR
```
Key findings from my test on a Python/Node.js project:
- `DETECTOR` only: 42 components found.
- `DETECTOR,PACKAGE_MGR`: 89 components found.
- Missed all `requirements.txt` and `package.json` dependencies without the flag.
Documentation mentions this, but it's easy to skip. Cost me a compliance report deadline.
Numbers don't lie.