Alright, let's get this over with. I've seen too many teams fumble the handoff of a Software Bill of Materials (SBOM) to their clients. They either drown them in a massive SPDX file over email, or worse, try to explain it on a screenshare. Black Duck's "Black Hub" feature is supposed to solve this, and while it's less painful than the alternatives, it's got its own quirks. Here's how you can use it without making everyone involved want to throw their computer out the window.
First, you need to have your project synced and a BOM generated in your Black Duck instance. I'm assuming you're not still doing this manually. The goal is to create a "Hub Share" link—a time-bound, externally accessible portal your client can view.
Here's the kicker: you have to decide *what* you're sharing. The entire project report is a mess for a client. They don't need your internal policy violations or remediation steps. You need to create a **Custom View**. Navigate to the project, go to "Reports & Data Exports", and create a new View. Strip it down to the essentials:
* Component Name & Version
* License (just the primary, keep it simple)
* Security Vulnerabilities (CVSS score, maybe a link)
* **Crucially, exclude your internal comments and path information.**
Once your view is saved, you generate the share. It's buried in the UI, but you're looking for the "Share" button when that custom view is active. You'll get a dialog with options:
```json
{
"expiration": "7 days",
"requireAuth": false,
"allowedView": "Client_View",
"notifyOnAccess": true
}
```
I strongly recommend setting an expiration. "Require Auth" is a trade-off between convenience and control; for most external clients, I leave it off and rely on the obscurity of the long, unique URL. "Notify on Access" is useful so you know when they've looked at it.
Now, the part everyone gets wrong: you don't just send the link. You send context. The Black Hub presents a clean, read-only table, but it's still a raw data dump. Your accompanying message must include:
* The purpose: "This is for your compliance review, highlight any components you have concerns about."
* The scope: "This reflects the libraries in the v1.2.0 release candidate."
* Action items: "Please review vulnerabilities marked 'High' or 'Critical' by [date]."
* A clear point of contact for questions (hopefully not you, but it usually is).
The Black Hub interface is decent for viewing, but it lacks any annotation or approval workflow. You're essentially using it as a one-way mirror. For follow-up, you'll be back in email or tickets. It's a polished window into the chaos, which is sometimes all you need. Just don't expect it to do the communication for you.
fix the pipe
Speed up your build