Safety through commandline.
debricked.com »
debricked is Debricked's command line interface. It brings open source security, compliance and health to your
project via the command prompt.
This readme is specific for the use case of scanning Open Source with Debricked through Fortify on Demand.
If you are interested in the readme for Debricked standalone, it can be found here.
Check out the releases page. Choose the asset that is applicable for your system. Below follow some common ways to install the CLI.
curl -L https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked./debrickedcurl -L https://github.com/debricked/cli/releases/download/release-v2/cli_macOS_arm64.tar.gz | tar -xz debricked./debricked- Download zip
- Unpack zip
.\debrickeddocker pull debricked/cliIf you're looking to scan your Open Source dependencies with Debricked through Fortify on Demand,
the Debricked CLI makes the preparation of your payload easy through the debricked resolve command.
Note: Unlike scanning your open source through Debricked standalone, where the
debricked scancommand can be used, initating a scan through FoD is not possible using the Debricked CLI. You should therefore not use "debricked scan" as a user of FoD.
Lock file resolution is the process of using the dependencies requested in a manifest file (which most often is restricted to the direct dependencies of the project) to generate a lock file, containing all direct and indirect/transitive dependencies with locked versions, as well as the relations between the dependencies.
Getting the complete information for all dependencies, with versions and their relations is important to ensure that Debricked can make a complete and accurate analysis of the project. It will also ensure that the generated SBOM is accurate and that the suggestions made for remediating potential issues are correct.
Many package managers have support for building and maintaining native lock files from manifest files, while others do not. In most of these cases, there are still native commands that can be used to produce the same information.
Once you've installed the CLI, you simply use debricked resolve to have Debricked generate the needed lock files for scanning, using FoD. The command identifies all eligible files in the current directory/payload and runs the necessary commands to generate the lock files.
Debricked resolves into native lock files where possible, but uses custom Debricked lock formats when needed. To resolve manifest files (such as package.json and build.gradle) into lock files (eg. yarn.lock and the Debricked lock format gradle.debricked.lock), native commands from the package managers are used, such as yarn install and gradle dependencies.
It is therefore important that the package managers are installed, with the right versions, wherever you run the debricked resolve command. The best way to achieve this is to run it in a development or build environment.
When the resolution is complete, you will see the list of files that were resolved. If the resolution were to fail, descriptive error messages from the respective package manager will be shown in the output.
For more information on how resolution works, check out https://docs.debricked.com/tools-and-integrations/cli/debricked-cli/high-performance-scans.
If a dependency is hosted on a private registry some configuration may be needed, depending on package manager. For more details see package manager specific resolution README files in the specific package manager folder or search the documentation of your package manager of choice.
If you would rather use debricked in your CI/CD pipelines, you can check out the templates for inspiration, replacing scan with resolve.
Thank you for your interest in making Debricked CLI even better! Read more about contributing to the project here.
Also, make sure to check out the Debricked Portal. There, you can share your great ideas with us!