WhiteSource is the leader in continuous open source software security and compliance management. WhiteSource integrates into your build process, irrespective of your programming languages, build tools, or development environments. It works automatically, continuously, and silently in the background, checking the security, licensing, and quality of your open source components against WhiteSource constantly-updated deﬁnitive database of open source repositories.
WhiteSource provides WhiteSource Bolt, a lightweight open source security and management solution developed specifically for integration with Azure DevOps and Azure DevOps Server. It works per project and does not offer real-time alert capabilities like the Full platform which is generally recommended for larger development teams, wanting to automate their open source management throughout the entire software development lifecycle (from the repositories to post-deployment stages) and across all projects and products.
What’s covered in this lab
This lab shows how you can use WhiteSource Bolt with Azure DevOps to automatically detect alerts on vulnerable open source components, outdated libraries, and license compliance issues in your code. You will be using WebGoat, a deliberately insecure web application, maintained by OWASP designed to teach web application security lessons.
Azure DevOps integration with WhiteSource Bolt will enable you to:
- Detect and remedy vulnerable open source components.
- Generate comprehensive open source inventory reports per project or build.
- Enforce open source license compliance, including dependencies’ licenses.
- Identify outdated open source libraries with recommendations to update.
Before you begin
Refer the Getting Started page before you follow the exercises.
Use Azure DevOps Demo Generator to provision the WhiteSource project on your Azure DevOps Organization.
Exercise 1: Activate WhiteSource Bolt
In your Azure DevOps Project, under Pipelines section, go to White Source Bolt tab, provide your Work Email, Company Name and click Get Started button to start using the Free version.
Upon activation, the below message is displayed.
Exercise 2: Trigger a build
You have a Java code provisioned by the Azure DevOps demo generator. You will use WhiteSource Bolt extension to check the vulnerable components present in this code.
Go to Pipelines section under Pipelines tab, select the build definition WhiteSourceBolt and click on Run pipeline to trigger a build. Click Run (leave defaults).Note: We also have a YAML build pipeline if that’s something you’re interested in. To proceed through the YAML pipeline, choose WhiteSourceBolt-YAML and click Edit to view the YAML pipeline.
To view the build in progress status, click on job named Phase 1.
While the build is in progress, let’s explore the build definition. The tasks that are used in the build definition are listed in the table below.
Tasks Usage npm Installs and publishes npm packages required for the build Maven builds Java code with the provided pom xml file WhiteSource Bolt scans the code in the provided working directory/root directory to detect security vulnerabilities, problematic open source licenses Copy Files copies the resulting JAR files from the source to the destination folder using match patterns Publish Build Artifacts publishes the artifacts produced by the build
Once the build is completed, click back navigation to see the summary which shows Test results, Build artifacts etc. as shown below.
Navigate to WhiteSource Bolt Build Report tab and wait for the report generation of the completed build to see the vulnerability report.
Exercise 3: Analyze Reports
WhiteSource bolt automatically detects OpenSource components in the software including transitive dependencies and their respective licenses.
The security dashboard shows the vulnerability of the build. This report shows the list of all vulnerable open source components with Vulnerability Score, Vulnerable Libraries, Severity Distribution.
You can see the opensource license distribution and a detailed view of all components and links to their metadata and licensed references.
WhiteSource Bolt also tracks outdated libraries in the project, getting all the detailed information and links to newer versions and recommendations.
With Azure DevOps and WhiteSource Bolt integration, you can shift-left your open source management. The integration allows you to have alerts in real time, on vulnerabilities and other issues to help you take immediate action.