The `blackduck` library provides Python bindings for interacting with the Synopsys Black Duck Hub REST API. It allows users to automate tasks such as fetching project information, managing vulnerabilities, and integrating with Black Duck's security and compliance features. The current version is 1.1.3, released on April 19, 2024. While functionally stable, the project's release cadence appears to be slow, with no new PyPI versions in the past two years, suggesting a maintenance-focused status.
pip install blackduckVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to initialize the `Client` and fetch a list of projects. It expects `BLACKDUCK_URL` and `BLACKDUCK_TOKEN` to be set as environment variables for secure authentication. The `Client` automatically handles API pagination.
Migrate all API interactions to use the `Client` class, which correctly handles pagination.
Switch to using the `blackduck.Client` class for all new and existing integrations.
Configure Black Duck URL and API token via environment variables `BLACKDUCK_URL` and `BLACKDUCK_TOKEN` respectively, and ensure the `Client` is initialized using these values.
Monitor the GitHub repository for activity and upcoming releases (v1.1.4 has been mentioned). Exercise caution regarding the responsiveness to new issues or feature requests if the release cadence remains slow.
Consult Black Duck Detect's Python support documentation. Ensure Python, pip executables, and `requirements.txt`/`pyproject.toml` files are correctly identified and that Detect is run within the appropriate virtual environment if applicable.
Install the library using pip: `pip install blackduck`
For development/testing (use with caution in production), disable SSL verification: `bd = blackduck.HubRestApi(base_url=BLACKDUCK_URL, token=BLACKDUCK_TOKEN, insecure=True)`. Alternatively, ensure your Python environment's certificate store is updated or explicitly trust the Black Duck server's certificate.
Verify the Black Duck Hub URL and port are correct and reachable from the client machine. Check firewall rules, proxy settings (and configure them in `blackduck` if necessary, e.g., `proxies={'http': 'http://your_proxy:port', 'https': 'http://your_proxy:port'}`), and DNS resolution.Ensure the Black Duck API token belongs to a user with the appropriate roles (e.g., Global Code Scanner, Project Code Scanner, BOM Manager) for the actions being attempted. Generate a new token if permissions are suspected to be incorrect or expired.