Registry / devops / blackduck

blackduck

JSON →
library1.1.3pypypi✓ verified 85d ago

The `blackduck` library provides Python bindings for interacting with the Synopsys Black Duck Hub REST API. It allows users to automate tasks such as fetching project information, managing vulnerabilities, and integrating with Black Duck's security and compliance features. The current version is 1.1.3, released on April 19, 2024. While functionally stable, the project's release cadence appears to be slow, with no new PyPI versions in the past two years, suggesting a maintenance-focused status.

pip install blackduck
INSTALL
IMPORT
SIG · BLACKDUCK
B
blackduck
devopspythonv1.1.3
Install
2.3s avg
Import
635ms
Disk
20MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.1.3 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.940 runs
installs and imports cleanly · install 0.0s · import 0.669s · 22.3MB
glibc
py 3.103.940 runs
installs and imports cleanly · install 2.3s · import 0.602s · 23MB
20MB installed
● package 20MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Client
from blackduck import Client
from blackduck.HubRestApi import HubInstance
The `HubInstance` class is deprecated and does not support pagination introduced in Black Duck v2022.2. The `Client` class is the recommended and actively maintained interface.

This quickstart demonstrates how to initialize the `Client` and fetch a list of projects. It expects `BLACKDUCK_URL` and `BLACKDUCK_TOKEN` to be set as environment variables for secure authentication. The `Client` automatically handles API pagination.

import os from blackduck import Client import logging logging.basicConfig( level=logging.INFO, format="[%(asctime)s] {%(module)s:%(lineno)d} %(levelname)s - %(message)s" ) # Ensure BLACKDUCK_URL and BLACKDUCK_TOKEN environment variables are set bd_url = os.environ.get('BLACKDUCK_URL', '') bd_token = os.environ.get('BLACKDUCK_TOKEN', '') if not bd_url or not bd_token: print("Error: BLACKDUCK_URL and BLACKDUCK_TOKEN environment variables must be set.") # In a real application, you might raise an exception or exit exit(1) try: # Initialize the Black Duck Client bd = Client( token=bd_token, base_url=bd_url, # verify=False # Uncomment to disable TLS certificate verification (use with caution) ) print(f"Successfully connected to Black Duck at {bd_url}") print("Listing first 5 projects:") # Fetch and print project names (Client handles pagination automatically) projects = bd.get_resource(name='projects', limit=5) for project in projects: print(f"- {project.get('name')}") except Exception as e: print(f"An error occurred: {e}")
Debug
Known issues
breakingThe `HubInstance` interface, used in older versions, will break when connecting to Black Duck instances running v2022.2 or later due to the introduction of a max page size in the REST API. It does not provide automatic paging support.
fix
Migrate all API interactions to use the `Client` class, which correctly handles pagination.
affects: <1.0.0 (or any usage of HubInstance)
deprecatedThe `HubInstance` interface is deprecated and no longer maintained. Examples using it are not guaranteed to work and any related issues will be closed as 'Won't Fix'.
fix
Switch to using the `blackduck.Client` class for all new and existing integrations.
affects: All versions, but functionally broken from Black Duck v2022.2+
gotchaWhile some examples or older scripts might use a `.restconfig.json` file for configuration (e.g., `baseurl`, `api_token`), it is generally recommended to use environment variables (`BLACKDUCK_URL`, `BLACKDUCK_TOKEN`) for consistency and security in automated environments, especially for the `Client` class.
fix
Configure Black Duck URL and API token via environment variables `BLACKDUCK_URL` and `BLACKDUCK_TOKEN` respectively, and ensure the `Client` is initialized using these values.
affects: All versions
gotchaDespite version 1.1.3 being released on April 19, 2024, the PyPI package has not seen further updates in the last two years (as of April 15, 2026). Snyk reports the maintenance status as 'Inactive', suggesting a potentially low attention from maintainers for new releases, although the GitHub repository shows some recent activity and an upcoming v1.1.4.
fix
Monitor the GitHub repository for activity and upcoming releases (v1.1.4 has been mentioned). Exercise caution regarding the responsiveness to new issues or feature requests if the release cadence remains slow.
affects: 1.1.3 and older
gotchaWhen integrating with Black Duck Detect (a separate scanning tool, often used in conjunction with this library), ensure that Python environments (e.g., virtualenvs) and package managers (pip, pipenv, poetry) are correctly configured and accessible by Detect. Incorrect setup can lead to incomplete or no results for Python project scans.
fix
Consult Black Duck Detect's Python support documentation. Ensure Python, pip executables, and `requirements.txt`/`pyproject.toml` files are correctly identified and that Detect is run within the appropriate virtual environment if applicable.
affects: All versions (when used with Black Duck Detect)
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'blackduck'
The 'blackduck' library is not installed in the Python environment, or the Python interpreter cannot find it in its search path.
fix
Install the library using pip: `pip install blackduck`
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
The Python environment cannot verify the SSL certificate presented by the Black Duck Hub server, often due to self-signed certificates, corporate proxies, or an outdated certificate store.
fix
For development/testing (use with caution in production), disable SSL verification: `bd = blackduck.HubRestApi(base_url=BLACKDUCK_URL, token=BLACKDUCK_TOKEN, insecure=True)`. Alternatively, ensure your Python environment's certificate store is updated or explicitly trust the Black Duck server's certificate.
Max retries exceeded with URL / Failed to establish a new connection
The Python client failed to connect to the Black Duck Hub URL, often due to network issues, incorrect URL/port, firewall blocks, or proxy configuration problems.
fix
Verify the Black Duck Hub URL and port are correct and reachable from the client machine. Check firewall rules, proxy settings (and configure them in `blackduck` if necessary, e.g., `proxies={'http': 'http://your_proxy:port', 'https': 'http://your_proxy:port'}`), and DNS resolution.
HTTP Error 403 Forbidden
The provided authentication token or user credentials lack the necessary permissions to perform the requested operation on the Black Duck Hub.
fix
Ensure the Black Duck API token belongs to a user with the appropriate roles (e.g., Global Code Scanner, Project Code Scanner, BOM Manager) for the actions being attempted. Generate a new token if permissions are suspected to be incorrect or expired.
Upgrade
Version history
1.1.3latest on PyPI · released Apr 19, 2024
Audit
Dependencies
requestsrequiredHTTP client for API communication.
python-dateutilrequiredUtility for parsing and manipulating dates and times.
fastmcpoptionalOptional dependency for Model Context Protocol (MCP) integration.
Agent activity
25 hits · last 30 days
node
23
OpenAI (training)
1
Resources
blackduck — pip install blackduck · libregistry