SourceClear CI Script Usage

SourceClear Software Composition Analysis

The following guide provides options for customizing the usage of the CI script for all integrations. For all CI script usage, the SRCCLR_API_TOKEN environment variable must be set in order to successfully authenticate for scanning.

Custom SourceClear Agent Commands

The default functionality of the CI script used in the curl -sSL https://download.sourceclear.com/ci.sh | bash command is to run the srcclr scanagent command in the current directory. Users can optionally specify their own custom command by appending -s -- <agent_commands> to the curl command. The following are examples usage of customized SourceClear commands with the CI script:

The CLI equivalent of:
srcclr test --maven"
curl -sSL  https://download.sourceclear.com/ci.sh | bash -s -- test --maven

The CLI equivalent of:

 srcclr scan --url https://github.com/srcclr/example-ruby --no-upload
curl -sSL  https://download.sourceclear.com/ci.sh | bash -s -- --url https://github.com/srcclr/example-ruby --no-upload

Environment Variables

The following environment variables can be used in the scanning environment to enable various features when scanning in your development pipeline with the following shell command: curl -sSL https://download.sourceclear.com/ci.sh | bash.

DEBUG

Description: When enabled, provides more verbose output during the scan. The default value for this is 0, or “off”.

Possible Values: 0 to disable, 1 to enable

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | DEBUG=1 bash

OR

export DEBUG=1
curl -sSL  https://download.sourceclear.com/ci.sh | bash

NOCACHE

Description: When enabled, the SourceClear agent will not be cached when the curl command is run. The default value for this is 0, or “off”.

Possible Values: 0 to disable, 1 to enable

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | NOCACHE=1 bash

OR

export NOCACHE=1
curl -sSL  https://download.sourceclear.com/ci.sh | bash

CACHE_DIR

Description: Allows the user to specify which directory location to store the SourceClear agent. The default value for this is the /tmp directory.

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | CACHE_DIR="/home/applications" bash

OR

export CACHE_DIR="/home/applications"
curl -sSL  https://download.sourceclear.com/ci.sh | bash

NOSCAN

Description: When enabled, the SourceClear agent will not perform a scan on the repository. The default value for this is 0, or “off”.

Possible Values: 0 to disable, 1 to enable

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | NOSCAN=1 bash

OR

export NOSCAN=1
curl -sSL  https://download.sourceclear.com/ci.sh | bash

SCAN_DIR

Description: Allows the user to specify which directory location to scan. The default value for this is the directory in which the curl command is run from.

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | SCAN_DIR="./path/to/dir" bash

OR

export SCAN_DIR="./path/to/dir"
curl -sSL  https://download.sourceclear.com/ci.sh | bash

SRCCLR_CI_JSON

Description: When enabled, the SourceClear agent will output the scan results in JSON format. The default value for this is 0, or “off”.

Possible Values: 0 to disable, 1 to enable

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | SRCCLR_CI_JSON=1 bash

OR

export SRCCLR_CI_JSON=1
curl -sSL  https://download.sourceclear.com/ci.sh | bash

CUSTOM_JRE_DIR

Description: Allows the user to specify which JRE to use for the SourceClear agent. The default functionality for SourceClear is to provide supported JRE’s for both Debian based and OSX operating systems. Specifying this value enables other operating systems to utilize SourceClear.

Example:

curl -sSL  https://download.sourceclear.com/ci.sh | CUSTOM_JRE_DIR=/opt/jdk/jre/lib/amd64 bash

OR

export CUSTOM_JRE_DIR=/opt/jdk/jre/lib/amd64
curl -sSL  https://download.sourceclear.com/ci.sh | bash