Frogs and Ducks, Your Sentinels for Open Source Security
summary
Shows three concrete integrations: a Xray data feed that layers Black Duck’s enhanced vulnerability database into JFrog Xray so critical CVEs (example: the Apache Struts timeline around Mar 5–10) appear earlier and include exploit links and remediation guidance; a Groovy-based build output scanner that cron-scans Artifactory developer uploads using evidence-based scanning plus declarative checks; and a CLI repo inspector (java -jar) that inspects a “golden” repo, uploads metadata to Hub and in the demo registers 21 artifacts.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:35CRA Strutz Vulnerability
- 8:02Black Duck
- 12:47Deploy
- 14:27Enhanced Vulnerability Data
- 18:02Build Output Scanner
- 24:02Repo Inspector
related talks
23mFrog-Proof Security: Streamlining The Sec In DevSecOps
18mGlobal security at maximum velocity: Multi-Region and hybrid DevSecOps
29mA journey of the thousand binaries
29mFrom Vulnerabilities to Vigilance
09mSpotlight on a New Feature of the JFrog Platform
14mDetect and Track the Zergs in Your Dependencies!
07mJFrog Sponsored Session - Narasimha Pai, JFrog
30mDefectDojo Project