...
| Table of Contents |
|---|
Overview
This
...
The Mend Bolt extension enables you to do the following:
Detect and remediate vulnerable open source components
Generate a comprehensive open-source inventory report per build
Enforce open source license compliance, including dependencies’ licenses
NOTE: Mend only stores and generates a report for the latest build data of a particular pipeline definition.
Support for Languages and Package Managers
Mend Bolt supports languages and package managers that are supported today by the Unified Agent (over 200 languages).
Note the following limitations:
Docker image scanning is not supported.
Prerequisites
Ensure the following:
...
Your Azure DevOps organization is connected to an Azure Active Directory via Organization Settings > Azure Active Directory.
...
You do not have any existing Mend extensions installed. If so, these must be uninstalled.
...
page
...
If you are using a self-hosted build agent, note that running it behind a web proxy is not currently supported.
...
The relevant package manager used by your project is installed.
Installing the Extension
To install the extension, do as follows:
Click here to access the Visual Studio Marketplace. The Mend Bolt extension page is displayed.
Click Get it free and follow the installation procedure.
Activating the Extension
To activate the extension, do as follows:
After installing the extension, navigate to Organization Settings > Extensions > Mend within your Azure DevOps organization.
An activation form enabling you to create your Mend account is displayed. Enter the following details:
First name
Last name
Work email
Company name
Phone Number (optional)
Country
Click Create Account.
Adding a Mend Bolt Build Task to Your Pipeline
To add a Mend Bolt build task to your existing pipeline, do as follows:
Go to the relevant Azure DevOps project for which you want Mend Bolt to run.
Inside your Azure DevOps project, from the sidebar, click Pipelines. The Pipelines page is displayed.
Click the relevant pipeline. The specific pipeline page is displayed.
Click Edit. Do one of the following procedures:
This activates the Mend integration on your build pipeline.
NOTE: Adding a pre-step build task is not necessary in order for Mend to successfully scan the build repository. Mend by default runs a pre-step command as part of the Mend Bolt task.
Adding a Build Task to a YAML Pipeline
In the pipeline edit page, from the right side, click Show assistant. The Tasks sidebar is displayed.
In the search bar, enter Mend. The Mend task is displayed.
Click the Mend Bolt task.
From the bottom right corner, click Add. The Mend Bolt task is added to the pipeline.
Code Block - task: Mend@21 inputs: cwd: '$(System.DefaultWorkingDirectory)'(Optional) To specify the name of the Mend project to be created in Mend Essentials, add the following to the Mend task. In the following example, replace
New_Project_Namewith the name you want to give your Mend project:
NOTE: You cannot change the project name after the first build run.Code Block - task: Mend@21 inputs: cwd: '$(System.DefaultWorkingDirectory)' projectName: 'New_Project_Name'Click Save & queue.
NOTE: The Mend task can be moved to other locations within the steps section, depending on your preferences.
Adding a Build Task to a Classic Pipeline
To add a task to the Agent Job, click the plus (“+”) sign next to the agent job section. The Add Tasks section is displayed.
In the search bar, enter Mend. The Mend Bolt task is displayed.
Click the Mend Bolt tab, and then click Add. The Mend Bolt task is added to the pipeline.
(Optional) To specify the name of the Mend project to be created, enter the name in the Project name field.
NOTE: You cannot change the project name after the first build run.Click Save & queue.
NOTE: The Mend task can be moved to other locations within the steps section, depending on your preferences.
Viewing the Mend Bolt Report
The Mend Bolt report is available on a pipeline build level and it comprises 3 tabs: Inventory, Security Vulnerabilities, and License Risks. You can view the Mend report at a build or project level (aggregated report of all your builds).
Viewing the Report
To view the report, do as follows:
Ensure that you followed the procedures in Activating the Extension and Adding a Mend Bolt Build Task to Your Pipeline.
Go to the specific build’s results page for your project, and click the Mend Bolt tab. The Mend open source risk report is displayed.
Understanding the Report
...
Security Summary
A summary of detected open source vulnerabilities and the libraries that contain them.
...
Name
...
Description
...
Vulnerability Risk
...
The overall risk level for your inventory. Can be High, Medium, Low, No Risk.
...
Vulnerable Libraries
...
Displays the total number of vulnerable libraries.
...
Severity Distribution
...
Provides a breakdown of the vulnerabilities according to their severity level.
Inventory Tab
An inventory of all open source libraries detected.
...
Name
...
Description
...
Library
...
The name of the open-source library linking to the Library Details page in the Mend Essentials application.
...
Licenses
...
Lists licenses detected for each library, and links to their license descriptions.
Security Vulnerabilities
A table listing all security vulnerabilities.
...
Name
...
Description
...
Severity
...
The severity of the vulnerability. Consists of:
Severity level- H (high), M (medium), L (low).
CVSS score
...
Vulnerability
...
The vulnerability identifier linking to the Mend vulnerability lab, containing more information.
...
Date
...
The vulnerability publish date.
...
Library
...
The name of the open-source library containing the vulnerability, linking to the Library Details page in the Mend Essentials application.
...
Top Fix
...
The top-rated remediation advice that Mend recommends for each vulnerability. A condensed description of the recommended course of action is given, followed by a link to a broader description.
License Risks
The License Risk Table displays a summary of open-source components’ license types and their associated risk including the number of occurrences.
...
Name
...
Description
...
License
...
The license detected as part of the inventory linking to its license description.
...
Risk
...
The risk associated with the license. Values are H (high), M (medium), L (low). In case of unknown risk, no risk is displayed.
...
Occurrences
...
In how many libraries this license occurs.
Additionally, the following charts are displayed:
...
The License Distribution chart displays the distribution of licenses across the inventory.
...
is available in Mend’s new Knowledge Hub, here: Mend Bolt for Azure Pipelines