Initiating a Scan

A WhiteSource scan is initiated via a valid GitLab push command. A valid push command meets at least one of the following requirements:

• One of the commits in the push command added/removed a source file(s) that has an extension supported by WhiteSource.
  Refer to the WhiteSource Languages page in order to find out whether or not a specific language and its extensions are supported. 

• One of the commits in the push command includes an addition/modification of the package manager dependency file(s).
  Refer to the list of supported dependency files to find out whether your dependency files are supported.

NOTE: a push command may consist of multiple commits.

Viewing Details of the Scan

Results can be viewed in the following places:

• The Issues tab within the GitLab project.

• The WhiteSource Security/License Check within the GitHub project's Commits tab.

• The WhiteSource UI.

• Via email notifications.

• For GitLab Ultimate users:

  • The GitLab security dashboard

  • Pipeline reports

Viewing the Issues Tab

If you are performing Merge Requests or push commands via the Web browser, refresh your Web browser in order to view the issues that were generated by WhiteSource. NOTE: It may take a number of minutes for the issues to be scanned and displayed after a valid push command is initiated.

The Issues tab displays all the issues that the WhiteSource Integration detected with the red security vulnerability label. This proprietary label indicates a security vulnerability was detected by WhiteSource. 

As part of your workflow, you have the option to add a relevant label(s) to specific issues, and close issues that were resolved.

Issues that were manually closed will not be re-opened during future WhiteSource scans unless their label and/or name have been manually changed or changed via the GitLab API.

Viewing Details of an Issue

See here for more information.

Viewing WhiteSource Security Checks

Commit Status indicators are displayed for each head commit on the Commits sub-tab of the Project tab.

NOTE: The commit statuses above are the red X and the green check mark.

Clicking a specific indicator will redirect you to the relevant Commit page, where you can find the WhiteSource Security Check for the selected head commit in the Changes sub-tab, which contains a security report.

The security report displays all the vulnerabilities that were found in descending order according to the severity and CVSS score. The following information is displayed for each vulnerability:

• CVE: A link to the related CVE page for the vulnerability. Displayed in a collapsible format (click the arrow to expand/collapse for more information regarding the vulnerability).

• Severity: Overall score of the severity (High, Medium or Low).

• CVSS Score

• Vulnerable Library

• Suggested Fix 

• Issue: A link to the WhiteSource issue that was generated for the vulnerability.

Types of Indicators

The following commit status indicators are available as feedback on the head commits:

• Pending: The WhiteSource scan has not begun and is scheduled to begin.

• Running: The WhiteSource scan is in progress.

• Success: The WhiteSource scan completed successfully and no vulnerabilities were detected. 

• Failed: The WhiteSource scan did not complete successfully, this is the default for all completed scans. NOTE: a failed status may be shown due to security vulnerabilities, or due to an error that occurred during the scan.

Samples of Commit Status Indicators

Running

The following is a sample of a Running status, which indicates that the security check is currently scanning the head commit.

Success

When no vulnerabilities are found and no errors occurred during the scan, WhiteSource will display the following commit status, and a security report indicating that no vulnerabilities were detected:

Failed

All head commits that fail the scan due to the security check detecting vulnerabilities or due to an error that occurred during the scan will display a failed commit status.
The following screenshot displays a failure indicator for a head commit

Viewing WhiteSource License Checks

In the Commits tab you can view the status and results of each scan. Click a specific build icon in order to view the Builds page.

Types of Indicators

The following commit status indicators are available as feedback on the head commits:

• Success: No license policy violations were detected. 

• Failed: One or more license policy violations were detected during the WhiteSource scan.

Viewing Details in the WhiteSource UI

• In the WhiteSource UI, WhiteSource projects will have the same name as the corresponding GitLab repository, with a "GL_" prefix, unless otherwise specified in the .whitesource file using a project token.

• The name of the WhiteSource product will be the same as that of the GitLab group preceded by a "GL_" prefix if the GitLab project is under a group. Otherwise, the name will be your GitLab username preceded by "GL_".

Viewing the Security Dashboard

GitLab Ultimate users have access to GitLab’s security dashboard.

Vulnerabilities detected by WhiteSource for GitLab can be identified by their “ - Detected by WhiteSource” suffix.

Viewing Details of a Vulnerability in the Security Dashboard

• Description: A description of the vulnerability.

• Project: The GitLab project the vulnerability exists in.

• File: The manifest file the vulnerable dependency is declared in.

• Identifiers: The original identifier of the vulnerability.

• Severity: The vulnerability’s severity. Possible values are:

  • High

  • Medium

  • Low

• Confidence: How reliable this vulnerability’s assessment is.

  • Vulnerabilities detected by WhiteSource will always have “Confirmed” confidence.

• Report Type: The security report this vulnerability belongs to (SAST, DAST, dependency_scanning, etc.).

  • Vulnerabilities detected by WhiteSource will always have the “dependency_scanning” report type.

• Links: Any references to external documentation pieces or articles that describe the vulnerability further.

• Solution: An explanation of how to fix the vulnerability.

Viewing the Pipeline Reports

Pipeline reports can be viewed from the following places:

• Within the CI/CD pipeline by clicking CI/CD > Pipelines > Pipeline # > Security.

• Within MRs from feature branches to the main branch by clicking Expand in the Security Scanning section of the MR.