Within the CI/CD pipeline by clicking CI/CD > Pipelines > Pipeline # > Security.
Within MRs from feature branches to the main branch by clicking Expand in the Security Scanning section of the MR.
A WhiteSource scan is initiated via a valid GitLab push command. A valid push command meets at least one of the following requirements:
One of the commits in the push command added/removed a source file(s) that has an extension supported by WhiteSource.
Refer to the WhiteSource Languages page in order to find out whether or not a specific language and its extensions are supported.
One of the commits in the push command includes an addition/modification of the package manager dependency file(s).
Refer to the list of supported dependency files to find out whether your dependency files are supported.
NOTE: a push command may consist of multiple commits.
Results can be viewed in the following places:
The Issues tab within the GitLab project.
The WhiteSource Security/License Check within the GitHub project's Commits tab.
The WhiteSource UI.
Via email notifications.
For GitLab Ultimate users:
The GitLab security dashboard
Pipeline reports
If you are performing Merge Requests or push commands via the Web browser, refresh your Web browser in order to view the issues that were generated by WhiteSource. NOTE: It may take a number of minutes for the issues to be scanned and displayed after a valid push command is initiated.
The Issues tab displays all the issues that the WhiteSource Integration detected with the red security vulnerability label. This proprietary label indicates a security vulnerability was detected by WhiteSource.
As part of your workflow, you have the option to add a relevant label(s) to specific issues, and close issues that were resolved.
Issues that were manually closed will not be re-opened during future WhiteSource scans unless their label and/or name have been manually changed or changed via the GitLab API.
See here for more information.
Commit Status indicators are displayed for each head commit on the Commits sub-tab of the Project tab.
NOTE: The commit statuses above are the red X and the green check mark.
Clicking a specific indicator will redirect you to the relevant Commit page, where you can find the WhiteSource Security Check for the selected head commit in the Changes sub-tab, which contains a security report.
The security report displays all the vulnerabilities that were found in descending order according to the severity and CVSS score. The following information is displayed for each vulnerability:
CVE: A link to the related CVE page for the vulnerability. Displayed in a collapsible format (click the arrow to expand/collapse for more information regarding the vulnerability).
Severity: Overall score of the severity (High, Medium or Low).
CVSS Score
Vulnerable Library
Suggested Fix
Issue: A link to the WhiteSource issue that was generated for the vulnerability.
The following commit status indicators are available as feedback on the head commits:
Pending: The WhiteSource scan has not begun and is scheduled to begin.
Running: The WhiteSource scan is in progress.
Success: The WhiteSource scan completed successfully and no vulnerabilities were detected.
Failed: The WhiteSource scan did not complete successfully, this is the default for all completed scans. NOTE: a failed status may be shown due to security vulnerabilities, or due to an error that occurred during the scan.
The following is a sample of a Running status, which indicates that the security check is currently scanning the head commit.
When no vulnerabilities are found and no errors occurred during the scan, WhiteSource will display the following commit status, and a security report indicating that no vulnerabilities were detected:
All head commits that fail the scan due to the security check detecting vulnerabilities or due to an error that occurred during the scan will display a failed commit status.
The following screenshot displays a failure indicator for a head commit
In the Commits tab you can view the status and results of each scan. Click a specific build icon in order to view the Builds page.
The following commit status indicators are available as feedback on the head commits:
Success: No license policy violations were detected.
Failed: One or more license policy violations were detected during the WhiteSource scan.
In the WhiteSource UI, WhiteSource projects will have the same name as the corresponding GitLab repository, with a "GL_" prefix, unless otherwise specified in the .whitesource file using a project token.
The name of the WhiteSource product will be the same as that of the GitLab group preceded by a "GL_" prefix if the GitLab project is under a group. Otherwise, the name will be your GitLab username preceded by "GL_".
GitLab Ultimate users have access to GitLab’s security dashboard.
Vulnerabilities detected by WhiteSource for GitLab can be identified by their “ - Detected by WhiteSource” suffix.
Description: A description of the vulnerability.
Project: The GitLab project the vulnerability exists in.
File: The manifest file the vulnerable dependency is declared in.
Identifiers: The original identifier of the vulnerability.
Severity: The vulnerability’s severity. Possible values are:
High
Medium
Low
Confidence: How reliable this vulnerability’s assessment is.
Vulnerabilities detected by WhiteSource will always have “Confirmed” confidence.
Report Type: The security report this vulnerability belongs to (SAST, DAST, dependency_scanning, etc.).
Vulnerabilities detected by WhiteSource will always have the “dependency_scanning” report type.
Links: Any references to external documentation pieces or articles that describe the vulnerability further.
Solution: An explanation of how to fix the vulnerability.
Pipeline reports can be viewed from the following places:
Within the CI/CD pipeline by clicking CI/CD > Pipelines > Pipeline # > Security.
Within MRs from feature branches to the main branch by clicking Expand in the Security Scanning section of the MR.