JFrog Xray works with JFrog Artifactory to perform universal analysis of binary software components at any stage of the application lifecycle.
The WhiteSource Xray integration is a vulnerability feed that can be easily integrated with your Xray account.
In order to integrate WhiteSource with JFrog Xray, simply add your WhitesSource organization API key to your Xray configuration.
Setting Up the WhiteSource Integration
- Login to JFrog Xray with administrator permissions. From the main menu, select Admin → Configuration → Integrations.
The integration pop-up window appears. Select the WhiteSource icon from the integration list, and enter the WhiteSource API key in the 'API Token' field.
The test URL is https://saas.whitesourcesoftware.com/xray/api/checkauth or in Azure EU https://app-eu.whitesourcesoftware.com/xray/api/checkauth.
Testing & Saving the Integration
- Click on the 'Test' button to validate that the integration is configured properly. A confirmation message should appear indicating that the API key is valid.
- Click on the 'Save' button.
Viewing Security Vulnerabilities
Once integrated, Xray starts pulling data from WhiteSource based on your watches (rules).
WhiteSource provides all relevant information about security vulnerabilities (severity, impacted versions and actionable remediation suggestions), and known severe software bugs for each of the displayed open source components. To view vulnerabilities:
- Go to the Security tab of a specific package as displayed in the following screenshot:
- Select a specific component in order to view details on the security vulnerability.