Audit Process

Estimation instructions

Please read completely.

1. Prerequisites

Proceed to the next steps only if:

• You have completed and returned the “OSS Scoping Instructions and Questionnaire” document.
• You have talked to one of our Project Managers to confirm the scope of the assessment.

2. Gather the files

You should have received specific directions from our Project Manager as to what files to include for the assessment. If you have not, consider the general guidelines below:

Our assessment is based on a static analysis of your code. We do not compile, build, or deploy applications. So we ask that you assemble a codebase that includes the following artifacts:

• All text-readable source code, both homegrown and third party (commercial or open source)
• Third-party pre-compiled libraries (Note: We do not need the source code for these libraries)

Do NOT include:

• Build tools and scripts, unless these are also distributed
• The binaries produced by your build process

3. Download and run the Code Estimation Tool

The CET records the size of your codebases to help us determine the scope of the audit. Instructions for selecting and running the CET are below. Return the output file to us for processing.

Note: The CET records the number of files, their file extensions, and their sizes. Importantly, it doesn’t gather or store any file details other than count, type, and size. This information helps us estimate the complexity of the project and the length of time it will require.

Command line tool (recommended)

Download file: BD_CET-2.1.0.0.zip (3.3 MB)

Supports all operating systems

(Java-based—JRE 7 or later is required)

Windows

• Open File Explorer and navigate to the folder where bd_cet is unzipped.
• In the File Explorer address bar, type “cmd” to open a command prompt.
• In the command prompt, type the following command to run the CET:

bd_cet.bat –d <path/to/scan/dir> –f <name_of_output_file>

Unix / Linux / Mac platforms

• Open a terminal and navigate to the folder where bd_cet is unzipped.
• Type the following command to run the CET:

bd_cet.sh –d <path/to/scan/dir> –f <name_of_output_file>

Alternative solutions

Use one of these solutions if you encounter problems with the command line tool.

Windows installer

Download file: blackduck-bdspest-windows_09-26-2013.zip (45.37 MB)

Supports Windows® XP/2003/2008 R2/Vista/Windows 7/Windows 8 (some versions of Windows 8 may not be supported)

• Double-click on the downloaded file and follow the instructions to install the CET.
• Run the CET from the location where you installed it. It will prompt you for the path name where the codebase to be audited resides.
• Click “Begin Scan.”
• When the results are displayed, save the output as HTML. Do not save as a PDF or edit this file.

Note: If you encounter an unsupported Windows problem, try installing the tool in Compatibility Mode. Right-click on the install executable file, select “Properties,” go to the “Compatibility” tab, and set it to run in Compatibility Mode for Windows 7.

Perl script (requires Perl interpreter)

Download file: bdsest-201.zip (3 KB)

Supports all operating systems

• If Perl is not already installed on your system, download it from https://www.perl.org/get.html.
• The Perl script does not offer output options. Save the output as a plain text file. Do not edit this file.

4. Archive the codebases

We strongly recommend you save the codebases you analyzed with the CET as we will run our analysis on them. Note: Saving the codebases in archives can save time and effort at the start of the audit work.