Skip to content

The Java "securing build time" page is incomplete. #2

@JoeBeeContrast

Description

@JoeBeeContrast

The Java documentation is incomplete. I strongly doubt anyone outside of contrast would be able to use this to successfully run the CLI tool on a Java build.

There are two commands listed.
npm install -g @contrast/contrast-cli
which installs the cli
and
contrast-cli --yamlPath scan.yaml
Which does, nothing...
Before this there is no reference to a scan.yaml file, or what it should contain.

This page should contain step by step instructions on how you setup the cli to generate a scan/sbom. With the only thing you need is to drop in your api key/auth token. And there should be instructions on how you get those.
Also example Java application, such as https://github.com/Contrast-Security-OSS/vulnerable-spring-boot-application with an example of the build integration would also be very useful. With examples for gradle and maven.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions