Skip to content

Commit

Permalink
update readme
Browse files Browse the repository at this point in the history
  • Loading branch information
rl-devops committed Mar 28, 2024
1 parent d9bbb5e commit e1c5ba3
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 7 deletions.
12 changes: 6 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ If you're looking for a solution with more functionality out-of-the-box, try the

## What is rl-secure?

`rl-secure` is a CLI tool that's part of the [secure.software platform](https://www.secure.software/) - a new ReversingLabs solution for software supply chain protection.
`rl-secure` is a CLI tool that's part of the [Spectra Assure platform](https://www.reversinglabs.com/products/software-supply-chain-security) - a new ReversingLabs solution for software supply chain protection.

With `rl-secure`, you can:

Expand Down Expand Up @@ -76,13 +76,13 @@ The Base64-encoded license string and the site key must be provided to the actio
### Configure a package store

A package store is a special directory where `rl-secure` can permanently keep your analyzed build artifacts and their scan results.
When created, a package store is automatically organized into [a predefined structure](https://docs.secure.software/cli/commands/create#example-structure-of-a-package-store) where every analyzed artifact is registered as a **package version** and assigned a **package URL (PURL)** in the format `[pkg:type/]<project></package><@version>`.
When created, a package store is automatically organized into [a predefined structure](https://docs.secure.software/cli/commands/create#example-structure-of-a-package-store) where every analyzed artifact is registered as a **package version** and assigned a **package URL (purl)** in the format `[pkg:type/]<project></package><@version>`.

A package store is a prerequisite for [comparing build artifacts](#compare-artifacts) because the diff scan requires specifying artifacts by their PURLs and saving analysis results for each artifacts.
A package store is a prerequisite for [comparing build artifacts](#compare-artifacts) because the diff scan requires specifying artifacts by their package URLs and saving analysis results for each artifacts.

To configure a package store, use the `rl-store` parameter. This requires either a path on the runner (if only one runner is used) or a shared storage location with NFS or CIFS (if scanning will be performed on multiple runners). **Configuring a package store only make sense on self-hosted runners.**

When a package store is configured, you must provide the package URL (PURL) with the `rl-package-url` parameter when scanning an artifact to register it in the package store.
When a package store is configured, you must provide the package URL (purl) with the `rl-package-url` parameter when scanning an artifact to register it in the package store.
Likewise, if you want to use the `rl-package-url` parameter, you must also set the `rl-store`.


Expand All @@ -92,10 +92,10 @@ The `rl-secure` CLI and the `rl-scanner` Docker image both allow comparing the a
This comparison is also known as the **diff scan**.

To perform a diff scan, `rl-secure` needs to preserve the results of previous scans in a package store.
When using a package store, analysis results for every scanned artifact are accessible with the PURL in the format `<project>/<package>@<version>`.
When using a package store, analysis results for every scanned artifact are accessible with the package URL in the format `<project>/<package>@<version>`.
This lets you compare the scan results of an artifact against a previously scanned artifact in the same project and package.

To compare artifacts, use the `rl-diff-with` parameter when scanning an artifact to specify the PURL of a previous version to compare against.
To compare artifacts, use the `rl-diff-with` parameter when scanning an artifact to specify the package URL of a previous version to compare against.
The diff scan action will verify that the requested version was actually scanned before, and ignore the request for a diff scan if there are no results for the requested `<project>/<package>@<version>`.


Expand Down
2 changes: 1 addition & 1 deletion action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# action.yml
name: 'gh-action-rl-scanner-only'
author: 'ReversingLabs'
description: 'Scan an artifact with ReversingLabs secure.software CLI'
description: 'Scan an artifact with ReversingLabs Spectra Assure CLI'

branding:
icon: 'shield'
Expand Down

0 comments on commit e1c5ba3

Please sign in to comment.