Spectra Assure scanning guidelines
Software packages come in many formats, but they all serve the same purpose: distributing software.
A software package type is a broad category of files that share the same packaging format and overall structure. Rather than referring to a specific ecosystem or vendor, it describes a family of packages. Even though packages of the same type may contain completely different software, they are organized in similar ways.
The same security checks can be applied to every package type, but differences in how packages are organized and what they contain determine how they are analyzed. Before analysis begins, Spectra Assure identifies the package type and applies the processing needed to expose its contents. Depending on the package type, this may involve unpacking archives, mounting file systems, parsing metadata, or reading files directly. Once the package has been processed, each file and component is analyzed according to its type.
This page explains the concepts shared across package types before introducing detailed scanning guides for each supported format.
When to scan a package
Software packages can be scanned at any point in the software development lifecycle (SDLC), and the same package may be analyzed multiple times as it moves through the software supply chain.
However, users get the greatest benefit from scanning packages as early as possible. Identifying malware, tampering, embedded secrets, and vulnerable components before deployment allows issues to be addressed while remediation is still fast and inexpensive.
Because the analysis is performed directly on the package, it can be scanned without first deploying or running it. This makes package scanning well-suited for automated security checks throughout the software development lifecycle, including CI/CD pipelines.
Source and binary distributions
Before looking at specific package types, it helps to understand one distinction between source and binary distributions. Both represent the same software, but package it differently, exposing different information to Spectra Assure.
A source distribution includes the original source code together with the build scripts, configuration files, metadata, and other resources required to build or install the package.
These files are human-readable, so they can be inspected directly.
An example of this would be a Python source distribution (sdist) containing .py source files, data files, and packaging metadata.
A binary distribution includes prebuilt artifacts together with the resources and metadata needed to install or run the software.
The software has already been compiled, so it can typically be installed without rebuilding from source.
An example of this would be a Python wheel (.whl) containing packaged Python modules, compiled extensions (if any), and package metadata.
Source and binary distributions expose different contents, which means that Spectra Assure processes and analyzes them differently. Source distributions allow direct inspection of source code and build files, while binary distributions require analysis of packaged binaries, metadata, and other distributed artifacts using techniques appropriate to the compiled form.
Neither distribution format is inherently safer than the other. Malicious functionality can be introduced through source code, build or installation scripts, package metadata, or compiled binaries.
Regardless of the distribution format, Spectra Assure analyzes packages for the same types of security issues. The difference lies in the package contents available for analysis and the techniques used to inspect them.
Example: scanning installers vs. downloaders
Some software is distributed as a downloader rather than a complete installer. A downloader contains only the logic needed to retrieve the actual installation package from the internet when it is run.
The downloader does not contain the software it installs, so scanning it only reveals the downloader itself, not the application that ultimately ends up on the system. The downloaded contents may also vary depending on the version, platform, configuration, or time of installation, so the scan cannot provide a complete picture of the software being deployed.
Whenever possible, scan the enterprise installer (also called the offline installer) instead. Unlike a downloader, an offline installer contains the application and its dependencies within the package itself, allowing Spectra Assure to analyze the software that will actually be installed.
Scanning the complete installer provides a more comprehensive assessment of the application security posture, including its software components, dependencies, vulnerabilities, malware, embedded secrets, and other security risks.
Scanning guides for different software package types
Even though the same analysis is performed for every package type, the way a package is processed depends on its format. The guides below explain how Spectra Assure applies that workflow to each supported package type.