Spectra Assure Integrations

Learn more about supported CLI and Portal integrations, and choose the best one for your organization.

Continuous integration and continuous delivery (CI/CD) are essential to the modern software development lifecycle. To help you build and deliver secure software, ReversingLabs maintains official CI/CD integrations for Spectra Assure products that you can use in new and existing software development projects.

This page lists all official integrations for the Spectra Assure CLI and the Spectra Assure Portal.

To work with CLI integrations, you must be an existing user of the Spectra Assure CLI. To use the Portal integrations or the Portal API, you must have an active account on a Spectra Assure Portal instance.

Which integration should you use?

Spectra Assure integrations support a variety of use-cases, but it can be difficult to pick the best one if you're not yet familiar with all the products.

To find out which integrations we recommend for your use-case, answer the following few questions.

Your answers are not stored or sent anywhere, and you can refresh the page at any point to start over.

Is the software you want to analyze built by your organization?

YesNo

Choosing YES started the software producer decision branch

Is it OK to send software artifacts to ReversingLabs servers for analysis?

YesNo

Do you plan to automate scanning in your CI/CD pipelines?

YesNo

Do you want to automate scanning in your CI/CD pipelines?

YesNo

• Your use-case matches the Software Producer persona.
• Your answers indicate you don't want to send software artifacts to ReversingLabs and you don't need CI/CD automation. Based on this, we recommend you use the Spectra Assure CLI directly.

• Your use-case matches the Software Producer persona.
• Your answers indicate you can send software artifacts to ReversingLabs and you don't need CI/CD automation. Based on this, we recommend you use the Spectra Assure Portal UI.

• Your use-case matches the Software Producer persona.
• Your answers indicate you can send software artifacts to ReversingLabs and you plan to set up CI/CD automation. Based on this, we recommend several options that integrate with the Spectra Assure Portal. You can choose an integration depending on your preferred CI/CD tool.
• GitHub: use the Portal GitHub Action
• Azure DevOps Pipelines: use the Portal Azure DevOps extension
• Other tools: use the Portal Docker image

• Your use-case matches the Software Producer persona.
• Your answers indicate you cannot send software artifacts to ReversingLabs, but you plan to set up CI/CD automation. Based on this, we recommend several options that integrate with the Spectra Assure CLI. You can choose an integration depending on your preferred CI/CD tool.
• GitHub: use the CLI GitHub Action
• Azure DevOps Pipelines: use the CLI Azure DevOps extension
• Other tools: use the CLI Docker image

Choosing NO started the enterprise buyer decision branch

Can software artifacts be sent to ReversingLabs servers?

YesNo

• Your use-case matches the Enterprise Buyer persona.
• Your answers indicate you don't want to send software artifacts to ReversingLabs. Based on this, we recommend you use the Spectra Assure CLI directly.

Do you need to automate scanning in CI/CD pipelines?

YesNo

• Your use-case matches the Enterprise Buyer persona.
• Your answers indicate you don't need CI/CD automation. Based on this, we recommend you use the Spectra Assure Portal UI.

• Your use-case matches the Enterprise Buyer persona.
• Your answers indicate you can send software artifacts to ReversingLabs and you need automated scans in CI/CD pipelines. Based on this, we recommend several options that integrate with the Spectra Assure Portal.
• Portal API if you want to create custom workflows
• Portal SDK if you prefer a Python-based ready-made solution

Official Docker images

ReversingLabs provides official Docker images for easier automation and integration with CI/CD tools. The images are published on Docker Hub and based on Rocky Linux 9.

There are two official Spectra Assure Docker images:

• rl-scanner is primarily intended for Spectra Assure CLI users, as it closely aligns with the CLI workflows and makes it easier to deploy the CLI in various environments.
• rl-scanner-cloud is mainly for Spectra Assure Portal users who want to build their own integrations on top of the Portal features.

The following table lists more detailed differences between these two Docker images that should help you choose the most appropriate image for your use-case.

	rl-scanner	rl-scanner-cloud
Endpoint access	Connects to api.reversinglabs.com and data.reversinglabs.com	Connects to a user-specified Portal instance (my.secure.software/{server}/api)
Scanning	Software packages are scanned inside the Docker container, on the local system where the container is running.	Software packages are scanned in the cloud, on the Portal instance to which they are uploaded.
Password management	Users can provide passwords or (Base64-encoded) password list files to allow decrypting password-protected archives during the scan and getting complete analysis reports.	Not supported at this time. The analysis reports will indicate that the file content is protected by an unknown password.
Policy controls	If a permanent package store is used with the Docker image, users can modify policies through local configuration files.	Any existing policy configuration for the user's organization and group on the Portal automatically applies.
Reports	Users can choose the report format(s) they want to generate, and automatically save the reports to local storage or as pipeline artifacts.	Users can choose the report format(s) they want to generate and save them to local storage or as pipeline artifacts. The SAFE report (rl-html format) is always generated, but it's accessible only in the Portal web interface. By default, the direct link to the SAFE report on a Portal instance is included in the Docker command output.
Accounts and licensing	A valid rl-secure license with site key is required to use the Docker image. The size of analyzed files is deducted from the monthly analysis capacity tied to the user's rl-secure account.	An active Portal account with a Personal Access Token is required to use the Docker image. The size of analyzed files is deducted from the monthly limit configured for the user's group and designated for projects.

Select a Docker image to access its configuration and usage instructions:

rl-scanner (CLI)

Official ReversingLabs Docker image for the Spectra Assure CLI.

rl-scanner-cloud (Portal)

Official ReversingLabs Docker image for the Spectra Assure Portal.

Spectra Assure CLI integrations

This section lists the official Spectra Assure CLI integrations currently provided by ReversingLabs. All integrations come with usage instructions and examples.

In general, the CI/CD integrations rely on the rl-scanner Docker image to run rl-secure in a container, scan a single build artifact, and generate an analysis report.

A valid, active rl-secure license with a site key is required to use the integrations.

Action: rl-scanner only ☍

Uses the rl-scanner Docker image to scan a build artifact, generate the report, and display the analysis status as a check in the GitHub interface.

Action: rl-scanner composite ☍

Extends the 'rl-scanner-only' functionality to upload the reports automatically without requiring additional workflow configuration.

Jenkins

A guide for integrating rl-secure as a stage in an existing Jenkins pipeline using the rl-scanner Docker image.

TeamCity

A guide for integrating rl-secure into an existing TeamCity setup with the TeamCity GUI using the rl-scanner Docker image.

Azure DevOps Template ☍

A template for integrating rl-secure in Azure DevOps Pipelines using the rl-scanner Docker image.

Azure DevOps Extension ☍

An Azure DevOps Marketplace extension for integrating rl-secure in Azure DevOps Pipelines.

GitLab CI ☍

A GitLab CI configuration that can be remotely included in pipelines to integrate rl-secure using the rl-scanner Docker image.

Spectra Assure Portal integrations

This section lists the official Portal integrations currently provided by ReversingLabs. All integrations come with usage instructions and examples.

In general, the CI/CD integrations rely on the rl-scanner-cloud Docker image to connect to a Portal instance from the container and upload the artifact to the Portal for scanning.

An active Portal account with a Personal Access Token is required to use the integrations.

Action: rl-scanner-cloud-only ☍

Uses the rl-scanner-cloud Docker image to upload and scan a build artifact on the Portal, and displays the analysis status as a check in the GitHub interface. Optionally downloads and saves analysis reports.

Action: rl-scanner-cloud-composite ☍

Extends 'rl-scanner-cloud-only' to automatically upload reports to GitHub, update the commit status and return the exit status. Optionally downloads and saves analysis reports.

Azure DevOps Template ☍

A template for integrating the Portal in Azure DevOps Pipelines using the rl-scanner-cloud Docker image.

Azure DevOps Extension ☍

An Azure DevOps Marketplace extension for integrating the Portal in Azure DevOps Pipelines.

GitLab CI ☍

A GitLab CI configuration that can be remotely included in pipelines to integrate with the Portal using the rl-scanner-cloud Docker image.

Spectra Assure Portal SDK

ReversingLabs provides an official Python SDK (software development kit) for the Spectra Assure Portal. You can use it to integrate the Portal and interact with it in your own applications. The SDK provides access to operations supported by the Portal API.

You can install the SDK library directly from PyPI as spectra-assure-sdk.

For usage instructions and examples, refer to the documentation in the SDK GitHub repository.

Build your own integrations

Download Spectra Assure policy metadata

ReversingLabs maintains a public GitHub repository with metadata source files for Spectra Assure policies. All Spectra Assure products use this same metadata in analysis reports. The metadata repository is a valuable resource for everyone who plans to integrate Spectra Assure products into their solutions and workflows.

Access the metadata

Leverage the Spectra Assure Portal API

The Portal API is a public resource that you can use to automate common Portal actions and use the Projects feature more efficiently. The API can help you speed up workflows in your development and DevOps teams, integrate with other software supply chain security tools, and build your own solutions on top of Spectra Assure Portal.

Get started with the API