...

https://github.com/hyperledger/besu/security/dependabot

LGTM

running on PRs

CodeQL analysis

This doesn't provide anything better than sonar cloud.

•  Added here https://github.com/hyperledger/besu/pull/3774

Running on main3324And it took 19 minutes https://github.com/hyperledger/besu/runs/4933198025?check_suite_focus=true

Trivy

Teku uses Trivy, and scans the develop docker images. So scan results only include runtime dependencies not build or test dependencies. See https://github.com/ConsenSys/teku/blob/master/.circleci/config.yml

•  Nightly scan of docker image for Besu Besu - sample report https://githubapp.circleci.com/pipelines/github/hyperledger/besu/pull/334612961/workflows/dde97a21-0eb3-4345-8767-0d4490a2ee44/jobs/71864

NexusIQ

It is from sonatype https://blog.sonatype.com/nexus-vulnerability-scanner-and-vulnerability-analysis but I couldn’t even try it out without agreeing to a whole bunch of stuff on behalf of company so did not proceed.

...

Integrates quite nicely with github but there is a lot of noise. 

•  Also integrates with DockerHub but only admins can see the report

Image Added

Dependency check gradle plugin

Useful but we don't want to gate PRs on this.

There is also a homebrew option

Maven central

Maven central does an ok job of pointing out some CVEs https://mvnrepository.com/artifact/org.hyperledger.besu.internal/eth/21.10.6 

...