Build engineer guide

The DigiCert® Software Trust Manager Build engineer is responsible for scanning software using threat detection and also has permission to sign.

提示

For more information about how to run a scan and interpret a scan report, refer to Threat detection.

Download client tools

ReversingLabs scanning tool (rl-deploy) is included in Software Trust Manager client tools package.

To download client tools:

Sign in to DigiCert ONE.
Navigate to: Manager menu (top right) > Software Trust.
Select Resources > Client tool repository.
Download the following based on your operating system:
Windows Clients Installer
Linux Clients

Create your credentials

When you sign your software, your API key and client authentication certificate authenticate you to DigiCert® Software Trust Manager, not your DigiCert ONE username and password. The API key and client authentication certificate provide two-factor authentication (2FA).

提示

Service users are generally used for automated signing and therefore do not have credentials to access DigiCert ONE. However, service users can still sign and access resources like keys and certificates in DigiCert® Software Trust Manager when authenticated by an API token and client authentication certificate.

Create an API key

An API key is a unique identifier generated by the server to authenticate a user or calling program to an API.

Follow the procedure below based on your user classification:

例 1. User

Users can create their own API token because they have access to DigiCert ONE.

To create an API key:

Sign in to DigiCert ONE.
Navigate to the Profile icon (top right).
Select Admin Profile.
Identify the On this page section (right), select API tokens.
Select Create API Token.
Securely store your API token.
注意
The API token cannot be viewed again.

例 2. Service user

提示

The DigiCert® Account Manager permission: Manage users is required to create an API key for service users.

You can only create an API key for a new service user; you cannot create an API key for an existing user.

To create an API key for a new service user:

Sign in to DigiCert ONE.
Navigate to Manager menu icon (top right).
Select DigiCert® Account Manager > Access > Service users.
Select Create service user.
Complete the fields, and then select Next.
Define the roles and permissions for each selected manager, and then select Add user.
In the window that displays, securely copy and store the service user token ID, which is the user's API key.
注意
The API token cannot be viewed again.

Create a client authentication certificate

A client authentication certificate is a X.509 digital certificate with a unique password that is generated by the server to authenticate a user or calling program to an API.

例 3. User

Users can create their own client authentication certificate because they have access to DigiCert ONE.

To generate a client authentication certificate:

Sign in to DigiCert ONE.
Navigate to the Profile icon (top right).
Select Admin Profile
Identify the On this page section (right), select Authentication Certificates.
Select Create authentication certificate.
Copy the certificate password.
注意
The password cannot be viewed again.
Select Download client authentication certificate.

例 4. Service user

提示

The DigiCert® Account Manager permission: Manage users is required to create a client authentication certificate for someone else.

To create a client authentication certificate for a service user:

Sign in to DigiCert ONE.
Navigate to Manager menu icon (top right).
Select DigiCert® Account Manager > Access > Service users.
Select on the user's name.
Identify the On this page section (right), select Authentication Certificates.
Select Create authentication certificate.
Copy and securely store the certificate password.
注意
The password cannot be viewed again.
Select Download client authentication certificate.

注意

Your API key and client authentication certificate inherit your user permissions orrole.

Secure your credentials

Your DigiCert ONE host environment, API key, client authentication certificate and password make up your environment variables and are required to access Software Trust Manager client tools. You may want to use one of the methods below to securely store your credentials based on your operating system.

例 5. Windows

DigiCert recommends storing your API key and client authentication certificate password in Windows Credential Manager, an encrypted vault, protected from unauthorized access.

例 6. Linux

DigiCert recommends storing your API key and client authentication certificate password in Linux Pass, a password manager that uses GnuPG for encryption and decryption of stored information.

例 7. macOS

DigiCert recommends storing your API key and client authentication certificate password in Keychain Access, an application that stores your passwords and account information.

注意

You can set a proxy to verify the connection, by following the instructions below for your operating system:

WindowsWindows configuration
LinuxLinux configuration
macOS.Apple configuration

Manage threat detection

As a build engineer, you are responsible for scanning software for malware, vulnerabilities, secrets, and more before releasing your software for consumption using our Dynamic Application Security Testing (DAST) service powered by ReversingLabs.

提示

If you do not see Threat detection in the left navigation menu, contact your account manager to add ReversingLabs integration to your service agreement.

Install Static Binary Analysis scanning tool

To install rl-deploy, run the following command in SMCTL:

smctl scan rl-install <new folder path to install>

Command samples

If you have administrator privileges, run this command in Administrator Command Prompt:

smctl scan rl-install "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools\rl"

If you do not want to give rl-deploy administrator privileges, specify an installation location that does not require administrative privileges, such as:

smctl scan rl-install "C:\rl"

Command output

Downloading
[==================================================] 100% [00m:07s]
187090012/187090012 bytes

Unpacking package ...
finished!

提示

Refer to errors and solutions if you encounter an error.

Create a project

Create a project to store all your related software scans, such as different versions of the same software. The software project will be referred to by a descriptive name and a project alias to allow for easy reference.

提示

Project aliases are limited to 150 alphanumeric characters. Underscores and hyphens are also allowed.

To create a project, use the command:

smctl scan project create <project name> <project alias>

Command sample:

smctl scan project create project1 p1

Static Binary Analysis scan command

To scan software with Static Binary Analysis, use the command:

smctl scan rl-scan --input <file to scan> --project <project alias> --scan-alias <scan alias> --version <version>