Overview

Code Insight 2020 R3 includes usability and productivity improvements related to projects by unifying inventory-only and standard project capabilities into a single unified project. Users can now perform remote agent-based scanning with more comprehensive scan server-based scanning in a a single project. Furthermore, Analysis Workbench, Code Insight's web-based comprehensive analysis interface, now supports file operations for codebase files from remote scans as well as server scans.

Below is a high-level summary of the changes made in this release:

• The Project Type field has been removed since all new projects no longer need the distinction.
• Legacy inventory-only projects are still supported through 2020; but are likely to be deprecated in 2021.
• New unified projects require updated versions of scan plugins; inventory-only projects can use the existing projects (Code Insight 2020 R2 and earlier).

• Analysis Workbench has been extended to support remote files:
  • Codebase Files and Advanced File Search panels now support a combined view of both remote as well as scan server files.
  • All codebase file tree operations, except for download file, are supported.
  • File evidence view is supported for remote files; however, for 2020 R3, there will not be any evidence returned by remote scans. License evidence will be supported in early 2021.
  • File exact matches and partial matches tabs are disabled for remote files.
  • Files associated with inventory items support a combined view of remote ans scan server files.

• The project dashboard and reports have been updated to include combined data from remote and scan server files

The following improvements are planned in future Code Insight releases:

• Codebase Files and Advanced File Search panels will be improved to display relative paths (to the scan root) as well as include icons representing the source of the codebase files (Code Insight 2020 R4).
• All REST APIs and reports will be refactored to display relative paths (to the scan root) (Code Insight 2020 R4).
• License detection results for remote files will be supported via the Analysis Workbench, REST APIs, and reports (Code Insight 2021 R1).

Migrating from Legacy Inventory Only Projects to the New Unified Projects

Inventory-only projects were used in Code Insight R2 (and earlier) to accommodate remote scanning via scan agents. Some examples of remote scanning include CI/CD scans, docker scans, and local build scans. Starting with Code Insight 2020 R3, server-based scanning and remote scanning can all be accomplished in a single unified project. Existing standard projects from Code Insight 2020 R2 (and earlier) will be automatically converted into the new unified projects in Code Insight 2020 R3. There are cases where legacy inventory-only projects need to be folded into the new unified projects. To accomplish this task, follow the steps below:

1. Navigate to the legacy inventory-only project as a project owner.
2. Click the Manage Project menu button and select the Export Project Data option.
   
   This will produce an archived project data export file (PROJECT_ID-export-DATE_TIME_STAMP.zip). 
3. Navigate to the new unified project into which you want to merge legacy agent results.
   • Configure the desired remote scan plugin.
   • Perform an initial scan using the IDE plugin,  CI/CD build, local build, docker plugin, or the generic scan agent.
   • Import the exported project data from the legacy inventory-only project by navigating to the Manage Project menu button and selecting the Import Project Data option; select the exported zip file created in the previous step, and configure the desired import options.
     
     
4. Review the inventory items and perform any necessary reconciliation tasks.
   
   

How to Handle Scan Results in Cases of Orphaned Plugins

There may be cases where a plugin that was used to perform remote scans for a given project is no longer desired. The plugin alias is treated as a unique identifier for a plugin instance for a given project. Perhaps the build has been modified or moved to another server; or the plugin alias has been updated. In such cases, the Code Insight project will not know how to reconcile the change, and will instead create a new root codebase node for the updated plugin configuration. In such a case, the scan results for the previous (now orphaned) plugin configuration will remain as-is, which essentially becomes a false-positive since that plugin is no longer active.

While we plan on implementing a user-invoked purge feature to handle this scenario, the steps below outline a process that can be used today to clean up the data:

1. Branch the existing project using the project branching feature in 2020 R3.
   
   As part of the branching process, a snapshot of the Scan Server codebases for the source project will be created for the new project. A scan on these codebases will be performed along with a project data import overlay to ensure that the scan results and file-audit data in the new project are comparable to those in the source project.
2. Next re-configure the existing plugins (associated with the source project) to point to the new project, and then force each plugin to perform a scan to populate the new project. Do NOT perform this step for the plugin that is no longer desired in the source project.
3. When all desired plugin scans for the new project have been performed, run an export on the source project and import the results into the new project. This step incorporates all of the manual audit work (if any) previously performed on the plugin scan results into the new project.
4. Optionally, delete the source project.

Now your new project should be a clone of the old one, minus the scan results of the removed plugin.

Contacting Support

If you have any questions about the project changes in Code Insight 2020 R3 or about the procedures included in this article, access the Get Support menu on the Revenera Community at http://www.revenera.com.