blackduck

What it is and what it does

blackduck is a Python client library for querying and managing Black Duck Hub, Synopsys's software composition analysis platform. It wraps the Hub REST API with a modern Client class that handles session persistence, automatic pagination, and token lifecycle management—features essential for working with Black Duck v2022.2 and later, which enforce maximum page sizes on API responses.

The package is built on requests and python-dateutil and targets Python 3.6 and later. It provides a generator-based interface for traversing paginated resources, making it practical for scanning large component inventories or project lists. The older HubInstance interface remains available for backward compatibility but does not support the new paging model and is no longer maintained; the documentation explicitly recommends migrating to the Client class.

Use it for:

• Automate security scans and retrieve vulnerability data for software components across multiple projects in Black Duck.
• Build CI/CD pipeline integrations to fetch component analysis results and fail builds based on policy violations.
• Export Black Duck project and component inventories to external systems or reporting tools via the REST API.
• Monitor license compliance by querying component license data and generating compliance reports programmatically.
• Manage Black Duck users, roles, and project assignments through API-driven administration workflows.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Python bindings for the Synopsys Black Duck Hub REST API, providing a Client class with automatic paging, session management, and bearer token renewal for querying Black Duck security and component analysis data.

Yes, if you need to integrate Black Duck Hub into Python automation or tooling. The package is actively maintained, has low install friction, and the Client class provides modern session and paging support required for Black Duck v2022.2 and later. Avoid if you are still on older Black Duck versions and cannot migrate code to the Client interface, as the deprecated HubInstance will not work with current server releases.

Install

blackduck on PyPI

pip install blackduck

uv add blackduck

poetry add blackduck

Installing blackduck

Before you install

Low friction install with only two runtime dependencies (requests and python-dateutil). Actively maintained with repository last commit on 2026-05-29 and 100 stars.

License in practice

Licensed under Apache (permissive), allowing commercial and private use with minimal restrictions. Suitable for integration into proprietary or open-source projects.

Quickstart

pip3 install blackduck

from blackduck import Client
import os

bd = Client(
    token=os.environ.get('blackduck_token'),
    base_url="https://your.blackduck.url"
)

for project in bd.get_resource(name='projects'):
    print(project.get('name'))

Requires a Black Duck Hub instance with a valid API token; base URL and authentication credentials must be provided at initialization.

Verify before relying

• Whether the deprecated HubInstance interface remains functional in current Black Duck server versions despite the v2022.2 paging changes.
• Current test coverage and whether pytest suite passes against modern Black Duck releases.
• Whether automatic bearer token renewal works reliably across long-running sessions.
• Compatibility with Black Duck versions prior to v2022.2 and migration path complexity.

Package facts

Evidence: blackduck-1.1.3-py3-none-any.whl

Keywords: api

Tags

More Quality Assurance packages