Your first scan (java thin client)

How to use the dockerized client to execute your first scan

The thin client requires a Java Runtime Environment 1.8+ to run and does not include any standard SDK that is usually needed to produce the dependencies graph of your application. For example, if you want to analyse a Java project based on Maven, then Maven will have to be installed on your machine. The same happens if you want to analyse a .NET project: the .NET SDK will have to be installed and correctly configured on the machine you are running the client from. We expect developers to have their tools on their machines :) but in case they do not, please prefer using the dockerized version of the client, which includes also all the necessary tools.

This guide assumes you are working on a *nix environment: if you are using windows, please refer to the page "Use the thin client on Windows".

1. download the Java Thin Client from the Meterian cloud

curl https://www.meterian.io/downloads/meterian-cli.jar > ~/meterian-cli.jar

2. set up the METERIAN_API_TOKEN environment variable with one of tokens available in the account, or create a new one. We also suggest you add this to your .bashrc

export METERIAN_API_TOKEN=your-token-uuid-here

3. launch the client once to validate everything is working properly (note: the first time the thin client may also be downloaded)

java -jar ~/meterian-cli.jar --version 

Meterian Client v1.2.24.5, build 51bcad7-764

4. move into the folder you have your codebase and execute the client

java -jar ~/meterian-cli.jar

© 2017-2022 Meterian Ltd - dockerized version 2.3.53.699
Meterian Client v1.2.24.5, build 51bcad7-764
© 2017-2022 Meterian Ltd - All rights reserved

System information:
- running locally:   yes
- interactive mode:  off
- working on folder: /home/john/projects/zxing
- autofix mode:      off

Checking folder...
Folder /workspace contains a viable project!

Authorizing the client...
Client successfully authorized

Account: "Acme Team Account"
- Minimum scores:  
  - security:  90
  - stability: 90
  - licensing: 90
- Analysis scopes:  
  - security:  packaged components
  - stability: all components
  - licensing: all components

Project information:
- url:    https://github.com/zxing/zxing
- branch: local
- commit: 708b14bef82a087dd0fefbada81398dd2100366c

Java scan - running maven locally...
- maven: loading dependency tree...
- maven: loading dependency tree (alternate)...
- maven: dependencies generated...
Execution successful!

Uploading dependencies information - 23 found...
Done!

Starting build...
Current build status: initialized - the project has been classified as opensource
Current build status: in preparation
Current build status: process advices at 2022-06-13T15:41:33.660

Final results: 
- security:	85	(minimum: 90)
- stability:	98	(minimum: 90)
- licensing:	100	(minimum: 90)

Full report available at: 
https://www.meterian.com/projects/?pid=...&branch=local&mode=eli

Build unsuccessful!
Failed checks: [security]

All done! You can click on the link and see the final report in HTML. you can also ask the system to generate, for example, a console report adding to the command "--console-report" to see immediately all the information. To learn more about it, see the section "Command line parameters".

You can also setup a simple script that will automatically update your client if required:

#!/bin/sh 
curl -s -o "~/meterian-cli.jar" -z "~/meterian-cli.jar" "https://www.meterian.io/downloads/meterian-cli.jar" >/dev/null
java -jar ~/meterian-cli.jar $*