In this demo, I'll show you just how easy installing OWASP Dependency‑Check is.
The command line tool is available in two forms, a
downloadable Java program and a Docker image.
The Docker image is great.
It's a very portable way to run Dependency‑Check, and it's
especially suited for build pipelines. But, so that we can focus on
the tool itself and not get distracted by Docker stuff, we're going
to use a downloadable Java version.
That means that before you can run Dependency‑Check,
you'll need to have the Java Runtime installed on
your system, version 8 or newer.
We can download Dependency‑Check from the official OWASP website.
The link to the download page is going to be in the
resources at the end of this course,
but you can easily find it by going to owasp.org and putting
Dependency‑Check in the search bar at the top of the page.
Hit Enter, and click on the first result that comes back.
That takes us to the main site for the Dependency‑Check project, and it's
well worth having a read of this page to understand the tool in OWASP's
own words. Scroll down a bit, and on the right‑hand side you'll see
Downloads, and you want the first option,
Command Line. Hit that, and a ZIP file download of the most recent version
will start. Installing Dependency‑Check is as simple as just unzipping that
download to wherever you want to install it.
I'm going to put it at the top of my C drive.
Once it's unzipped,
you can go into the bin directory, and you will find both Windows Batch and
Linux Shell scripts for whichever operating system you're using.
Finally,
I recommend adding this bin folder to your path environment
variable so that you don't need to reference the full
installation path when you're invoking the tool.
Once you've done all that,
you can open a terminal window anywhere you'd like and run
dependency‑check ‑v, and if the install was successful,
you'll see the Dependency‑Check version reported back to you.