Videos
From finding to fix: fixing the top action in your Spice Labs portfolio
Follow one finding from the portfolio to a fixed build.
What to fix next in the Spice Labs portfolio ranks every action by severity, by how far it reaches, and by the criticality of the subjects it touches. Open the top action to see what is wrong, what to do, and where it is.
The fix is a one-line change in pom.xml that upgrades the library to the recommended version. The application is rebuilt and the new build is surveyed with the Surveyor CLI, the same command as the first survey. When the new survey is in, the portfolio updates.
Step by step guides: https://docs.spicelabs.io
Chapters
Transcript
0:00 Introduction This is a remediation engineer's view of Spice Labs. It follows one finding from the top of the portfolio to a fixed build. What to fix next ranks every action by severity, by how far it reaches, and by the criticality of the subjects it touches. The engineer starts at the top, which here is upgrading the Bouncy Castle cryptography library.
0:21 What is wrong and what to do Open the action to see what is wrong, what to do about it, and where it is. It shows the advisories against this version, the suggested upgrade checked against known advisories, and the application that ships it.
0:33 The fix The fix is a one-line change in pom.xml that upgrades Bouncy Castle to the version the action recommends. Rebuild, then survey the new build with the same command as the first survey.
0:45 The portfolio updates When the new survey is in, the portfolio updates. The scores and the ranked list now reflect the fixed build, and the next action is at the top. Find it, fix it, survey again. The step by step guides on docs.spicelabs.io cover reports, portfolios and what to fix next.