How VEX Fields Are Determined in Global Reports

When you generate a global report that includes multiple projects from different project groups, Black Duck SCA uses a closest common ancestor approach to determine which values to use for VEX fields like legal_disclaimer and namespace.

What Does This Mean?

Black Duck SCA looks at the project group hierarchy and finds the nearest project group that is a parent (ancestor) to all selected projects. The VEX field values from that common ancestor project group are used in the report.

How It Works: Examples

Example 1: Direct Common Parent

Project hierarchy:

Root (Black Duck Project Groups)
└── Project Group C
├── Project Group A
│   └── Project 1
└── Project Group B
    └── Project 2

When you select: Project 1 and Project 2

Common ancestor: Project Group C

Result: VEX fields from Project Group C are used in the report.

Example 2: Higher-Level Common Parent

Project hierarchy:

Root (Black Duck Project Groups)
└── Project Group D
    ├── Project Group C
    │   └── Project Group A
    │       └── Project 1
    └── Project Group B
        └── Project 2

When you select: Project 1 and Project 2

Common ancestor: Project Group D

Result: VEX fields from Project Group D are used in the report.

Example 3: Single Project Selected

Project hierarchy:

Root (Black Duck Project Groups)
└── Project Group D
    └── Project Group C
        └── Project Group A
            └── Project 1

When you select: Only Project 1

Common ancestor: Project Group A (the immediate parent)

Result: VEX fields from Project Group A are used in the report.

Example 4: No Shared Parent (Uses Root)

Project hierarchy:

Root (Black Duck Project Groups)
├── Project Group C
│   └── Project Group A
│       └── Project 1
└── Project Group D
    └── Project Group B
        └── Project 2

When you select: Project 1 and Project 2

Common ancestor: Root (no other shared parent exists)

Result: VEX fields from the Root project group are used in the report.

Key Takeaways

Black Duck SCA finds the nearest project group that is a parent to all selected projects
VEX field values from that ancestor project group are applied to the report
If projects have no common parent, root-level VEX fields are used
For single-project reports, the immediate parent project group is used