Xygeni publishes a SHA-256 checksum of published components in the xygeni/xygeni GitHub repository, so you may verify the integrity of a downloaded artifact.
This GitHub repository website is hosted in a completely different platform from the download site. Hackers need to compromise two different sites to keep tampered components, like the scanner or the installation script, undetected by the checksum verification.
To ensure that the downloaded installation script checksum matches the checksum published in Xygeni repository, meaning that probably it was not tampered with:
Go your profile pannel and navigate to Organization/Personal Tokens:
Create a new token. The difference betweeen Organization tokens and Personal tokens is who can see and revoke those tokens. Select either one and generate a new token.
In order to run scans, the only permission that is needed is the "Upload scan results" permission. However, if you want to use the same token with the REST API, you’ll need to grant it additional permissions.
Set XYGENI_TOKEN environment variable
In order to run scans, a new environment variable must be set, the name of this variable must be "XYGENI_TOKEN" and it content has to be the token that was created in the previous step.
Add this line at the end of the file:
Apply the changes:
This will create the XYGENI_TOKEN environment variable for the current user.
(Recommended) Add the scanner folder to path
In order to execute the Xygeni application as another command, the Xygeni Scanner folder must be added to the path.
This step is optional but highly recommended to facilitate future scans.
Add this line at the end of the file:
Apply the changes:
This will modify the Current User Path.
What’s next?
Congratulations, at this point you should have your installation successfully completed.
Now, let’s run your first scan. Move to your installation directory and execute the command:
