Skip to content

Commit f968ab6

Browse files
dylanbthomasdylanbthomas
authored
Merge pull request #44 from fortify/fcli-upgrade
Fcli upgrade to 2.4.0
2 parents aca4563 + 97925c5 commit f968ab6

23 files changed

+628
-408
lines changed

‎build_spec.yaml‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,16 @@ shell: bash
66
env:
77
# these are local variables to the build config
88
variables:
9+
"JAVA_HOME" : "/usr/lib64/graalvm/graalvm-java17"
910
# the value of a vaultVariable is the secret-id (in OCI ID format) stored in the OCI Vault service
1011
# you can then access the value of that secret in your build_spec.yaml commands
1112
vaultVariables:
1213
# Use below variables for FORTIFY ON DEMAND integration
13-
FOD_TENANT: ocid1.vaultsecret.oc1.XXXXXXX # TENANT ID
14-
FOD_USER: ocid1.vaultsecret.oc1.XXXXXXX # FOD USER KEY
15-
FOD_PWD: ocid1.vaultsecret.oc1.XXXXXXX # FOD PAT
16-
FOD_RELEASE_ID: ocid1.vaultsecret.oc1.XXXXXXX # FOD APPLICATION BASED RELEASE ID
14+
FCLI_DEFAULT_FOD_TENANT: ocid1.vaultsecret.oc1.XXXXXXX # TENANT ID
15+
FCLI_DEFAULT_FOD_USER: ocid1.vaultsecret.oc1.XXXXXXX # FOD USER KEY
16+
FCLI_DEFAULT_FOD_PASSWORD: ocid1.vaultsecret.oc1.XXXXXXX # FOD PAT
17+
FCLI_DEFAULT_FOD_URL: ocid.vaultsecret.oc1.XXXXXXX # FOD URL
18+
FOD_RELEASE_ID: ocid1.vaultsecret.oc1.XXXXXXX # FOD APPLICATION BASED RELEASE ID
1719
# Use below variables for FORTIFY SCANCENTRAL integration
1820
FCLI_DEFAULT_SC_SAST_CLIENT_AUTH_TOKEN: ocid1.vaultsecret.oc1.XXXXXXX # SCANCENTRAL CLIENT AUTH TOKEN FOR HANDSHAKE
1921
FCLI_DEFAULT_SSC_USER: ocid1.vaultsecret.oc1.XXXXXXX # SSC USERNAME
@@ -28,14 +30,18 @@ steps:
2830
name: "Install Prereqs"
2931
command: |
3032
java -version
31-
yum install -y java-11-openjdk-devel
32-
alternatives --display java
33-
alternatives --set java /usr/lib/jvm/java-11-openjdk-11.0.18.0.10-1.el7_9.x86_64/bin/java
34-
java -version
33+
yum -y install graalvm-17-native-image
34+
export PATH=$JAVA_HOME/bin:$PATH
3535
36+
#yum install -y java-11-openjdk-devel
37+
#alternatives --display java
38+
#alternatives --set java /usr/lib/jvm/java-11-openjdk-11.0.18.0.10-1.el7_9.x86_64/bin/java
39+
java -version
3640
# install Maven
37-
yum install maven
41+
#yum install maven
42+
3843
mvn --version
44+
3945
onFailure:
4046
- type: Command
4147
timeoutInSeconds: 40

‎buildspec.yml‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@ env:
33
parameter-store:
44
###############################################################
55
# INTEGRATE FORTIFY ON DEMAND #
6-
FOD_RELEASE_ID: "/fod/releaseid"
7-
FOD_TENANT: "/fod/tenant"
8-
FOD_USER: "/fod/user"
9-
FOD_PAT: "/fod/pat"
6+
# FOD_RELEASE_ID_LOCAL: "/fod/releaseid"
7+
# FCLI_DEFAULT_FOD_TENANT_LOCAL: "/fod/tenant"
8+
# FCLI_DEFAULT_FOD_URL_LOCAL: "/fod/url"
9+
# FCLI_DEFAULT_FOD_CLIENT_ID_LOCAL: "/fod/client_id"
10+
# FCLI_DEFAULT_FOD_CLIENT_SECRET_LOCAL: "/fod/client_secret"
1011
###############################################################
1112
# INTEGRATE FORTIFY SCANCENTRAL #
1213
FCLI_DEFAULT_SC_SAST_CLIENT_AUTH_TOKEN: "/fortify/client_auth_token"
@@ -15,13 +16,14 @@ env:
1516
FCLI_DEFAULT_SSC_CI_TOKEN: "/fortify/ci_token"
1617
FCLI_DEFAULT_SSC_URL: "/fortify/ssc_url"
1718
SSC_APP_VERSION_ID: "/fortify/ssc_app_versionid"
19+
SSC_IP_LOCAL: "/fortify/ssc_ip"
1820
phases:
1921
install:
2022
runtime-versions:
21-
java: corretto11
23+
java: corretto17
2224
commands:
2325
# Upgrade AWS CLI to the latest version
24-
- pip install --upgrade awscli
26+
#- pip install --upgrade awscli
2527
pre_build:
2628
commands:
2729
- mvn clean
@@ -30,25 +32,19 @@ phases:
3032
- mvn -Pwar clean package
3133
post_build:
3234
commands:
33-
# Do not remove this statement. This command is required for AWS CodeStar projects.
34-
# Update the AWS Partition, AWS Region, account ID and project ID in the project ARN in template-configuration.json file so AWS CloudFormation can tag project resources.
35-
- sed -i.bak 's/\$PARTITION\$/'${PARTITION}'/g;s/\$AWS_REGION\$/'${AWS_REGION}'/g;s/\$ACCOUNT_ID\$/'${ACCOUNT_ID}'/g;s/\$PROJECT_ID\$/'${PROJECT_ID}'/g' template-configuration.json
3635
###############################################################
3736
# INTEGRATE FORTIFY SAST #
3837
# #
3938
# For FORTIFY ON DEMAND uncomment the next line #
4039
#- bash devops-integrations/aws/fortify-sast-fod.bash
40+
#- bash devops-integrations/aws/fortify_sast_local_java_template.bash
4141
# #
4242
# For FORTIFY SCANCENTRAL uncomment the next line #
4343
- bash devops-integrations/aws/fortify_sast_scancentral.bash
4444
# #
4545
# #
46-
###############################################################
46+
###############################################################
4747
artifacts:
4848
files:
49-
- 'appspec.yml'
50-
- 'template.yml'
51-
- 'scripts/*'
5249
- 'devops-integrations/aws/*'
5350
- 'target/iwa.war'
54-
- 'template-configuration.json'

‎cloudbuild.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@
99
# - $$SSC_APP_VERSION_ID
1010

1111
steps:
12-
- name: maven:3.6.0-jdk-11-slim
12+
- name: maven:3.9.7
1313
entrypoint: 'mvn'
1414
args: ['-q', 'clean', 'package', '-DskipTests']
1515

1616
- name: 'gcr.io/cloud-builders/docker'
1717
args: ['build', '-t', 'gcr.io/$PROJECT_ID/iwa_java:latest', '-t', 'gcr.io/$PROJECT_ID/iwa_java:$COMMIT_SHA', '-t', 'gcr.io/$PROJECT_ID/iwa_java:$BUILD_ID', '.']
1818
id: 'build-image-IWAJava'
1919

20-
- name: 'fortifydocker/fortify-ci-tools:3.14.0-jdk-11'
20+
- name: 'fortifydocker/fortify-ci-tools:5.4.1-jdk-17'
2121
entrypoint: bash
2222
args:
2323
- -c
@@ -27,10 +27,10 @@ steps:
2727
fcli sc-sast session login
2828
2929
scancentral package -bt mvn -o package.zip
30-
fcli sc-sast scan start --appversion=$$SSC_APP_VERSION_ID --upload --sensor-version=$$SC_SAST_SENSOR_VERSION --package-file=package.zip --store='?'
30+
fcli sc-sast scan start --publish-to=$$SSC_APP_VERSION_ID --sensor-version=$$SC_SAST_SENSOR_VERSION --package-file=package.zip --store=Id
3131
32-
fcli sc-sast scan wait-for '?' --interval=30s
33-
fcli ssc appversion-vuln count --appversion=$$SSC_APP_VERSION_ID
32+
fcli sc-sast scan wait-for ::Id:: --interval=30s
33+
fcli ssc issue count --appversion=$$SSC_APP_VERSION_ID
3434
3535
echo Terminating connection with Fortify Platform
3636
fcli sc-sast session logout
@@ -39,7 +39,7 @@ steps:
3939
env:
4040
- 'FORTIFY_IP=${_PUBLIC_IP}'
4141
- 'SSC_APP_VERSION_ID=${_SSC_APP_VERSION_ID}'
42-
- 'SC_SAST_SENSOR_VERSION=22.2'
42+
- 'SC_SAST_SENSOR_VERSION=24.2'
4343
id: 'fortify-static-scan'
4444
waitFor: ['build-image-IWAJava']
4545

@@ -61,7 +61,7 @@ steps:
6161
- '--allow-unauthenticated'
6262
id: 'deploy-to-cloud-run'
6363

64-
- name: 'fortifydocker/fortify-ci-tools:3.14.0-jdk-11'
64+
- name: 'fortifydocker/fortify-ci-tools:5.4.1-jdk-17'
6565
entrypoint: "bash"
6666
args:
6767
- "-c"
@@ -70,7 +70,7 @@ steps:
7070
fcli ssc session login
7171
fcli sc-dast session login
7272
73-
fcli sc-dast scan start $$SC_DAST_SCAN_NAME --settings $$SC_DAST_CICD_IDENTIFIER
73+
fcli sc-dast scan start --name=$$SC_DAST_SCAN_NAME --settings=$$SC_DAST_CICD_IDENTIFIER
7474
7575
echo Terminating connection with Fortify Platform
7676
fcli sc-dast session logout

‎devops-integrations/.circleci/config-fortify-dast-scancentral.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# - $FCLI_DEFAULT_SSC_PASSWORD
66
# - $FCLI_DEFAULT_SSC_CI_TOKEN
77
# - $FCLI_DEFAULT_SSC_URL
8-
# - $SSC_APP_VERSION_ID
8+
# - $SC_DAST_CICD_IDENTIFIER
99
version: '2.1'
1010
jobs:
1111
deploy:
@@ -15,6 +15,7 @@ jobs:
1515
- checkout
1616
- run:
1717
command: |
18+
echo Deploying artifacts
1819
jf config add --url=$ARTIFACTORY_URL --user=$ARTIFACTORY_USER --password=$ARTIFACTORY_API_KEY --interactive=false
1920
jf rt u "(*).jar" example-repo-local/circleci/ --recursive=false
2021
@@ -24,7 +25,7 @@ jobs:
2425
SC_DAST_CICD_IDENTIFIER: "<<NNNNNNNNNNNNNNNN>>"
2526
working_directory: ~/circleci-iwajava-scancentral
2627
docker:
27-
- image: fortifydocker/fortify-ci-tools:3.14.0-jdk-11
28+
- image: fortifydocker/fortify-ci-tools:5.4.1-jdk-17
2829

2930
steps:
3031
- checkout
@@ -35,8 +36,8 @@ jobs:
3536
#Use --insecure switch when SSL certificates are self-generated
3637
fcli ssc session login
3738
fcli sc-dast session login
38-
39-
fcli sc-dast scan start $SC_DAST_SCAN_NAME --settings $SC_DAST_CICD_IDENTIFIER
39+
40+
fcli sc-dast scan start --name=$SC_DAST_SCAN_NAME --settings=$SC_DAST_CICD_IDENTIFIER
4041
4142
echo Terminating connection with Fortify Platform
4243
fcli sc-dast session logout

‎devops-integrations/.circleci/config-fortify-sast-fod.yml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
# Integrate Fortify on Demand Static AppSec Testing (SAST) into your Circle CI pipeline
22
# Renaming this file to config.yml for leveraging the file directly otherwise copy scan job content
33
# The following environment variables must be defined in CircleCI context before using this job
4-
# - $FOD_RELEASE_ID
5-
# - $FOD_USER
6-
# - $FOD_PAT
7-
# - $FOD_TENANT
4+
# - $FCLI_DEFAULT_FOD_TENANT
5+
# - $FCLI_DEFAULT_FOD_CLIENT_ID
6+
# - $FCLI_DEFAULT_FOD_CLIENT_SECRET
7+
# - $FCLI_DEFAULT_FOD_URL
88
version: '2.1'
99
jobs:
1010
build:
1111
working_directory: ~/circleci-iwajava
1212
docker:
13-
- image: maven:3.8.6-openjdk-11
13+
- image: maven:3.8.7-openjdk-18
1414

1515
steps:
1616
- checkout
@@ -33,21 +33,28 @@ jobs:
3333

3434
scan:
3535
environment:
36-
FOD_URL: "https://ams.fortify.com"
37-
FOD_API_URL: "https://api.ams.fortify.com"
38-
FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf"
3936
FOD_NOTES: "Triggered by CircleCI Pipeline"
37+
FOD_RELEASE_ID: <NNNNNNNN>
4038
working_directory: ~/circleci-iwajava
4139
docker:
42-
- image: fortifydocker/fortify-ci-tools:latest
40+
- image: fortifydocker/fortify-ci-tools:5.4.1-jdk-17
4341

4442
steps:
4543
- checkout
4644

4745
- run:
4846
command: |
47+
echo Setting connection with Fortify Platform
48+
#Use --insecure switch if the SSL certificate is self generated.
49+
fcli fod session login
50+
4951
scancentral package -bt mvn -oss -o package.zip
50-
FoDUpload -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid $FOD_RELEASE_ID -tc $FOD_TENANT -uc $FOD_USER $FOD_PAT $FOD_UPLOADER_OPTS -n "$FOD_NOTES"
52+
fcli fod sast start --release=$FOD_RELEASE_ID --file=package.zip --remediation=NonRemediationScanOnly --notes=$FOD_NOTES --store=Id
53+
54+
fcli fod sast wait-for ::Id:: --interval=30s
55+
fcli fod issue list --release=$FOD_RELEASE_ID
56+
57+
fcli fod session logout
5158
5259
# Orchestrate job run sequence
5360
workflows:

‎devops-integrations/.circleci/config-fortify-sast-scancentral.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
build:
1313
working_directory: ~/circleci-iwajava-scancentral
1414
docker:
15-
- image: maven:3.8.6-openjdk-11
15+
- image: maven:3.8.7-openjdk-18
1616

1717
steps:
1818
- checkout
@@ -36,10 +36,10 @@ jobs:
3636
sast:
3737
environment:
3838
SSC_APP_VERSION_ID: "<<$$$$>>"
39-
SC_SAST_SENSOR_VERSION: "22.2"
39+
SC_SAST_SENSOR_VERSION: "24.2"
4040
working_directory: ~/circleci-iwajava-scancentral
4141
docker:
42-
- image: fortifydocker/fortify-ci-tools:3.14.0-jdk-11
42+
- image: fortifydocker/fortify-ci-tools:5.4.1-jdk-17
4343

4444
steps:
4545
- checkout
@@ -52,10 +52,10 @@ jobs:
5252
fcli sc-sast session login
5353
5454
scancentral package -bt mvn -o package.zip
55-
fcli sc-sast scan start --appversion=$SSC_APP_VERSION_ID --upload --sensor-version=$SC_SAST_SENSOR_VERSION --package-file=package.zip --store='?'
55+
fcli sc-sast scan start --publish-to=$SSC_APP_VERSION_ID --sensor-version=$SC_SAST_SENSOR_VERSION --package-file=package.zip --store=Id
5656
57-
fcli sc-sast scan wait-for '?' --interval=30s
58-
fcli ssc appversion-vuln count --appversion=$SSC_APP_VERSION_ID
57+
fcli sc-sast scan wait-for ::Id:: --interval=30s
58+
fcli ssc issue count --appversion=$SSC_APP_VERSION_ID
5959
6060
echo Terminating connection with Fortify Platform
6161
fcli sc-sast session logout

0 commit comments

Comments
 (0)