yetus-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bus...@apache.org
Subject yetus git commit: YETUS-441 Add a plugin that uses OWASP's depenency-check tool.
Date Wed, 09 May 2018 16:48:51 GMT
Repository: yetus
Updated Branches:
  refs/heads/YETUS-441 [created] 154361595


YETUS-441 Add a plugin that uses OWASP's depenency-check tool.

* precommit plugin 'dependency_check' for maven or cli if given
* jenkins job that will handle updating a cached vulnerability database


Project: http://git-wip-us.apache.org/repos/asf/yetus/repo
Commit: http://git-wip-us.apache.org/repos/asf/yetus/commit/15436159
Tree: http://git-wip-us.apache.org/repos/asf/yetus/tree/15436159
Diff: http://git-wip-us.apache.org/repos/asf/yetus/diff/15436159

Branch: refs/heads/YETUS-441
Commit: 1543615957ed11501615a2dd53e98c6148ce305d
Parents: e56ba29
Author: Sean Busbey <busbey@apache.org>
Authored: Wed May 2 11:36:37 2018 -0500
Committer: Sean Busbey <busbey@apache.org>
Committed: Wed May 9 09:42:58 2018 -0700

----------------------------------------------------------------------
 precommit/core.d/00-yetuslib.sh                 |  28 ++
 .../jenkins/owasp-dependency-check-cache.sh     |  93 +++++
 precommit/test-patch.d/dependency-check.sh      | 361 +++++++++++++++++++
 3 files changed, 482 insertions(+)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/yetus/blob/15436159/precommit/core.d/00-yetuslib.sh
----------------------------------------------------------------------
diff --git a/precommit/core.d/00-yetuslib.sh b/precommit/core.d/00-yetuslib.sh
index 983dfe6..fbdb70d 100755
--- a/precommit/core.d/00-yetuslib.sh
+++ b/precommit/core.d/00-yetuslib.sh
@@ -293,6 +293,34 @@ function yetus_add_array_element
   fi
 }
 
+## @description return the array index of given element
+## @audience    public
+## @stability   stable
+## @replaceable yes
+## @param       arrayname
+## @param       element
+## @returns     0 found
+## @returns     1 not found
+## @returns     stdout array index
+function yetus_array_index_of
+{
+  local arr_name=$1
+  local needle=$2
+  # shellcheck disable=SC2016
+  local -a 'arr_keys=("${!'"$1"'[@]}")'
+  local entry
+
+  # shellcheck disable=SC2154
+  for entry in "${arr_keys[@]}"; do
+    local valueref="${arr_name}[${entry}]"
+    if [[ "${!valueref}" = "${needle}" ]]; then
+      echo "${entry}"
+      return 0
+    fi
+  done
+  return 1
+}
+
 ## @description  Sort an array by its elements
 ## @audience     public
 ## @stability    stable

http://git-wip-us.apache.org/repos/asf/yetus/blob/15436159/precommit/jenkins/owasp-dependency-check-cache.sh
----------------------------------------------------------------------
diff --git a/precommit/jenkins/owasp-dependency-check-cache.sh b/precommit/jenkins/owasp-dependency-check-cache.sh
new file mode 100755
index 0000000..def06e1
--- /dev/null
+++ b/precommit/jenkins/owasp-dependency-check-cache.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# no shelldocs required from this file
+# SHELLDOC-IGNORE
+
+# Make sure that bash version meets the pre-requisite
+
+if [[ -z "${BASH_VERSINFO[0]}" ]] \
+   || [[ "${BASH_VERSINFO[0]}" -lt 3 ]] \
+   || [[ "${BASH_VERSINFO[0]}" -eq 3 && "${BASH_VERSINFO[1]}" -lt 2 ]]; then
+  echo "bash v3.2+ is required. Sorry."
+  exit 1
+fi
+
+INSTALL_URL_DEFAULT="http://dl.bintray.com/jeremy-long/owasp/dependency-check-3.1.2-release.zip"
+
+set -e
+function usage {
+  echo "Usage: ${0} [options] /path/to/data/cache/directory"
+  echo ""
+  echo "    --dependency-check /path/to/exec  Optionally point to 'dependency-check' cli."
+  echo "    --install /path/to/dir            download and cache dependency-check cli."
+  echo "    --install-url url                 where the cli download is."
+  echo "                                          default: ${INSTALL_URL_DEFAULT}"
+  echo "    --help                            show this usage message."
+  exit 1
+}
+# if no args specified, show usage
+if [ $# -lt 1 ]; then
+  usage
+fi
+
+# Get arguments
+declare dependency_check
+declare install
+declare install_url="${INSTALL_URL_DEFAULT}"
+declare cache_dir
+while [ $# -gt 0 ]
+do
+  case "$1" in
+    --dependency-check) shift; dependency_check=$1; shift;;
+    # make this an absolute path
+    --install) shift; install="$(cd "$(dirname "$1")"; pwd)/$(basename "$1")"; shift;;
+    --install-url) shift; install_url=$1; shift;;
+    --) shift; break;;
+    -*) usage ;;
+    *)  break;;  # terminate while loop
+  esac
+done
+
+# Should still have the required arg
+if [ $# -lt 1 ]; then
+  usage
+fi
+# Absolute path
+cache_dir="$(cd "$(dirname "$1")"; pwd)/$(basename "$1")"
+
+# If we didn't point to an exec, check for install cache
+if [ -z "${dependency_check}" ] && [ -n "${install}" ]; then
+  # if we have things cached, just point at it otherwise do an install
+  if [ ! -x "${install}/dependency-check/bin/dependency-check.sh" ]; then
+    if [ ! -d "${install}" ]; then
+      mkdir "${install}"
+    fi
+    echo "Downloading '${install_url}' to '${install}'" >&2
+    curl --location -o "${install}/dependency-check.zip" "${install_url}"
+    unzip "${install}/dependency-check.zip" -d "${install}"
+    rm -f "${install}/dependency-check.zip"
+  fi
+  dependency_check="${install}/dependency-check/bin/dependency-check.sh"
+fi
+
+# if we don't point at something by now, give the path a try
+if [ -z "${dependency_check}" ]; then
+  dependency_check=$(which dependency-check)
+fi
+echo "Dependency check CLI version: $("${dependency_check}" --version)"
+"${dependency_check}" --updateonly --data "${cache_dir}"
+echo "Done updating cache in '${cache_dir}'"

http://git-wip-us.apache.org/repos/asf/yetus/blob/15436159/precommit/test-patch.d/dependency-check.sh
----------------------------------------------------------------------
diff --git a/precommit/test-patch.d/dependency-check.sh b/precommit/test-patch.d/dependency-check.sh
new file mode 100644
index 0000000..11629cc
--- /dev/null
+++ b/precommit/test-patch.d/dependency-check.sh
@@ -0,0 +1,361 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# SHELLDOC-IGNORE
+
+DEPENDENCY_CHECK_ARGS=()
+DEPENDENCY_CHECK_SUPPRESSION_FILES=()
+DEPENDENCY_CHECK_EXCLUDES_PATTERNS=()
+DEPENDENCY_CHECK_TIMER="0"
+DEPENDENCY_CHECK_SEVERITIES=("High" "Medium" "Low")
+DEPENDENCY_CHECK_SEVERITY="${DEPENDENCY_CHECK_SEVERITIES[0]}"
+DEPENDENCY_CHECK_UPDATE=true
+DEPENDENCY_CHECK_EXPERIMENTAL=false
+DEPENDENCY_CHECK_MAVEN_GOAL=check
+
+add_test_type dependency_check
+
+## @audience     private
+function dependency_check_usage
+{
+  yetus_add_option "--dependency-check=<path>" "path to the dependency-check executable"
+  yetus_add_option "--dependency-check-severity-threshold=<value>" "ignore findings
with a 'highest severity' lower than this. default: ${DEPENDENCY_CHECK_SEVERITY}"
+  yetus_add_option "--dependency-check-suppression=<list>" "path(s) to suppression
XML file(s). see https://s.apache.org/ahw7"
+  yetus_add_option "--dependency-check-excludes=<list>" "list of ant style exclusions"
+  yetus_add_option "--dependency-check-experimental" "enable experimental analyzers."
+  yetus_add_option "--dependency-check-no-updates" "suppress updates of CVE information"
+  yetus_add_option "--dependency-check-data-file=<path>" "path to local H2 database"
+  yetus_add_option "--dependency-check-db-connection-string=<string>" "iff shared db,
jdbs connection string"
+  yetus_add_option "--dependency-check-db-driver-name=<classname>" "iff shared db,
jdbc driver name"
+  yetus_add_option "--dependency-check-db-driver-jar=<path>" "iff shared db, driver
jar path"
+  yetus_add_option "--dependency-check-db-username=<name>" "iff shared db, username"
+  yetus_add_option "--dependency-check-db-password=<passwor>" "iff shared db, password"
+  yetus_add_option "--dependency-check-maven-goal=<goal>" "iff maven build, the plugin
goal to use. default: ${DEPENDENCY_CHECK_MAVEN_GOAL}"
+}
+
+## @audience     private
+function dependency_check_parse_args
+{
+  declare i
+
+  for i in "$@"; do
+    case ${i} in
+      --dependency-check=*)
+        DEPENDENCY_CHECK=${i#*=}
+      ;;
+      --dependency-check-severity-threshold=*)
+        DEPENDENCY_CHECK_SEVERITY=${i#*=}
+      ;;
+      --dependency-check-suppression=*)
+        yetus_comma_to_array DEPENDENCY_CHECK_SUPPRESSION_FILES "${i#*=}"
+      ;;
+      --dependency-check-excludes=*)
+        yetus_comma_to_array DEPENDENCY_CHECK_EXCLUDES_PATTERNS "${i#*=}"
+      ;;
+      --dependency-check-experimental)
+        DEPENDENCY_CHECK_EXPERIMENTAL=true
+      ;;
+      --dependency-check-no-updates)
+        DEPENDENCY_CHECK_UPDATE=false
+      ;;
+      --dependency-check-data-file=*)
+        DEPENDENCY_CHECK_DATA_FILE=${i#*=}
+      ;;
+      --dependency-check-db-connection-string=*)
+        DEPENDENCY_CHECK_DB_CONNECTION=${i#*=}
+      ;;
+      --dependency-check-db-driver-name=*)
+        DEPENDENCY_CHECK_DB_DRIVER=${i#*=}
+      ;;
+      --dependency-check-db-driver-jar=*)
+        DEPENDENCY_CHECK_DB_DRIVER_JAR=${i#*=}
+      ;;
+      --dependency-check-db-username=*)
+        DEPENDENCY_CHECK_DB_USER=${i#*=}
+      ;;
+      --dependency-check-db-password=*)
+        DEPENDENCY_CHECK_DB_PASSWORD=${i#*=}
+      ;;
+      --dependency-check-maven-goal=*)
+        DEPENDENCY_CHECK_MAVEN_GOAL=${i#*=}
+      ;;
+    esac
+  done
+
+}
+
+## @audience     private
+function dependency_check_filefilter
+{
+  declare filename=$1
+
+  case ${BUILDTOOL} in
+    maven)
+      if [[ ${filename} =~ pom\.xml$ ]]; then
+        yetus_debug "tests/dependency_check: ${filename}"
+        add_test dependency_check
+      fi
+    ;;
+    *)
+      add_test dependency_check
+    ;;
+  esac
+}
+
+## @audience     private
+function dependency_check_precheck
+{
+  declare dependency_check_version
+
+  if ! yetus_array_contains "${DEPENDENCY_CHECK_SEVERITY}" "${DEPENDENCY_CHECK_SEVERITIES[@]}"
; then
+    yetus_error "Dependency check doesn't know about severity level '${DEPENDENCY_CHECK_SEVERITY}'"
+    return 1
+  fi
+
+  case ${BUILDTOOL} in
+    maven)
+      if [ "${#DEPENDENCY_CHECK_EXCLUDES_PATTERNS[@]}" -gt 0 ]; then
+        yetus_error "dependency_check: The maven plugin doesn't support exclusion patterns."
+        return 1
+      fi
+    ;;
+    *)
+      if ! verify_command "dependency_check" "${DEPENDENCY_CHECK}"; then
+        add_vote_table 0 dependency_check "dependency-check was not available."
+        delete_test dependency_check
+        return 0
+      fi
+    ;;
+  esac
+
+  # Can't give both data file and db connection info
+  if [ -n "${DEPENDENCY_CHECK_DATA_FILE}" ] && [ -n "${DEPENDENCY_CHECK_DB_CONNECTION}"
]; then
+    yetus_debug "Both a local datafile and an external db were given on the cli, behavior
of dependency-check isn't well defined."
+  fi
+
+  # finally let folks know what version they'll be dealing with.
+  dependency_check_version=$(${DEPENDENCY_CHECK} --noupdate --version 2>/dev/null | head
-n 1 2>/dev/null)
+  add_footer_table dependency_check "version: ${dependency_check_version}"
+}
+
+## @audience     private
+function dependency_check_initialize
+{
+  local -a filtered_severities
+  local -i severity_threshold
+  severity_threshold=$(yetus_array_index_of "DEPENDENCY_CHECK_SEVERITIES" "${DEPENDENCY_CHECK_SEVERITY}")
+  yetus_debug "Looking for severities in our list ranked up to ${severity_threshold}"
+  for key in "${!DEPENDENCY_CHECK_SEVERITIES[@]}"; do
+    if [ ! "${key}" -gt "${severity_threshold}" ]; then
+      filtered_severities=("${filtered_severities[@]}" "${DEPENDENCY_CHECK_SEVERITIES[${key}]}")
+    fi
+  done
+  yetus_debug "Given severity threshold of '${DEPENDENCY_CHECK_SEVERITY}' we'll look for:
${filtered_severities[*]}"
+  # The quotes here are important, because we want to match an entire CSV record
+  IFS=" " read -r -a DEPENDENCY_CHECK_LOG_FILTERS <<< "$(printf -- '-e "%s" ' "${filtered_severities[@]}")"
+
+  case ${BUILDTOOL} in
+    maven)
+      if [[ "${DEPENDENCY_CHECK_EXPERIMENTAL}" = "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DenableExperimental=true")
+      fi
+      if [[ "${DEPENDENCY_CHECK_UPDATE}" = "false" ]] || [[ "${OFFLINE}" == "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DautoUpdate=false")
+      fi
+      if [[ "${OFFLINE}" == "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DcentralAnalyzerEnabled=false")
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DnexusAnalyzerEnabled=false")
+      fi
+      if [ -n "${DEPENDENCY_CHECK_DATA_FILE}" ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DdataDirectory=${DEPENDENCY_CHECK_DATA_FILE}")
+      fi
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-Dformat=ALL")
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DversionCheckEnabled=false")
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DskipProvidedScope=true")
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DskipSystemScope=true")
+      if [ "${#DEPENDENCY_CHECK_SUPPRESSION_FILES[@]}" -gt 0 ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DsuppressionFiles=$(printf
-- "%s," "${DEPENDENCY_CHECK_SUPPRESSION_FILES[@]}")")
+      fi
+      if [ -n "${DEPENDENCY_CHECK_DB_CONNECTION}" ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DconnectionString=${DEPENDENCY_CHECK_DB_CONNECTION}")
+        if [ -n "${DEPENDENCY_CHECK_DB_DRIVER}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DdatabaseDriverName=${DEPENDENCY_CHECK_DB_DRIVER}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_DRIVER_JAR}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DdatabaseDriverPath=${DEPENDENCY_CHECK_DB_DRIVER_JAR}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_USER}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DdatabaseUser=${DEPENDENCY_CHECK_DB_USER}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_PASSWORD}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "-DdatabasePassword=${DEPENDENCY_CHECK_DB_PASSWORD}")
+        fi
+      fi
+    ;;
+    *)
+      if [[ "${DEPENDENCY_CHECK_EXPERIMENTAL}" = "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --enableExperimental)
+      fi
+      if [[ "${DEPENDENCY_CHECK_UPDATE}" = "false" ]] || [[ "${OFFLINE}" == "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --noupdate)
+      fi
+      if [[ "${OFFLINE}" == "true" ]]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --disableCentral)
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --disableNexus)
+      fi
+      if [ -n "${DEPENDENCY_CHECK_DATA_FILE}" ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --data "${DEPENDENCY_CHECK_DATA_FILE}")
+      fi
+
+      if [ -n "${DEPENDENCY_CHECK_DB_CONNECTION}" ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --connectionString "${DEPENDENCY_CHECK_DB_CONNECTION}")
+        if [ -n "${DEPENDENCY_CHECK_DB_DRIVER}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --dbDriverName "${DEPENDENCY_CHECK_DB_DRIVER}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_DRIVER_JAR}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --dbDriverPath "${DEPENDENCY_CHECK_DB_DRIVER_JAR}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_USER}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --dbUser "${DEPENDENCY_CHECK_DB_USER}")
+        fi
+        if [ -n "${DEPENDENCY_CHECK_DB_PASSWORD}" ]; then
+          DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --dbPassword "${DEPENDENCY_CHECK_DB_PASSWORD}")
+        fi
+      fi
+
+      if [ "${#DEPENDENCY_CHECK_SUPPRESSION_FILES[@]}" -gt 0 ]; then
+        local -a suppressions
+        IFS=" " read -r -a suppressions <<< "$(printf -- "--suppression '%s' " "${DEPENDENCY_CHECK_SUPPRESSION_FILES[@]}")"
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "${suppressions[@]}")
+      fi
+      if [ "${#DEPENDENCY_CHECK_EXCLUDES_PATTERNS[@]}" -gt 0 ]; then
+        local -a excludes
+        IFS=" " read -r -a excludes <<< "$(printf -- "--exclude '%s' " "${DEPENDENCY_CHECK_EXCLUDES_PATTERNS[@]}")"
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" "${excludes[@]}")
+      fi
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --format ALL)
+      DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --project "${PROJECT_NAME}")
+      if [ -n "${BASEDIR}" ]; then
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --scan "${BASEDIR}")
+      else
+        DEPENDENCY_CHECK_ARGS=("${DEPENDENCY_CHECK_ARGS[@]}" --scan ".")
+      fi
+    ;;
+  esac
+
+
+}
+
+## @audience     private
+function dependency_check_logfilter
+{
+  declare input=$1
+  declare output=$2
+
+  # TODO we should be parsing CSV columns properly
+  yetus_debug "dependency_check: filtering out lines based on severities with '${DEPENDENCY_CHECK_LOG_FILTERS[*]}'"
+
+  "${GREP}" "${DEPENDENCY_CHECK_LOG_FILTERS[@]}" "${input}" > "${output}"
+
+}
+
+## @audience     private
+function dependency_check_postcompile
+{
+  declare repostatus=$1
+  declare reports="dependency_check_${repostatus}.reports"
+  if ! verify_needed_test dependency_check; then
+    return 0
+  fi
+
+  big_console_header "Determining number of dependency concerns (${repostatus})"
+
+  start_clock
+
+  # Add our previously calculated time
+  if [[ "${repostatus}" != branch ]]; then
+    offset_clock "${DEPENDENCY_CHECK_TIMER}"
+  fi
+
+  mkdir "${PATCH_DIR}/${reports}"
+
+  case ${BUILDTOOL} in
+    maven)
+      # invoke on a specific version, because older ones don't support options we need
+      # like CSV report output.
+      # shellcheck disable=2046
+      echo_and_redirect "${PATCH_DIR}/dependency_check_${repostatus}.log" \
+        $(maven_executor) --batch-mode "${DEPENDENCY_CHECK_ARGS[@]}" \
+        "org.owasp:dependency-check-maven:3.1.2:${DEPENDENCY_CHECK_MAVEN_GOAL}"
+
+      if [ ! -f "${BASEDIR:-.}/target/dependency-check-report.csv" ]; then
+        yetus_debug "maven goal did not generate csv report"
+        add_vote_table 0 dependency_check "${BUILDMODEMSG} maven goal did not generate needed
report"
+        return 1
+      fi
+      # TODO get the plugin to allow configuring the output directory to something other
than the project build dir.
+      # TODO maybe use the archive functionality here?
+      mv "${BASEDIR:-.}/target/dependency-check-"*{csv,html,json,xml} "${PATCH_DIR}/${reports}/"
+    ;;
+    *)
+      echo_and_redirect "${PATCH_DIR}/dependency_check_${repostatus}.log" \
+          "${DEPENDENCY_CHECK}" "${DEPENDENCY_CHECK_ARGS[@]}" \
+          --log "${PATCH_DIR}/dependency_check_${repostatus}.verbose.log" \
+          --out "${PATCH_DIR}/${reports}"
+    ;;
+  esac
+
+  generic_logfilter dependency_check \
+      "${PATCH_DIR}/${reports}/dependency-check-report.csv" \
+      "${PATCH_DIR}/dependency_check_${repostatus}_filtered.csv"
+
+  if [[ "${repostatus}" = branch ]]; then
+    DEPENDENCY_CHECK_TIMER=$(stop_clock)
+  else
+    # shellcheck disable=SC2016
+    numPostpatch=$(wc -l < "${PATCH_DIR}/dependency_check_patch_filtered.csv")
+
+    # iff the branch report doesn't already exist, we must be in a qbt build via --empty-patch
+    if [ -f "${PATCH_DIR}/dependency_check_branch_filtered.csv" ]; then
+      calcdiffs \
+        "${PATCH_DIR}/dependency_check_branch_filtered.csv" \
+        "${PATCH_DIR}/dependency_check_patch_filtered.csv" \
+        dependency_check \
+          > "${PATCH_DIR}/diff-dependency-check.csv"
+      diffPostpatch=$(wc -l < "${PATCH_DIR}/diff-dependency-check.csv")
+
+      # shellcheck disable=SC2016
+      numPrepatch=$(wc -l < "${PATCH_DIR}/dependency_check_branch_filtered.csv")
+    else
+      numPrepatch=0
+      diffPostpatch="${numPostpatch}"
+      cp "${PATCH_DIR}/dependency_check_patch_filtered.csv" \
+         "${PATCH_DIR}/diff-dependency-check.csv"
+    fi
+
+    statstring=$(generic_calcdiff_status "${numPrepatch}" "${numPostpatch}" "${diffPostpatch}"
)
+
+    if [[ ${diffPostpatch} -gt 0 ]] ; then
+      add_vote_table -1 dependency_check "${BUILDMODEMSG} ${statstring}"
+      add_footer_table dependency_check "@@BASE@@/diff-dependency-check.csv"
+      return 1
+    fi
+
+    add_vote_table +1 dependency_check "${BUILDMODEMSG} ${statstring}"
+  fi
+  return 0
+}
+


Mime
View raw message