SonarQube
Configuration
Following configuration assumes SonarQube on prem. As LF is moving to SonarCloud, the setup might be different.
Each project should have jjb file to integrate with CI.
To add SonarQube scan, the jjb file should be modified with the following changes:
- mvn-settings
- mvn-params
- gerrit-maven-sonar job
Here is an example:
- project:
name: portal_user_interface
project: portal_user_interface
project-name: portal_user_interface
mvn-settings: portal_user_interface-settings
mvn-params: '-f AECPortalMgmt'
nexus-iq-namespace: 'akraino-'
build-node: centos7-builder-2c-1g
stream: master
jobs:
- '{project-name}-maven-jobs'
- gerrit-maven-sonar
views:
- project-view
Currently, global-jjb has jobs for Java/maven, Python/tox, and C/cmake. Other languages will have to create their own job templates. For the supported global-jjb jobs, it's just a matter of including the job (such as "gerrit-maven-sonar"), and any parameters that the job requires, in each project's jjb file.
Here's some additional documentation on the Sonar jobs/macros we have set up:
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-maven-jobs.html#lf-infra-maven-sonar
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-python-jobs.html#lf-infra-tox-sonar
https://docs.releng.linuxfoundation.org/projects/global-jjb/en/latest/jjb/lf-c-cpp-jobs.html#cmake-sonar
Scan Result
SonarQube scan results can be accessed from https://sonar.akraino.org. You should be able to log in with your LFID credentials, the same as you would use for Gerrit or Jenkins.
Bug Severity in SonarQube and mapping to Akraino security requirements
| SonarQube | Akraino |
|---|---|
| Blocker | Critical |
| Critical | Important |
| Major | Important |
| Minor | Moderate |
| Info | Low |
Vuls
Vuls will be integrated with Validation Framework (Bluval User Guide)
Below are the list of tasks for the integration.
- Install Vuls containers (https://vuls.io/docs/en/install-with-docker.html). Vuls containers can be found at: https://hub.docker.com/u/vuls/
- Install go-cve-dictionary, run "docker pull vuls/go-cve-dictionary"
- Install goval-dictionary, run "docker pull vuls/goval-dictionary"
- Install gost, run "docker pull vuls/gost"
- Install vuls, run "docker pull vuls/vuls"
- Set up and run (https://vuls.io/docs/en/tutorial-docker.html)
- Write Bluval configuration file for security tests
- SSH key generation & distribution: As Vuls connects to target server through SSH, and Vuls has to use SSH key-based authentication. There needs to be a way to generate SSH key pair, save the private key for Vuls container and dispatch the public key to target server. We probably don’t want to store the private key with the container image if the container image is public accessible.
- Download and start Vuls container to run tests
- Push test results to LF Nexus
- Show test results in Bluval UI
Lynis
Lynis requires to run on SUT (System Under Test). The overall test framework will the similar to that of Vuls. As to the Lynis installation, there are two options:
- Lynis is pre-installed on SUT by project team.
- Lynis is to be installed as part of test flow from Validation Framework.
Considering the complexity of installing application on target system, it is recommended that option 1 is to be used.